Back to basics on NHS networking

Costs

The NHS Executive is currently paying £3.8m a year for hospital trust and health authority links to NHSnet centrally, which includes unlimited access to the internet (data provided by the NHS Information Authority in response to an “open access code” request). The figure shows that the costs of use of NHSnet have grown linearly over the past five years. The NHS Executive is also meeting centrally the costs of messaging, which are estimated at £2.8m for 1999-2000. The crude mean cost to the NHS Executive of connection and messaging for 1999-2000 is therefore about £10 600 per organisation. The NHS Information Authority was unable to provide us with data on general practitioners' and other primary care use of NHSnet, but told us that about 70% of computerised practices were connected at the end of August 2000.

Total charges for use of NHSnet between 1995-6 and 1999-2000

• Download figure
• Open in new tab
• Download powerpoint

Evidence about the internet is also limited. The investment costs are not known, principally because of its long gestation and the large number of organisations involved in developing it. The costs of internet connection and messaging vary with the nature of the connection. As an example, the company Demon Internet offer a leased line for a 64 kb connection to the internet, comparable to NHSnet, for £4700 a year (see table). Once connected, the cost of 100 000 messages (which is the approximate number of messages per health authority or hospital trust a year) is zero for Demon Internet and about £24 000 for NHSnet. These figures can only be indicative, as the two networks offer different services to users—and in principle the NHS could even set up as an internet service provider in its own right—but they illustrate the order of costs associated with each strategy.

Benefits

For benefits, reliable figures are again elusive. The NHS Executive hopes that NHSnet will help save £100m a year in NHS running costs. 4 6 However, convincing evidence of cost savings is lacking,7 as is evidence of clinical or management benefits attributable to NHSnet. More generally, there is scant evidence about the costs and benefits of the NHSnet networking technology in non-health settings. 8

9 Similarly, the benefits attributable to the internet have not been quantified, but observation of the rapid growth of internet connections10 and the large volume of health related resources on the world wide web suggest that it is widely judged to be useful.

In the absence of direct evidence about benefits, one measure that sheds light on the relative values of the two strategies is the extent to which NHS organisations are actually using NHSnet and the internet. Some 200 000 X.400 messages (the main messaging protocol used for messaging within NHSnet) were sent each day over NHSnet in late 1999. In October 1999, a further 52 000 messages came into NHSnet from the internet, and 60 000 went out from NHSnet to the internet. Thus, 112 000 out of 312 000 messages, or about a third of all NHSnet messages, were moving between NHSnet and the internet. In March 2000 there were 4.221 million X.400 messages and 3.371 million SMTP messages (the latter are principally messages sent to or from the internet by means of one of the main internet protocols). This shows an increase to about 244 000 messages a day. Since almost all the SMTP messages would have been communications with the internet then about 44% of messages were sent to or from internet sites. These patterns of use, revealing users' actual preferences, suggest that access to the internet is valued by NHS users.

Security

Security has been one of the main sources of controversy about NHSnet.1 Security threats can be external, from people attempting to hack into the network, or internal, with authorised staff misusing their access to sensitive data. 13 14 A study by the Audit Commission of fraud and abuse of information technologies indicated that a half of all public sector organisations are now affected.15

We gather that there have been attempts to hack into NHSnet from outside but that the electronic defences have withstood the attacks. The situation with regard to internal misuse is less clear. There has always been a code of conduct for connection to NHSnet. Initially it focused on screening potential users, through a complicated administrative process that users found difficult to understand and which required them to agree to abide by strict security rules. A new code of connection was published in 1999,16 which seems to be much simpler to administer and includes policies on acceptable use and network security. We were told that the incidence of attempted misuse has been low to date.

On the internet, security is the responsibility of those who send and receive data. Large commercial firms are now confident about maintaining email and web links, and “e-commerce” is growing rapidly.10 Indeed, companies can allow privileged users to gain access to and alter their own data. But, equally, there have been several accounts of major security breaches. The issue of security, by itself, does not help us to discriminate between NHSnet and the internet.

Reliability

Reliability is a key goal for both NHSnet and the internet. NHSnet adopted a closed network approach, broadly similar to that used by banks and other institutions that manage large volumes of transactions every day. In contrast, the internet uses protocols developed for ARPAnet, the original US military network that spawned the internet, with arbitrary routing over open networks to avoid problems such as broken links or nodes. Proper comparison of reliability is difficult, but NHSnet was “down” for about 2.2% of the time in late 1999 (although we were told that this has improved this year), and Demon Internet business services were down for around 1% of the time (see table). This criterion seems to favour the internet, though not decisively.

Membership

There are also differences between NHSnet and the internet on the issue of membership. NHSnet was conceived as a dedicated NHS network, and almost all health authorities and NHS trusts are now connected. This excluded patients, all health care provided outside the NHS, and many statutory organisations that need to communicate with the NHS (see box). In retrospect it seems that the NHS was viewed as a self contained organisation rather than one inextricably linked to the world around it. This position is changing, and there are now plans to link social services and other organisations to NHSnet. But the logical outcome must be a network with many non-NHS users, which tends to undermine the argument for sole reliance on a private network.

The internet, in contrast, tends to encourage membership (though this is not the same as saying that it is an inclusive technology). Anyone with access to a personal computer and modem can use the internet at relatively low cost. Its resources are available to all—including clinicians, who already use it to search for evidence on good clinical practice and to exchange emails with one another and with patients.17-19 The internet does not pose any technical barriers to people in different organisations communicating. This criterion tends to favour the internet, though it does not rule out a solution using a public and private network in tandem.

Sustainability

A sustainable networking strategy is one that allows individuals and organisations to change their own working practices, and the ways in which they use a network, and yet be able to continue to use the network without serious impediment. In effect this means that the economics of the solution, as well as the technology itself, must continue to make sense. In the case of information technologies, exposure to dynamic markets may lead to both cost reductions and innovations, which suggests that the NHS should use systems and software that are “open” and have many suppliers.

It is not widely appreciated that both NHSnet and the internet allow the use of two messaging standards, X.400 and SMTP: the difference, until now, has been that X.400 has been the standard for NHSnet, whereas SMTP has emerged as an internet standard. The difference may seem to be purely technical, but it has important implications for the evolution of networks. Support for niche standards such as X.400 leads users to become “locked in” to the few suppliers who offer it, and they risk having to pay monopoly prices and the standard not being supported in the longer term.

The decision to support SMTP as well as X.400 was taken by the NHS Executive in late 1999, though it was not widely publicised.2 The decision is an economic as well as a technical one. Hitherto, economic sustainability has been a crucial weakness in the argument for NHSnet, because a series of decisions about the design of the network led to the risk of “lock in” and obsolescence.