NHS left with sick PCs as suppliers resist Windows 11 treatment
- Reference: 1761895746
- News link: https://www.theregister.co.uk/2025/10/31/nhs_windows_11_issues/
- Source link:
Digital Health News [1]reported this week that one supplier quoted the Rotherham NHS Foundation Trust £25,000 to upgrade a three-year-old device so it would work with Windows 11, which rolled out in 2021.
James Rawlinson, the trust's director of health informatics, said that while 98 percent of its Microsoft estate has already been upgraded, around 2 percent of devices remain on older software because suppliers have not yet updated their systems to support Windows 11.
[2]
"We have some examples where we bought clinical and medical equipment and the manufacturer now says we have to buy it brand new even though it's only three years old," Rawlinson said.
[3]
[4]
Microsoft officially [5]ended support for Windows 10 on October 14, meaning any devices still running the operating system will no longer receive critical security patches – including those used in medical settings.
While Redmond offers [6]a paid Extended Security Updates (ESU) program for organizations and users unable to move off Windows 10, [7]the directive from NHS England is to upgrade to Windows 11 to protect patient data and keep clinical systems secure.
[8]
Rawlinson said the trust had quarantined outdated devices to minimize cyber risk while it attempted to negotiate solutions with suppliers, calling the issue "worrisome."
[9]Johnson, Cummings met Thiel months before Palantir won NHS pandemic role
[10]NHS disability equipment provider on brink of collapse a year after cyberattack
[11]Qilin ransomware attack on NHS supplier contributed to patient fatality
[12]UK Spending Review prescribes £10B digital remedy for NHS
"Historically these medical equipment suppliers have provided end-to-end support for their software and equipment, but then suddenly say 'It's nothing to do with us, it's up to your local IT to look after it, but don't worry, you can buy extended support from Microsoft.' It just stinks," he said.
In addition to the cybersecurity risks posed, Rawlinson noted that taking outdated systems offline could also impact care – for example, by preventing pacemakers from communicating with cardiology systems. "You just hope and pray that nothing untoward happens," he said.
A [13]ransomware attack on pathology services provider Synnovis in June 2024 resulted in [14]thousands of NHS appointments being postponed and was linked [15]to the death of at least one patient .
It was the NHS's sluggish response to replacing outdated Windows XP and 7 systems that left it exposed to [16]the devastating WannaCry attack of 2017 , which brought the healthcare system to its knees and left the Department of Health and Social Care [17]footing a £92 million bill .
[18]
El Reg has contacted NHS England to determine what proportion of the NHS estate remains on Windows 10 and to understand whether other trusts face similar issues with outdated devices. ®
Get our [19]Tech Resources
[1] https://www.digitalhealth.net/2025/10/medical-device-suppliers-stalling-nhs-upgrade-to-windows-11/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aQSWymYIAFxNL3WXkgc5ggAAAYE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aQSWymYIAFxNL3WXkgc5ggAAAYE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aQSWymYIAFxNL3WXkgc5ggAAAYE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2025/10/16/windows_10_office_and_servers/
[6] https://www.theregister.com/2025/08/04/windows_11_market_share/
[7] https://digital.nhs.uk/about-nhs-digital/windows-10-end-of-support-october-2025
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aQSWymYIAFxNL3WXkgc5ggAAAYE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2025/09/10/johnson_cummings_thiel_meeting/
[10] https://www.theregister.com/2025/07/31/nhs_disability_equipment_provider_nears/
[11] https://www.theregister.com/2025/06/26/qilin_ransomware_nhs_death/
[12] https://www.theregister.com/2025/06/12/nhs_tech_spending_review/
[13] https://www.theregister.com/2024/06/04/suspected_cyberattack_hits_major_london/
[14] https://www.england.nhs.uk/london/2024/07/04/update-on-cyber-incident-clinical-impact-in-south-east-london-thursday-4-july/
[15] https://www.theregister.com/2025/06/26/qilin_ransomware_nhs_death/
[16] https://www.theregister.com/2017/05/13/wannacrypt_ransomware_worm/
[17] https://www.gov.uk/government/publications/securing-cyber-resilience-in-health-and-care-october-2018-update
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aQSWymYIAFxNL3WXkgc5ggAAAYE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://whitepapers.theregister.com/
Re: Oh please
But of course, this is difficult as everyone wants integrated care. Instant access to scans and test results, etc. and not waiting for a week for something to get to my Doctors in the postal service from the Hospital.
NHS hospitals
What ? Are you telling me that they have finally upgraded from Windows 95 ?
Wow.
Re: NHS hospitals
What ? Are you telling me that they have finally upgraded TO Windows 95 ?
There, I fixed it for you
Re: NHS hospitals
Well, 95 > 11, so who's laughing?
Should have gone and stayed with OS/2 :)
Possibly not so silly as [1]ecomstation have a surprising number of clients.
Surprising number of instruments in non safety critical environments were shipped with OS/2 and are still kicking.
[1] https://www.ecomstation.com/
Re: Should have gone and stayed with OS/2 :)
What OS are cash machines running these days? In the past they've been notable for ancient versions of Windows (and OS/2 was still around for a long time too).
jujitsu...again
I see from the above link that Fujitsu are listed as using OS/2.
Hmm....
Only themselves to blame
The impression the article leaves me with is that the trust bought equipment without asking itself basic questions like how long the kit was expected to last, what that meant for software support, and how those support needs would be met. So rather than this being evil or incompetent suppliers* the single and fundamental issue here is incompetent procurement that relied on an assumption that the suppliers would either offer the support free, or at most for a handful of beans.
I wonder if any lessons have been learned? /s
* Profiteering, yes.
Extortion pure and simple.
The money the NHS wastes in this field is huge.
Windows 11 was released more than three years ago. So, when the bought that equipment it didn't work with Windows 11. They should have been checking when they bought it at the time.
Yeah, like five+ years before Win11 appeared? 11 was released 2021, and required CPUs at least from "around 2017"? How much IT news did you miss? Oh, 15 years between today and the last time you checked!
Blame the Project Managers. All they care about is "on time and to budget" (and impressing their managers), this is true no matter what the size of the project. Any governance issues are dismissed with a wave of the hand (which mostly work). I lasted a few months in a NHS trust until I realised their GRC was just pretend and "getting the job done" was legitimate reason to override policy (exception requests were just rubber stamped).
Not in the NHS trust where I used to work. I left four years ago and they had barely started rolling out windows 10 due to the project managers incompetence. They have recently started deploying 11 despite 10 not being complete and I know there are 95,2000 and XP systems facing the internet because the equipment they connect to is either fully functional so there's no money or impetus to replace it or the system is so deeply integrated into an in house developed application that has been around for such a long time nobody has any documentation and in some cases even knows who created it.
Microsoft's fault
If I am buying something with Windows 10 and Microsoft are saying that this is "the last ever operating system", why should I be worrying about Microsoft lying?
Rhetorical question as all large corporations lie as their standard advertising and responses.
Not as easy as people think...
To everyone say that they should have checked for the future updates..
Well yes they should BUT sometimes there may only be a couple of manufactures of who only make a relatively few " Very Expensive Extremely Specialized Device (tm)" a year and they may that may need to fit into existing equipment / workflow.
When I worked at a medical research facility we did DMZ off these devices, but often the manufactures would specify not only the version of windows, but often which patches you could install (None) for the machine to be under support.
The software that these things run on is a joke, and often seems to be written by the students who helped develop the machine (e.g. Chemists & Biologists etc) with old versions of Visual Basic rather than software engineers with upto date tooling.
The equipment suppliers have you between a rock and a hard place you need machine X to do your research \ work, costs many thousands to buy and for licencing & support but will consider the specific PC to be used the same as some custom part rather than a commodity part.
What can you do? demand better service? Well go use Y machine that is just as bad?
Not get the machine until you have assurances? Well good luck doing your work / research and kiss your grant goodbye
Not at all surprising
What many outside the medical devices field don't know is that most medical devices require extensive testing and approval to ensure that they won't cause unintended effects to staff and patients. That testing costs a ****ing fortune, takes years to complete, and has to be done for each and every region where your devices will be sold because of course every region has different requirements for testing and documentation. So, MS announce that they are ending support for Win10 in just over 1 year under the massively flawed assumption that everyone can just jump to their latest shiny-shiny at will. Most medical device companies typically operate on a 5-10 year refresh cycle depending on the device, and MS and their marketing people can just go sit on a massive **** and rotate if they think otherwise.
Ours run the latest versions of Win10 LTSR and Win10 Embedded and we will get them to Win11 when the testing/documentation is done and not before. Many such devices sit behind their own firewalls and have other protections so the fact that the OS is flawed and requires constant patching if exposed to the internet is normally not an issue.
And before the Linux/Unix people start bleating on about using that instead, some of our devices do run on certain flavours of *nix but there are other issues there that make life difficult such as the fact that the user base are all Windows people.
Most medical device companies typically operate on a 5-10 year refresh cycle
We have this situation at the moment. Some of the manufacturers do have devices/software that can run on Windows 11/Server 2022 but they can't sell them to us/upgrade existing software until MHRA issue a Medical Device Registration and that can take years.
This is one of the reasons NHS England negotiated a roughly 50% discount with Microsoft on the Win 10 ESU at the last minute having previously said they wouldn't (wanting, instead, to push us to upgrade rather than be lazy and throw taxpayer's money at the ESU)
Re: Not at all surprising
Yes, but didn’t the article state that 98% of the medical device companies certified their products with Bumpyloft Trembles 11. So only a very small minority doesn’t have its act together. So no need to apologize for them.
Re: Not at all surprising
A medical machine is a perfect/textbook use case for Wndows 10 IoT 2021, which will be supported by microsoft until early 2032, no ESU, no hoops, just plain old security patches.
Blame the medical equipment manufacturer for using the wrong version of Windows....
Oh please
We've been doing this for decades with Win98, Win2000, WinXP, Win7 (Vista did not appear yet), Win8.1 and various old unixes/linuxes with old well known bugs:
DMZ them, done. And either they stay DMZ (cevice/machine control PCs), or more time left to migrate.