Silicon Practice Digital Health Solutions (Schappit Ltd) administration – update

FOR IMMEDIATE ACTION: Silicon Practice Digital Health Solutions (Schappit Ltd) administration – update

An updated advisory note on Schappit Ltd, trading as Silicon Practice Digital Health Solutions (Silicon Practice), entering administration, which has resulted in disruption and cessation to services.

We are writing to you because NHS England understands that the administrator has contacted Silicon Practice customers to provide an update.

Our advice remains that impacted organisations should continue to enact business continuity plans (BCP) and put in place contingency provision to address loss and disruption of service.

Impacted GP practices should contact their ICB in the first instance for support. The NHS England Commercial and Procurement Hub is available to underpin this support, providing ICBs and general practices with advice and guidance on procurement, purchasing and contracting for alternative solutions.

The Hub has now contacted all ICBs to offer support. ICBs and practices can contact the Hub at commercial.procurementhub@nhs.net.

Understandably there are many queries coming through and we are responding to these as quickly as possible. An FAQs document is in development and will be shared with regional digital teams by close today (29 October) to support ongoing updates on key areas of concern. 

We are aware that an urgent position is required on domain ownership to support practices in establishing new websites as a specific requirement.

The rest of this note reaffirms the immediate business critical and patient safety actions required from regions, ICBs, impacted practices and associated organisations, including trusts (defined in this instance as “Silicon users”), which were issued to you last week.

 Two CAS alerts have already been issued to relevant practices for expediency given potential operational and clinical safety impact.

Actions for Regions:

NHS England’s regional digital teams are responsible for providing appropriate oversight and assurance of primary and secondary care IT responsibilities in ICB and Trust providers.

Regional digital teams should: 

• Contact affected ICBs and Trusts and confirm that the issue is being actively managed.
• Consider how regional communications team can support proactive patient communications
• Provide a named owner and contact from the region and the ICB or Trust’s to NHS England Digital Services for Integrated Care (DSIC) Team at england.dsicportfoliooffice@nhs.net.
• Work with the national Digital Primary Care team to assess impact and update on progress.

Actions for ICBs:

ICBs have responsibility for GP IT service arrangements and the requirements of the GP IT Operating Model. This includes appropriate clinical safety, data security, cyber security and business continuity assurance across the GP IT supply chain.

ICBs must therefore:

• Continue to engage with the Commercial and Procurement Hub.
• Confirm with their region who is leading this on behalf of the ICB.
• Forward this NOC-ROC operational note onto ICB Heads of Digital Transformation, ICB Heads of Primary Care, medical directors and communication leads.
• Contact affected practices and trusts within their ICB area and forward them this NOC-ROC operational note for immediate action.
• Urgently work with regions to validate current position, impact and progress – noting that a separate commission on this is to follow via regional teams.
• Work with practices and other impacted organisations to support them in revisiting and assessing whether to enact business continuity and disaster recovery plans (BCDR).
• Support practices to put alternative solutions in place.
• Work with regions to validate the organisations listed in the annex. Noting this is based on information provided by Silicon Practice but we are aware this may not be accurate and so ICBs will need to confirm the position with each practice, including identifying any practices affected that may not be on this list.

Actions for impacted practices:

If you haven’t already so, you will need to urgently work with your ICB to assess whether to enact business continuity and disaster recovery plans to minimise risk of losing access to outstanding patient requests and ongoing patient access and communications.

This includes:

• Identifying which affected products are in use (Online Consultation, Practice website).
• Identifying if other (non-Silicon Practice) digital tools are impacted by loss of access to websites, i.e. they are no longer available due to websites being down
• If your affected practice website provides access to other online practice services, such as online consultation, you should consider alternative website arrangements or other access routes to ensure patients can continue to access these services.
• Deploying alternate online consultation, website and triage products. Practices can seek advice and support from their ICB (who should be the first point of call) and the NHS Commercial and Procurement Hub. Contactable here commercial.procurementhub@nhs.net.
• Agreeing with the ICB alternative arrangements for patient access until new online systems are available.
• Putting plans in place to maintain patient access to alternative means of contact, such as by telephone and walk-in, and preparing for additional demand.
• Reviewing triage and workflow management processes and putting alternatives in place.
• Actioning patient communications such as SMS and a statement for social media channels and website banners as available. With instructions on how to contact the practice or attend a scheduled appointment by other means.

In parallel, please also prioritise: 

• Escalating any clinical safety, patient safety or information governance concerns through established local processes, including incident reporting and any required regulatory notifications.
• Reporting any impact on patients via the Learn from Patient Safety Events service (https://www.england.nhs.uk/patient-safety/patient-safety-insight/learning-from-patient-safety-events) using “Silicon” in the incident description so that this can be monitored and assessed nationally.
• Discussing with the practice Data Protection Officer whether there is a requirement to inform the Information Commissioners Office where there is evidence that the incident has affected the availability, integrity, confidentiality or recoverability of personal data.
• Considering professional Duty of Candour requirements and professional responsibilities regarding informing patients and service users.

Recognising that the potential impact on practices will vary depending on which products are in use and to what extent.

Practices must confirm their mitigation plans with the relevant ICB and / or the Commercial and Procurement Hub and discuss any concerns, including impact, with them. Feedback will help the national team shape support required.

Actions for secondary care:

Trusts should work with regions to urgently review their business continuity and disaster recovery arrangements in relation to the affected knowledge-based healthcare applications.

As set out in the Annex (based on information provided by Silicon Practice so please validate) the principal Trust exposure is to knowledge and information resources rather than online patient engagement tools; contingency planning should therefore focus on maintaining access to this information and identifying appropriate alternative arrangements should the service become unavailable.

This may include:

• Identifying the affected Silicon Practice/Piota products and the clinical or operational services that depend on them, with an appropriate local service, digital and clinical-safety lead.
• Identifying and managing any outstanding patient interactions, tasks, messages, referrals, results, attachments or other workflow items.
• Checking whether relevant patient information has transferred into the trust’s authoritative clinical record.
• Enacting, as necessary, proportionate BCDR arrangements, including safe alternative workflows, staff communications, patient-facing routes and capacity implications.
• Seeking advice from the trust Clinical Safety Officer, CCIO/CMIO, DPO/IG lead, Caldicott Guardian, SIRO/cyber lead and relevant service owner as applicable.
• Recording and escalating any actual clinical-safety, patient-safety, information-governance or cyber incident through the appropriate local route.

In tandem, please also consider:

• Escalating any clinical safety, patient safety or information governance concerns through established local processes, including incident reporting and any required regulatory notifications.
• Reporting any evidence of patient harm via the Learn from Patient Safety Events service (https://www.england.nhs.uk/patient-safety/patient-safety-insight/learning-from-patient-safety-events) using “Silicon” in the incident description so that this can be monitored and assessed nationally.
• Where there is evidence that the incident has affected the availability, integrity, confidentiality or recoverability of personal data, affected organisations should promptly involve their Data Protection Officer or Information Governance lead and, where appropriate, their Caldicott Guardian; document the assessment; and make any required regulatory or individual notifications within the applicable statutory timescales.
• Whether operational communication with patients is needed before harm is established.
• Duty of Candour should be considered separately where the relevant statutory or professional threshold is met.

NHS England national coordination

The incident is being actively managed by NHS England’s Digital Primary Care Team, with coordinating support from Service Bridge, through a Gold Command cadence.

Each region has been asked to confirm a designated lead, as earlier, and Alec Price-Forbes, as below, is the lead Senior Responsible Officer (SRO).

NHS England is working at pace on commercial as well as practical support for those that are impacted to minimise the operational and clinical safety risk as a matter of urgency.

Further updates will be communicated through regions, and we will require regional and ICB feedback on impact and what national support is required. This will help to frame ongoing and coordinated engagement as a priority focus.

Any practice or Trust concerns and feedback on impact should be directed to ICBs in the first instance. Regional and ICB queries should be directed to NHS England Digital Services for Integrated Care (DSIC) Team at england.dsicportfoliooffice@nhs.net