NHS Prescription Services: the impact of legacy ICT 1 AUGUST 2013 NHS Business Services Authority The National Audit Office scrutinises public spending for Parliament and is independent of government. The Comptroller and Auditor General (C&AG), Amyas Morse, is an Officer of the House of Commons and leads the NAO, which employs some 860 staff. The C&AG certifies the accounts of all government departments and many other public sector bodies. He has statutory authority to examine and report to Parliament on whether departments and the bodies they fund have used their resources efficiently, effectively, and with economy. Our studies evaluate the value for money of public spending, nationally and locally. Our recommendations and reports on good practice help government improve public services, and our work led to audited savings of almost £1.2 billion in 2012. Our vision is to help the nation spend wisely. Our public audit perspective helps Parliament hold government to account and improve public services. Contents Summary 4  Part One 6  The National Audit Office's assessment of government's legacy ICT 6  Part Two 8  The NHS Business Services Authority 8  Prescription Services 8  The service model 11  Part Three 14  Financial and performance analysis 14  Service and system performance 14  Financial analysis 17  Part Four 20  Our enterprise analysis of the NHS Prescriptions Service and the management of the legacy system 20  Part Five 29  The lessons learned from the impact of legacy ICT on the Authority's prescriptions service 29  Appendix One 32  Timeline 32  Appendix Two 33  Methodology 33  Appendix Three 34  Enterprise analysis framework 34  Appendix Four 37  National Audit Office reports on government ICT 37  4 Summary NHS Prescription Services: the impact of legacy ICT Summary 1 The NHS Business Services Authority (the Authority) is an arm's-length body of the Department of Health. NHS Prescription Services is one of the services supplied by the Authority. It calculates how much pharmacists, GPs who dispense and appliance contractors should be paid as reimbursement and remuneration for medicines and medical devices dispensed to patients from NHS prescription forms. The Authority processes around 4 million prescription items every working day and payments amount to around £9 billion a year.1 2 The National Audit Office examined the way the Authority manages its prescription pricing information and communication technology (ICT), and the impact of legacy ICT on the delivery of the NHS Prescriptions Service. The service currently depends on two ICT systems; the Capacity Improvement Programme system, known as CIP; and an older system, known within the Authority as the legacy system. We found:  In 2005, the Authority identified issues with its legacy system and made the decision to replace it with CIP. The Authority then took a sensible approach towards implementation with a feasibility study before moving to a controlled pilot and then a phased roll-out, targeting the bulk of the transactions for first migration. This means that less than 1 per cent of transactions are now carried out on the legacy system.  We found that the Authority actively monitors its exposure to risks related to technology approaching end-of-life. The legacy system is stable and meets the current needs of the fee-paying customers and internal system users, despite the hardware being supported by the supplier on a 'best endeavours' basis.2  The legacy system is unable to comply with the latest NHS information standards for drugs and medicines. The Authority is focussing on the delivery of priorities, such as the NHS reform and accuracy improvements required by the Department of Health and therefore has not yet formulated a robust value for money case to either replace or retain the remaining legacy system.  The IT strategy is currently being refreshed and will include the replacement of the legacy system alongside other strategic objectives. This will enable engagement with stakeholders regarding risk, cost, prioritisation and funding. 1 ttp://www.nhsbsa.nhsh.uk/PrescriptionServices/809.aspx 2 The McDonnell Douglas hardware and spare parts are no longer commercially available and replacements are drawn from stock that has been decommissioned since the introduction of CIP. NHS Prescription Services: the impact of legacy ICT Summary 5  The newer CIP system, operational since 2007, has improved the speed and cost of processing through the use of modern scanning equipment. However, there remains a dependence on the processing of paper prescription forms. From April to December 2012, only 5.4 million prescription line items were submitted electronically, which represents less than 1 per cent of total transactions. It may be many years before electronic transfer of prescriptions is fully adopted and while the Authority has a strong preference for the electronic submission of prescriptions for reasons of accuracy and efficiency; it has no control over take-up of electronic submissions. For this reason we do not consider the benefits of such a development, particularly with regard to combating prescription fraud through enhanced interface with other electronic records.  We have estimated that, in 2011-12 the cost of processing a prescription line item on the legacy system was 7.74 pence, compared with 4.08 pence on CIP. This is still above the target 3.35 pence contained within the original CIP business case. Both systems have met the target that 97.5 per cent of items are processed accurately since October 2011.  The number of prescriptions is increasing by an average of 5 per cent a year and there is a desire within the Authority to improve accuracy and reduce costs further across the service. The retention of the legacy system is inefficient as it involves manual input and duplicates development and support effort. There is also a lack of understanding regarding the capacity of the service and the ability of CIP to handle the growth in demand.  The IT service provider is responsible for the disaster recovery arrangements and for carrying out regular tests. We found no evidence of a test being carried out and we were told that a test will be arranged after the recent service provider data centre relocation. While the Authority took steps to ensure roll-back capability at each stage of the move, we would expect a technology recovery test to be successfully carried out as part of these arrangements prior to the relocation in order to provide further assurance that risks arising from the move could be mitigated.  The information governance arrangements are thorough and in line with NHS policy. However, the IT staff we spoke to are unaware of the arrangements and accreditations to deal with the risks of cyber threat, fraud and other security threats. 6 Part One NHS Prescription Services: the impact of legacy ICT Part One The National Audit Office's assessment of government's legacy ICT 1.1 We define legacy ICT as systems and applications that have been operationally embedded within a business function but superseded by newer and often more effective technologies or changed business needs, for example the need to deliver a new policy or deliver a service in a different way. 1.2 Public services that rely on legacy systems face a number of risks. Availability can be impacted through unreliability or failure of worn components. Extending public services to digital channels as per the 'digital by default' strategy as set out in the Government Digital Strategy3 can be constrained by legacy modes of operation - processing jobs as a sequence of batches instead of reacting in real time in a way users of digital services have become accustomed. Additionally, the improvement of public services through their redesign can take longer and be more costly because the skills and knowledge that understands the function of the legacy system have been lost. 1.3 In its ICT strategy,4 the government identified its legacy systems as acting as barriers to transforming public service delivery. These barriers stem from older systems that may use proprietary standards in their technical design that creates challenges when integrating data and processing with modern systems. Despite this, the government's stated preference is to extend the lives of such systems rather than face the risks and costs of replacing them. This was made clear in a response to the Public Administration Select Committee’s (PASC) report on IT in government5 which identified the often key role legacy systems play in public service delivery. PASC recommended that government identifies where and when investment is needed to migrate and replace legacy systems. In response, the government said it preferred to extend the life of legacy systems using software layers it called “wrappers” that would make legacy systems integrate more easily with newer systems. 3 The Cabinet Office, Government Digital Strategy, November 2012, available at http://publications.cabinetoffice.gov.uk/digital/strategy/ 4 The Cabinet Office, Government ICT Strategy, 2011, available at http://www.cabinetoffice.gov.uk/sites/default/files/resources/uk-government-ict-strategy-2011_0.odt 5 House of Commons Public Administration Select Committee, Government and IT - "a recipe for rip-offs": time for a new approach: Further Report with the Government Response to the Committee's Twelfth Report of Session 2010-12, Twentieth Report of Session 2010-12, HC 1724, January 2012 NHS Prescription Services: the impact of legacy ICT Part One 7 Subsequently the Cabinet Office issued further advice6 providing more detail on the approach to handling legacy ICT. 1.4 We examined how the public sector manages its legacy ICT systems in relation to service delivery. In particular, we explored public services that continue to be supported by legacy ICT for the foreseeable future. 1.5 We applied our Business Analysis Toolkit7 to assess the impact of legacy ICT on public service performance and costs. The toolkit focuses on three areas of analysis: the service model which describes the key components of service delivery; service performance over time, with associated costs and risks; and an enterprise analysis8 measuring how mature the organisation is in managing, operating and maintaining the service, including its legacy ICT. 1.6 This report is part of a series that examines how well government is managing those public services that rely on legacy ICT systems. There are four reports in this series:  The consumer credit licensing service operated by the Office of Fair Trading using the 6 year old PROMOD system.  The processing and payment of the state pension, a service delivered by the Department for Work and Pensions using the 26 year old Pension Strategy Computer System.  The Value Added Tax (VAT) service operated by HM Revenue & Customs using a series of legacy systems that originally date back to a 40 year old VAT mainframe system.  The prescription processing service operated by the NHS Business Services Authority using the 6 year old Capacity Improvement Programme system and its 17 year old legacy forerunner. 1.7 In Appendix Four we show how this piece of work fits in with other National Audit Office publications on government ICT. 6 The Cabinet Office, Government Service Design Manual, April 2014, available at https://www.gov.uk/service-manual/technology/architecture.html#the-legacy-estate 7 A full description of the methodology used during our fieldwork, including the components of our Business Analysis Toolkit, can be found in Appendix Two. 8 Our enterprise analysis is performed using a framework containing the seven key areas that most impact performance: strategy, governance, implementation, service management, people, process and technology. A full description of the enterprise analysis framework we applied during our fieldwork can be found in Appendix Three. 8 Part Two NHS Prescription Services: the impact of legacy ICT Part Two The NHS Business Services Authority 2.1 The NHS Business Services Authority (the Authority) is an arm's-length body of the Department of Health. It was established on 1 October 2005 and became fully operational on 1 April 2006. It brought together five previously separate NHS groups into a single organisation:  Prescription Pricing Authority  NHS Pensions Agency  Dental Practice Board  NHS Logistics Authority  NHS Counter Fraud and Security Management Service Authority. Prescription Services 2.2 NHS Prescription Services, which is one of the services supplied by the Authority, calculates the remuneration and reimbursement due to pharmacists, GPs and appliance contractors for medicines and medical devices dispensed to patients from NHS prescription forms. The Authority processes more than four million prescription items every working day and payments amount to around £9 billion a year. 2.3 The Authority also provides a variety of information and prescribing related data to NHS stakeholders and the general public. For example, the Electronic Prescribing & Financial Information for Practices service (ePFIP) allows GP practices to interrogate their prescribing data; manage, monitor and control their prescribing habits and costs; monitor and manage drug expenditure against budget; and compare and manage their prescribing performance against national and Primary Care Trust (PCT) comparators. While the Authority does not make payment direct to dispensing GP practices or to GPs, it provides a file of the payment data to NHS Connecting for Health to facilitate PCTs making the necessary payment to dispensing practices. While information services form a significant part of the role of the Authority, they are beyond the scope of this report. NHS Prescription Services: the impact of legacy ICT Part Two 9 Prescription pricing ICT 2.4 The Authority currently uses two ICT systems to process prescriptions: the Capacity Improvement Programme (CIP) system, and an older system, known within the Authority as the legacy system. The vast majority of prescriptions are handled by CIP, with less than 1 per cent being processed by the legacy system. The Authority's aim is to transfer all remaining prescription services to the CIP system and decommission the legacy system. 2.5 The legacy system, implemented in 1996, is composed of the McDonnell Douglas Information System (MDIS) which provides the operator terminals and the Sun Pricing System (SPS) which provides the calculation and validation capability. 2.6 The legacy system relies on operators manually keying information from paper prescriptions into the system. On average, 593,000 prescriptions items were processed per month in 2011-12 by the legacy system, primarily on behalf of the Channel Islands and the Isle of Man, who are charged a fee to use the service, which provided an income of around £630,000 in 2011-12. The legacy system is also used for late prescription claims, private practice prescriptions, out-of-hours, and local pharmaceutical services (Figure 1). The business rules for these customer groups have not yet been added to the CIP system. Figure 1 Remaining reliance on the legacy system The legacy system handled an average of 593,000 prescription items per month in 2011-12 NOTE 1. 'Other' includes prescriptions provided by private practices, out-of-hours prescriptions and local pharmaceutical services, an alternative contractual arrangement set up in 2006 that is slowly being phased out. Source: National Audit Office analysis 23% 21% 21% 35% Jersey Guernsey Isle of Man Other 10 Part Two NHS Prescription Services: the impact of legacy ICT 2.7 The Capacity Improvement Programme was started in 2005 and the new CIP ICT system went live in March 2007. The programme had three main aims: to efficiently manage payments to contractors as the number of prescriptions grows; to enable the submission of prescriptions electronically via the Electronic Prescriptions Service (EPS); and to address impending risks relating to technology approaching end-of-life. 2.8 To meet the capacity demands, CIP implemented high-speed scanning equipment and intelligent character recognition software to capture printed information from prescription forms and automatically process the form. Each scanner processes around 17,000 prescription forms per hour, 70 per cent of which are successfully interpreted by the intelligent character recognition software first time. The remaining 30 per cent require manual intervention to identify the customer or prescription information. The current scanners are now end-of-life and are being replaced with new scanner equipment that is expected to improve both throughput and accuracy, at a cost of £2 million. 2.9 The EPS provides the Authority's customers with the ability to submit prescriptions electronically as an alternative to paper prescription forms. The prescription information is then fed directly into the CIP system, bypassing the paper scanning stage and avoiding some of the accuracy pitfalls associated with scanning and character recognition. The first release of EPS in 2005 did not include the ability to process payments. This function was made available with the second release in 2009 at which time the implementation of electronic submission of prescriptions could proceed. The ownership of EPS transferred from NHS Connecting to Health to the NHS Commissioning Board on 1 April 2013. 2.10 Our focus in this report is the impact of the legacy ICT system on the delivery of Prescription Services. Investing in enhanced electronic submissions through EPS could also be a significant tool in combating known prescription fraud. The policy imperative here is, however, that prescriptions are made to those in medical need, which overrides the need to stringently combat potential fraudulent claims. Whilst this remains the case, the Authority is unlikely to be allowed to invest in the electronic submissions enhancements systems that could combat the risk of such frauds. Such matters are therefore excluded from the scope of our investigation. NHS Prescription Services: the impact of legacy ICT Part Two 11 The service model 2.11 Figure 2 shows the components of the prescription pricing service and defines the scope of our study:  Customers The Authority provides the prescription service to 11,700 pharmacists, 116 appliance contractors and around 47,000 doctors from 8,000 practices (of which just over 1,000 are dispensing doctors) in England, the Channel Islands, and the Isle of Man.  Commissioners The Department of Health is responsible for reimbursement policy in relation to the drugs and appliances dispensed in the community. Responsibility for remuneration policy in relation to dispensing contractor services and the EPS service was transferred to the NHS Commissioning Board from 1 April 2013.  In 2011-12, there were 930 full-time equivalent staff operating the prescription pricing ICT, 11 of whom use the legacy system.  Channels NHS prescription forms are submitted by the customers to claim reimbursement for prescriptions dispensed. These can be submitted in batches of paper prescriptions by post (all legacy customers submit by post) or via EPS. From April to December 2012, 5.4 million prescription line items were submitted electronically, which represents around less than 1 per cent of total transactions, but this figure is expected to grow.  Services NHS Prescription Services calculates how much its customers should be paid as reimbursement and remuneration for medicines and medical devices dispensed to patients from NHS prescription forms. In addition, the Authority also provides a variety of information and prescribing related data to NHS stakeholders and the general public (see paragraph 2.3). 12 Part Two NHS Prescription Services: the impact of legacy ICT Figure 2 Prescription pricing service model NOTE 1. Information services are beyond the scope of this report. Source: National Audit Office analysis  Processes In 2011-12 over 960 million prescription items were processed and payments amounted to around £9 billion. The processing of prescriptions involves the receipt of the prescription forms that contain around four million prescription items per day, the preparation of the batch (for scanning or manual processing) and the identification of the customer and drug information. The reimbursement is then calculated. The level of automation differs depending on the system on which the prescription is processed. These differences are shown in more detail in Figure 3.  Technology and data The prescription pricing service depends on the CIP and legacy systems. Once the information has been captured in either system calculation rules are automatically applied. Some manual validation and handling of exceptions is also carried out, typically for unusual or expensive items, or where customer or drug information has not been successfully recognised by the scanners. NHS Prescription Services: the impact of legacy ICT Part Two 13 2.12 Figure 3 shows that where the legacy system requires manual input of line items and application of the rules, the CIP system provides some automation. Electronic submission of prescriptions is the most efficient and accurate way to process prescriptions but this depends on the PCT and the dispensing pharmacy adopting EPS. Figure 3 Prescription pricing service processes NOTES 1. Type 1 exception handling occurs when it has not been able to accurately obtain customer or charge information from the paper prescription form. 2. Each system actually carries out two payment activities. These are payment to pharmacy contractors and payment information to doctors (CIP/legacy) and the Channel Islands and the Isle of Man (legacy). Source: NAO analysis of prescription pricing processes 14 Part Three NHS Prescription Services: the impact of legacy ICT Part Three Financial and performance analysis 3.1 In this part of the report, we analyse the investment the NHS Business Services Authority (the Authority) has made in the Capacity Improvement Programme (CIP) and the legacy system, the cost of running the prescription pricing service and the performance achieved. 3.2 For this review, we asked the Authority to provide us with service and system performance data for 2010-11 and 2011-12. We also requested cost data for the prescriptions pricing service for the period 2008-09 to 2013-14 and all cost data relating to the legacy system held by the Authority. Data on system availability, system faults and customer satisfaction did not distinguish between the legacy and CIP systems. Due to the introduction of a new service costing model, the Authority was only able to provide us with the cost data for 2011-12 and a forecast for 2012-13. Cost data on those two years was also less detailed than we expect. Service and system performance 3.3 The key volume measure for the prescription service is the total number of line items listed on each prescription form. The total number of prescription line items has grown by an average of 5 per cent per year in the last two years (Figure 4). There are three methods of processing prescription line items:  Items received by post and processed on the CIP system. There were 957 million of these line items in 2011-12, 99.2 per cent of the total.  Items processed on the legacy system. There were 7 million of these in 2011-12, 0.7 per cent of the total.  Items received electronically and processed on the CIP system. We would expect this to be the most efficient and accurate method of processing prescriptions. The number of line items through this route has grown since 2009- 10 but only accounted for 0.1 per cent of the total in 2011-12. NHS Prescription Services: the impact of legacy ICT Part Three 15 Figure 4 Volume and breakdown of prescription line items The number of line items processed by NHS Prescription Services has grown by an average of 5 per cent a year since 2009-10 NOTES 1. The difference between the two CIP processes is explained in Figure 3. 2. The actual number of prescriptions processed through EPS were: 2009-10 - 5,000; 2010-11 - 116,000; 2011-12 - 1,070,000. Source: NAO analysis of Authority data 3.4 The Authority works to a target to process 97.5 per cent of items accurately. This target is a challenge as manual input is required for all legacy prescription line items and the 30 per cent of CIP prescriptions that are not successfully processed automatically by the scanning software. Items that the Authority processed using the legacy system consistently met the accuracy target in 2011-12. The Authority failed to meet its accuracy target for items processed through the CIP system in 2010-11 but has consistently met it from October 2011 onwards (Figure 5). Reductions in error were due to system changes and improved people management by the Authority. Further improvements could be achieved by increasing the number of prescription line items submitted through the Electronic Prescriptions Service (EPS). 16 Part Three NHS Prescription Services: the impact of legacy ICT Figure 5 Performance against accuracy target The legacy system consistently met the accuracy target in 2011-12. Items processed by the CIP system met the accuracy target from October 2011 NOTES 1. CIP accuracy is based on a check of 50,000 transactions a month carried out by an internal quality team. Legacy accuracy is based on an internal check of 80 transactions from each operator. Source: The Authority 3.5 The Authority achieved its target for processing and paying 100 per cent of prescriptions in every month from April 2010 to March 2012. The process requires pharmacists and other customers to send prescriptions for payment by the fifth working day of a month. These are then processed by the Authority and paid 80 per cent at the end of the first month with the balance at the end of the second month. The Authority told us that it has not had a backlog in this process for over 10 years. NHS Prescription Services: the impact of legacy ICT Part Three 17 Financial analysis Expenditure on the prescription pricing service 3.6 The Authority spent £40.7 million on operating the NHS prescription services in 2011-12, equivalent to £42.18 per 1,000 prescription line items processed.9 Of this, £10.5 million (26 per cent) was for ICT. The Authority expects to spend £42.9 million on the service in 2012-13, 5 per cent more than in 2011-12. This is due to a rise in spending on ICT enhancements as discussed below. Excluding ICT enhancements, spending by the Authority is expected to fall by 5 per cent from £39.6 million to £37.8 million. 3.7 Around half of the costs of the prescription pricing service are allocated centrally by the Authority using a detailed allocation model. ICT costs form part of this model as the Authority pays its outsourced service provider centrally. These costs are allocated using the number of staff employed to operate the service and the Authority does not know the actual costs of running its CIP or legacy systems. We have extended the allocation methodology in the analysis that follows to allow us to estimate costs to the CIP and legacy elements of the service. This means that most of the differences in cost between the CIP and legacy system that we discuss below are the result of differences in the number of staff used to deliver and operate the two systems. The business case for the CIP system 3.8 In June 2005 a predecessor body of the Authority approved a business case to implement the CIP system as a replacement for the legacy system. This was based on:  a need to handle a rising volume in prescription line items;  a need to support new technologies, in particular the EPS and integration with Connecting for Health; and  a desire to achieve savings in the cost per prescription line item. 3.9 A comparison of the CIP business case to the current cost of the prescription pricing service shows that, while savings have been made due to implementing the CIP system, these are not as great as envisaged in the business case (Figure 6). The business case forecast a saving per prescription line item of 3.89 pence from upgrading to CIP. In 2011-12, the difference was actually 3.66 pence, 6 per cent less than forecast. The difference in the cost of processing a prescription line item in 2012- 13 between CIP and legacy reduces to 3.34 pence, 14 per cent less than envisaged in the business case. This is largely due to savings in the cost of renting and maintaining office accommodation. 9 In its external reporting, the Authority excludes items that it considers to be one-offs. This would reduce the expenditure in 2011-12 to £38.1 million or £39.48 per 1,000 prescription line items processed. 18 Part Three NHS Prescription Services: the impact of legacy ICT Figure 6 Comparison of forecast and actual savings Savings have been made by implementing the CIP system but these are not as great as envisaged in the business case Per June 2005 business case 2011-12 (actual) 2012-13 (forecast) Cost of processing a prescription line item on legacy system (pence) 7.24 7.74 7.08 Cost of processing a prescription line item on CIP system (including enhancement cost) (pence) 3.72 4.19 4.26 Cost of processing a prescription line item on CIP system (excluding enhancement cost) (pence) 3.35 4.08 3.74 Difference between legacy system and CIP system (excluding enhancements) 3.89 3.66 3.34 NOTES 1. Although there are no obvious scope differences, the age of the business case means that it is not possible to be sure that the costs of processing a prescription are identically measured between the business case and the current period. 2. Enhancement costs vary year to year. The business case envisaged higher spending on enhancements than actually happened in 2011-12 but lower than is forecast for 2012-13. 3. The cost of processing a prescription line item is for the full service including system costs, processing staff cost and estates. 4. Number of prescription line items for 2012-13 have been estimated using the trend between 2010-11 and 2011-12. 5. Amounts have been adjusted for inflation using the retail prices index. Source: NAO analysis of Authority data 3.10 The business case envisaged that a further 1.13 pence (27 per cent of the actual 2011-12 cost) per prescription line item could be saved by the adoption of the electronic prescription service. As shown in Figure 4, this service has yet to achieve large scale adoption. Expenditure on the ICT systems 3.11 The Authority has estimated that it spent £10.5 million on the ICT for the prescription pricing service in 2011-12 and is budgeting to spend £13.9 million in 2012-13 (Figure 7). The operational cost of ICT (90 per cent of the total in 2011-12 and 64 per cent of the total in 2012-13) is allocated, based on headcount, from a NHS Prescription Services: the impact of legacy ICT Part Three 19 central ICT contract and may not therefore represent the true costs. We have extended this allocation methodology and estimate that the Authority spent £127,000 on the legacy system in 2011-12 and is forecasting to spend £131,000 in 2012-13. The remainder of the ICT cost in each year was on the CIP system. Figure 7 ICT expenditure The Authority has estimated that it spent £10.5 million on the ICT for the prescription pricing service in 2011-12 and is budgeting to spend £13.9 million in 2012-13 Source: NAO analysis of Authority data NOTE 1. Costs in 2012-13 are budget estimates. 3.12 The increase in the Authority's overall ICT costs is due to a £4 million increase in enhancement expenditure. This represents a programme of investment, funded by the Department of Health, to improve the CIP system. The most significant element of this programme is £2 million to replace CIP's scanner equipment. 3.13 The Authority's operational cost of the ICT system is expected to fall by £600,000 (7 per cent) between 2011-12 and 2012-13. This is due to reductions in the ICT contract price and the cost of internal staff supporting the ICT system. 20 Part Four NHS Prescription Services: the impact of legacy ICT Part Four Our enterprise analysis of the NHS Prescriptions Service and the management of the legacy system 4.1 In this part, we summarise the findings of our enterprise analysis. Each section highlights a key finding and the scores we have allocated the NHS Business Services Authority (the Authority) as part of our assessment. Our scoring runs within the range of one to five, the higher the number the better the performance. Two sets of scores are applied which represents where the organisation is currently and where we believe its performance will be in 12 to 18 months, based on the evidence we have seen. The enterprise analysis framework can be found in Appendix Three. Strategy and business model Our assessment Key finding Now Future The Authority is taking steps to improve efficiency and accuracy. EPS provides the best potential benefit but the Authority is unable to affect uptake. 4.2 In 2005, the Authority identified issues with its legacy system and made the decision to replace it with the Capacity Improvement Programme (CIP). The programme had three main aims: to efficiently manage payments to contractors as the number of prescriptions grows; to enable the submission of prescriptions electronically via the Electronic Prescriptions Service (EPS); and address impending risks relating to technology approaching end-of-life. The Authority then took a sensible approach towards implementation with a feasibility study before moving to a controlled pilot and then a phased roll-out, targeting the bulk of the transactions for first migration in 2007. 33 NHS Prescription Services: the impact of legacy ICT Part Four 21 4.3 Less than 1 per cent of transactions are still carried out on the legacy system and the Authority told us that it intends to complete the transfer of the remaining elements of the legacy system to CIP and decommission the legacy system. The costs of running the legacy system are not fully understood and aside from a high level estimate provided in the business plan10 we found that there were no firm plans, business case or funding arrangements in place to assess or implement the remaining work. The Authority is taking on-going tactical steps to reduce the scope of the legacy system, for example, by migrating selected accounts into CIP. 4.4 Other demands continue to take priority over the completion of the transition. To date, organisational reform, legislative changes and the business rules simplification project have been the main focus of the Authority. It is likely that other projects will continue to take precedence without effective engagement with stakeholders such as the Department of Health, and the NHS Commissioning Board, and the Channel Islands and the Isle of Man. The Department of Health is responsible for reimbursement policy in relation to the drugs and appliances dispensed in the community. Responsibility for remuneration policy in relation to dispensing contractor services and the EPS service was transferred to the NHS Commissioning Board from 1 April 2013. 4.5 The Channel Islands and the Isle of Man currently use a different format of prescription form than the one used in England. Therefore, to move from the legacy system they will need to standardise the layout of their prescription forms so that they can be successfully read and interpreted by the CIP system, or make alternative arrangements. 4.6 Another aim of the Authority is to continually improve the level of service provided to customers in terms of information accuracy and speed.11 The installation of new scanner equipment will help to improve accuracy at the same time as increasing the capacity of the system to help cope with the increasing volume of transactions. In addition, a business rules simplification project undertaken during the summer of 2012 is expected to increase efficiency and automation in the processing of prescriptions by reducing the complexity of the rules used to price drugs. 10 NHS Business Services Authority Business Plan 2012/13 , available at http://www.nhsbsa.nhs.uk/Documents/NHSBSAAnnualReports/NHSBSA_Business_Plan_-_2012-13_- _Final.pdf 11 NHS Business Services Authority Strategy 2012-2017, available at http://www.nhsbsa.nhs.uk/Documents/NHSBSAAnnualReports/Strategy_2012-17.pdf 22 Part Four NHS Prescription Services: the impact of legacy ICT 4.7 We consider that the paper-based scanning process is a legacy process, and we agree with the Authority that the best solution in terms of value for money is to grow the volume of prescriptions submitted via the EPS. The electronic submission of prescriptions offers the most accurate and efficient means of processing prescriptions for CIP, but we found that only a very small proportion of transactions was submitted this way in 2011-12 (around 0.1 per cent), and, while this number is growing, the adoption of EPS is beyond the direct control of the Authority. 4.8 EPS is owned and managed by a separate arm's-length body of the NHS. In addition, Primary Care Trusts (PCTs) require Secretary of State approval to use EPS. In February 2013 there were 137 approved PCT's with a further 14 that do not yet have approval. Even within approved PCTs, use of EPS is not mandated or incentivised so dispensing contractors or prescribers are not obliged to adopt EPS. Each pharmacy contractor is paid an allowance for implementing EPS, and receives a monthly allowance for using EPS from the PCT to cover the costs of implementing and using the new system. Governance, architecture and standards Our assessment Key finding Now Future The Authority has comprehensive governance arrangements in place and is refreshing its ICT strategy in line with corporate objectives. The legacy system is hindering compliance with NHS information standards. 4.9 The Authority has comprehensive corporate governance arrangements and a corporate risk register, which describes strategic risks, their probability, potential impact and the agreed mitigations. A prescription pricing service programme board which includes representatives from the business and the IT group meet monthly to discuss service issues, enhancements and risks, and ICT is discussed during these meetings. 4.10 Risks discussed at the service area programme board feed into the corporate risk register. An 'end-of-life technology' risk register is also maintained that logs the risk and impact of a technology component that is approaching, or is already end-of- life. This ensures that the Authority is monitoring its exposure to risks related to technology that is approaching end-of-life in current systems. 43 NHS Prescription Services: the impact of legacy ICT Part Four 23 4.11 The Authority has adopted an enterprise architecture approach to ensure alignment of IT and business services, and the ICT strategy is in the process of being refreshed to improve consistency with the corporate strategy and business plan. This is being discussed at a senior level within the organisation and with representatives from across the business, and the replacement of the legacy system will be considered alongside other strategic objectives. An anomaly exists between the strategy to outsource ICT while the legacy system is still managed in-house. 4.12 The PCTs provide the contractor information, and a standard drug dictionary is developed through a partnership between the Authority and NHS Connecting for Health. There are two data sources for drug and contractor information: the 'CDR' and the 'MDR'. CDR provides drug information for the CIP system, and MDR provides contractor information for both systems and drug information for the legacy system. The drug data held in CDR complies with the NHS Dictionary of Medicines and Devices, the NHS standard for communicating medicine information that has been approved by the Information Standards Board for Health and Social Care.12 The drug data used by the legacy system use an earlier standard and therefore do not comply with this standard. 4.13 CIP and EPS both comply with the NHS Dictionary of Medicines and Devices, so customers currently handled by the legacy system will need to adopt that standard prior to moving to CIP and EPS. Implementation Our assessment Key finding Now Future The legacy system is still required to support prescription processing provided to the Channel Islands and some other processes. CIP was fully introduced in 2008, the Authority has not developed a robust business case to develop CIP, transfer the customers and decommission the legacy system. 4.14 The intention is to eventually decommission the legacy system and move all customers to CIP but we were unable to establish the existence of plans for the transition of customers and the decommissioning of the old ICT. CIP would also require further development to add the business rules for the work-load currently handled by the legacy system. Due to the relatively low volumes on the legacy system when compared to CIP, its running costs have not been calculated. This will hinder the development of a robust business case to develop CIP, transfer the customers and decommission the legacy system. 12 Information Standards Board for Health and Social Care, ISB 0052, available at http://www.dmd.nhs.uk/ 3 24 Part Four NHS Prescription Services: the impact of legacy ICT 4.15 Platform support is outsourced to the IT service provider (Capita), and application support is retained as an in-house function. This is considered an appropriate sourcing model due to the complexity of the business rules and the frequency of change to pricing and rules information. Changes to the service are managed through formal change processes and there is evidence of structured development of the ICT systems with build, test and release cycles on dedicated development and user acceptance testing environments, for both the CIP and legacy systems. Service management Our assessment Key finding Now Future The systems are stable and meet the customer and internal end-user needs. Good relationships exist with fee paying customer and IT service providers. 4.16 We found that the legacy system is stable and meets the current needs of the fee-paying customers and internal system users. Service definitions and service level agreements between the Authority and the Channel Islands and the Isle of Man were in place but have since expired. There have been formal agreements regarding fee changes but no updates to the service level agreements themselves. Service delivery has been managed between the parties on an informal basis. 4.17 Internal system users are generally satisfied with the functionality and performance of the ICT systems but during our visit staff were experiencing delays in the performance of the CIP system at a time when volumes are expected to increase. However, this was a short-term technical issue that was in the process of being resolved. 4.18 All technical issues are logged via a Capita IT helpdesk. We found that the performance and availability information captured relates to prescription processing as a whole and therefore the Authority are not able to analyse the impact of the legacy or CIP systems on the delivery of the prescriptions service. We found that the prescription processing systems met their 99.5 per cent target availability in all but two of the preceding 12 months to January 2013 (Figure 8). 33 NHS Prescription Services: the impact of legacy ICT Part Four 25 Figure 8 ICT performance against availability target Prescription processing systems met availability targets in all but two of the preceding 12 months to January 2013 Source: National Audit Office analysis of service delivery reports 4.19 The arrangements in place to manage the supplier services are adequate, with regular service review meetings taking place between the Authority's service delivery manager and Capita, who hold current ISO 20000 accreditation, a recognised service management standard. The Capita contract is in its third year and it has the expected controls in place for a managed service. The legacy McDonnell Douglas hardware is supported by Northgate on a 'best endeavours' basis. 26 Part Four NHS Prescription Services: the impact of legacy ICT People Our assessment Key finding Now Future Staff responsible for operating and maintaining the legacy system are experienced and knowledgeable. 4.20 There are around 11 full-time equivalent staff who operate the legacy system, with a small number of standby staff available to cover for absences and emergencies. The staff we met are typically long-serving and experienced, and reliance is placed upon this experience to sustain service levels rather than more formal training. 4.21 A good level of support is provided to the staff users with a change-controlled operating manual that contains business rules for processing drugs, and a comprehensive and frequently updated drug catalogue for drug codes and prices. There are no dedicated environments for end-user training but the systems are straightforward and intuitive to use, with most operator knowledge being required for the categorisation of drugs and understanding the business rules during validation and exception handling. Staff performance is monitored and captured by both systems. This enables managers to effectively track the performance of their staff and manage issues appropriately. 4.22 A large IT support team is necessary due to the diversity and complexity of the systems. Duplicate infrastructure, hardware and software arrangements are in place to cope with the two systems. The team has an appropriate mix of skills to maintain and operate the applications but a major change, particularly to the legacy system, may be problematic. Process Our assessment Key finding Now Future Business changes have to be implemented on two ICT systems but the systems are adaptable to changing business rules. 4.23 Legislative changes, drug tariff changes, or other changes that require modification to the business rules have to be applied to both systems which duplicates development, testing and execution. However, we have not seen any evidence of business process improvement or development being hindered by the legacy system. 4.24 Some additional manual changes need to be carried out for the legacy system. Each operator is equipped with a catalogue of medicine codes and an operating manual so changes to medicine codes or reimbursement rules require that the relevant sections of the catalogue and/or book are reprinted and circulated in a controlled manner. 44 43 NHS Prescription Services: the impact of legacy ICT Part Four 27 4.25 The IT service provider is responsible for the disaster recovery and perimeter security arrangements and for carrying out regular disaster recovery rehearsals and penetration test exercises. However, there is no evidence of either test being carried out. We were told that the tests will be arranged after the service provider's imminent data centre relocation, although at the time of our study, staff were still waiting for a date for the move. While the Authority took steps to ensure roll-back capability at each stage of the move, we would expect a technology recovery test to be successfully carried out as part of these arrangements prior to the relocation in order to provide further assurance that risks arising from the move can be mitigated. 4.26 The information governance arrangements are thorough and in line with the NHS policies, and the Authority assesses its compliance against the NHS-wide Information Governance Toolkit.13 No major security incidents were reported in 2011-12. However, the IT staff we spoke to were unaware of the arrangements and accreditations to deal with the risks of cyber threat and fraud and other security threats. Technology Our assessment Key finding Now Future The technology put in place is effective but there are questions regarding its ability to cope with future demand. 4.27 Drug tariff information and pricing changes frequently. The technology is designed in a manner that separates drug pricing and business rules from the processing in separate databases, so that any price, drug or pharmacist changes can be applied easily and then automatically used by the systems. 4.28 The CIP system has an inbuilt business rule processing engine based on Java technology. The in-house team are able to modify, add or remove rules. The CIP system will need further development to be able to handle the workload of the legacy system, for example, CIP cannot currently handle prescriptions that are submitted later than the current processing cycle. 4.29 The Authority has recently embarked on a technology refresh programme - replacing the physical server environment with virtual servers, and upgrading the desktop environment. The new virtual server environment is expected to provide scalability to respond to the increase in demand, although the capacity of the application has not been sufficiently measured to be able to predict the impact of the anticipated growth in demand. 13 NHS Connecting for Health, Information Governance, available at http://www.connectingforhealth.nhs.uk/systemsandservices/infogov (accessed November 2012) 43 28 Part Four NHS Prescription Services: the impact of legacy ICT 4.30 The proposed refresh of the scanner equipment is expected to increase the throughput of each scanner from around 17,000 images per hour to 23,000 images per hour at the same time as improving the accuracy of the intelligent character recognition, thus ensuring a larger proportion of prescriptions are automatically processed efficiently. 4.31 The legacy system was originally designed to cope with a national prescription service and since the implementation of the CIP system this has reduced to fewer than 1 per cent of total transactions. Therefore, capacity of this system is not considered to be an issue, especially considering the intent to decommission it. In addition, many of the retired units have been retained in storage to provide for spares in case of hardware failure. NHS Prescription Services: the impact of legacy ICT Part Five 29 Part Five The lessons learned from the impact of legacy ICT on the Authority's prescriptions service 5.1 In this final part of the report, we use the results from our service, financial and enterprise analysis to draw out the key lessons the NHS Business Services Authority (the Authority) has learned from the impact of legacy ICT on prescription services (Figure 9 and Figure 10). 5.2 This case study is an example of an organisation that identified issues with its legacy system in 2005 and made the decision to replace it. The Authority then took a sensible approach towards implementation. The Capacity Improvement Programme (CIP) started in 2005 with a feasibility study before moving to a controlled pilot and then a phased roll-out, targeting the bulk of the transactions for first migration. 5.3 This means that less than 1 per cent of transactions are now carried out on the legacy system. The legacy system is still fit for purpose, performing a valuable role for the remaining customers but the environment is changing; demand for NHS Prescription Services is growing and there is pressure to reduce costs and improve the efficiency of the prescription service. 5.4 The Authority intends to decommission the legacy system. This will reduce running costs by removing duplicate infrastructure and development and support effort. However, we found there were no firm plans in place to do this and building a stronger understanding of the running costs of legacy ICT will help the Authority to build a firm basis upon which to engage stakeholders and customers. 5.5 The best potential for accuracy and efficiency improvement appears to rest with the Electronic Prescriptions Service (EPS), the adoption of which is dependent on other organisations. 5.6 While the Authority is taking steps to improve in some areas we believe it is not in a position to improve its overall position unless practical plans are developed to transfer the remaining customers to CIP and decommission the legacy system, and the proportion of prescriptions submitted via EPS increases significantly. 30 Part Five NHS Prescription Services: the impact of legacy ICT Figure 9 Enterprise analysis summary assessment Source: National Audit Office analysis based on the enterprise analysis framework in Appendix Three NHS Prescription Services: the impact of legacy ICT Part Five 31 Figure 10 Lessons from the prescription pricing service Lessons Commentary Senior management ownership of IT risk leads to proactive decisions being made regarding the replacement or retention of legacy ICT systems The decision to invest in CIP in 2005 and transfer 99 per cent of transactions from the legacy system means the Authority is now in a strong position to meet its objectives and increase efficiency, but it is likely that the full benefits are contingent on the completion of the transfer of the remaining customers from legacy to CIP or EPS. Build a clear understanding of the value of the IT system and the cost of delivery of the service The original CIP business case used the cost per thousand prescription items and cost per prescription line item as a key performance indicator, which helped to build a robust case to replace the legacy system. The business now lacks a clear understanding of the annual cost of delivery of the ICT system While the Authority is taking on-going tactical steps to reduce the scope of the legacy system, the absence of a 'burning platform' means that there is a lack of urgency to address the removal of the legacy system. The business lacks a clear understanding of the costs of legacy ICT which makes it difficult to build a robust case that can be used to engage with stakeholders and map out plans to decommission the legacy system. Adequate resources should be allocated to understand and address risks created by legacy systems The legacy issues and risks identified in the CIP business case that led to the decision to implement CIP still exist. The inability to scale the system to meet demand; the lack of flexibility to adapt to changes of business rules; obsolete technology; and the inability to integrate with current data standards and systems (e.g. EPS) all further the cause to complete the migration to CIP. Other priorities have taken precedence in the absence of robust information. Source: National Audit Office analysis 32 Appendix One NHS Prescription Services: the impact of legacy ICT Appendix One Timeline History of prescription pricing systems Source: National Audit Office analysis NHS Prescription Services: the impact of legacy ICT Appendix Two 33 Appendix Two Methodology Our methodology centred on the application of our business analysis toolkit. This consists of an analysis of the service model, financial and performance analysis, and the application of our enterprise analysis framework (Appendix Three). Method Financial and performance analyses including:  Interviews with financial and operational staff  Analysis of investment and spend data  Analysis of service performance and service reporting data Analysis of service model including:  Semi structured interviews with service and contract management staff, technical stakeholders and representatives from suppliers  Document review of ICT and contracting strategies, reviews of the ICT estate, technical descriptions and publicly available service information Application of our enterprise analysis framework including:  A workshop of key stakeholders where they self-assessed and scored themselves against the components of the framework  Semi structured interviews with corporate service leaders, senior technical staff, system users drawn from staff and representatives from the suppliers  Data and document review that encompassed key contracts, technical and design documentation, management information, minutes from service and risk forums, risk registers and service impacting incidents  A 'wash up' workshop where the results of National Audit Office fieldwork findings were played back to senior stakeholders and compared with self-assessment 34 Appendix Three NHS Prescription Services: the impact of legacy ICT Appendix Three Enterprise analysis framework Good practice in the management of legacy ICT Strategy and business model Strategy and business model There is a clear strategy in place for the service, which the organisation regularly reviews and updates to reflect changes in its business environment and/or exploit new technologies. Business case and funding Business case(s) for replacement reflect good practice (e.g. HM Treasury Green Book), are regularly reviewed and challenged, and opportunities are exploited and managed. On-going costs Costs of the services are fully understood and managed against a budget and prioritised business demands. Costs are challenged and optimised, and the value of asset/investments is fully exploited. Governance, architecture and standards Technical governance Technical governance arrangements provide strong and effective oversight and direction on the ICT portfolio and the lifecycle of the legacy system. Regular meetings take place between business and IT to identify and prioritise changes in business requirements and legacy ICT capabilities, risks and issues, opportunities and threats. Enterprise architecture There are clear links and strong alignment between the IT strategy and business strategy, and the legacy system is supported by a documented comprehensive technical architecture. Data quality and assurance A clear and consistent strategy for data standards and architecture ensures a coordinated approach to continually improve the quality of information provided by the legacy system. The sources of data are well understood and business users have trust in the information. Risk management Risk management processes ensure that the business risk appetite is documented and legacy ICT and information assurance related risks are identified and regularly reviewed, documented and managed at a sufficiently senior level, with mitigating arrangements agreed. Key stakeholders have clear visibility of the level of risk exposure. Implementation Lifecycle management The system is readily adaptable to changing business needs and evidence of structured development and enhancement throughout its life can be seen. Testing plans and procedures are designed in partnership with business, release management processes are in place and system documentation is current, maintained and available. Software media and licence codes are available and regularly confirmed as operational. NHS Prescription Services: the impact of legacy ICT Appendix Three 35 Decommissioning legacy All legacy systems have been identified and effective transition arrangements, accountabilities and responsibilities have been agreed. All legacy data have been identified, cleansed and mapped to the new solution and decommissioning costs have been identified. Retaining legacy There is a legacy systems strategy in place that identifies what the business defines as legacy, the contract lifetimes and the anticipated technology lifetime of each architecture component, service and application, and the factors to be considered in making retirement/retain decisions. Service management Service performance There is clear definition of the service that is continually reviewed and improved in partnership with the end-users and/or customers, and service delivery performance is regularly compared with target performance and good practice benchmarks. The dependency of the legacy system on service performance is known, with risks and issues managed effectively. Management of supplier services Outsourced services are actively managed and regularly market tested to ensure value for money, the relationship is collaborative and information about future changes to the legacy system or the service are discussed between both parties. Change management An agreed multi-user forum exists for engaging in high- level strategy, performance management and service evolution discussions, which inputs to management decisions about future direction and investment. There is a tailored organisation wide training programme with clear success criteria being monitored. People Internal workforce The staff responsible for the on-going operation of the legacy system have the necessary skills and undertake training to perform their role. Training covers awareness of developments in the market and relevant associated technologies. Recruitment, retention and development activities are aligned with the needs of the service and its customers. Succession plans are in place for all key roles. Supplier capability Reliance on service providers and contractors involved in the on-going operation of the legacy system is known and actively managed. There are regular reviews of the ability of service providers to continue to support the legacy system throughout its projected lifetime, and there are agreed solution roadmaps are in place. 36 Appendix Three NHS Prescription Services: the impact of legacy ICT Process Business processes Development or improvement of business processes is not hindered by the capabilities of the legacy system, and/or new processes required by the business are assessed against the capabilities of the legacy system and failure to meet new requirements triggers a system review. Technical processes Data management processes are in place and owned by the business and are applied to the legacy system. Backup and recovery capability of the legacy system is regularly reviewed and tested, and adherence to agreed recovery objectives is actively measured. Access management controls are implemented and monitored with exception event procedures in place. Security processes The legacy ICT system meets government security standards (accreditation) in a cost-effective manner and its security controls ensure the confidentiality, availability and integrity of data. External security risk assessments are carried out regularly. No bespoke security systems or processes are required. Technology Applications The legacy ICT system fully integrates with the wider ICT environment using standard protocols or common application programme interfaces. Software versions are current and fully supported with plans in place for future upgrade. Performance. The availability and performance of the legacy system is captured as part of service performance measurement. Infrastructure The solution is sufficiently scalable to allow the addition or removal of components to meet service demand or enhanced to meet changing business needs. A regular patch cycle schedule is in place to apply functional and security patches systematically. Test facilities exist that replicate the production environment exist or can easily be created and removed as required. Source: National Audit Office enterprise analysis toolkit NHS Prescription Services: the impact of legacy ICT Appendix Four 37 Appendix Four National Audit Office reports on government ICT NOTE 1. For published client reports focused on ICT see next page Source: National Audit Office 38 Appendix Four NHS Prescription Services: the impact of legacy ICT Published client reports, focused on ICT Online services 1 HM Revenue & Customs: The expansion of online filing of tax returns, November 2011. Business Intelligence systems 2 Ministry of Defence: The use of information to manage the logistics supply chain, March 2011. Business systems 3 Department of Health: The National Programme for IT in the NHS: an update on the delivery of detailed care records systems, May 2011. 4 Department for Communities and Local Government: The failure of the FiREControl project, July 2011. 5 The Crown Prosecution Service: The introduction of the streamlined process, November 2011. 6 Department for Work and Pensions: The introduction of the Work Programme, January 2012. 7 Department for Work and Pensions: Child Maintenance and Enforcement Commission: cost reduction, February 2012. 8 HM Revenue & Customs: The Compliance and Enforcement Programme, March 2012. Back-office systems 9 Department for Business, Innovation and Skills: Shared services in the Research Councils, October 2011. Infrastructure 10 Department for Environment, Food and Rural Affairs: Geographic information strategy, July 2011. 11 Home Office and National Policing Improving Agency: Mobile technology in policing, January 2012. 12 Department for Culture, Media and Sport: The rural broadband programme, July 2013 NHS Prescription Services: the impact of legacy ICT Appendix Four 39 People delivering and operating government ICT 13 Department for Business, Innovation and Skills and Skills Funding Agency: Adult apprenticeships, February 2012. Policies and strategies for information and technology and business 14 Department for Environment, Food and Rural Affairs and the Animal Health and Veterinary Laboratories Agency: Improving the delivery of animal health and welfare services through the Business Reform Programme, July 2012. DP Ref 10184-001