On 14 November a senior associate ICT delivery facilitator sent a test message on what was thought to be a local distribution list she had created. However, it instead went to all 850,000 people with an NHSmail email account.
The blank message, sent early in the morning with a subject line that simply read “test”, was sent to a distribution list called “CroydonPractices”. Around 80 promptly replied and demanded that they be removed from the list which was when trouble really began.
An official report into the meltdown said that NHSmail’s Dynamic Distribution List (DDL) allows administrators to create distribution lists using a range of options and rules.
The local admin selected the “only in my organisation” rule, which she thought would restrict the distribution list to her South London clinical commissioning group.
However, a software configuration error meant that the system applied an ‘All England’ rule rather than one including only the administrator’s organisation. The administrator would not have known that this had occurred.”
The NHS report blames Accenture for not having failsafes in place that would have prevented the fiasco. The system’s design requirements was that “strict controls must be in place to limit the volume of any one email sent by an individual user or local administrator.” This was something that Accenture has not come up with.
The ability to create DDLs of similar forms will remain disabled until NHS Digital is satisfied this has been delivered, the reports said.