Health secretary did not attend police debrief on major NHS cyber attack

Health secretary Neil Gray did not take part in a critical police briefing following the February cyber attack on NHS Dumfries and Galloway that compromised more than 100,000 patients' data, a Freedom of Information release has revealed.

Last month, a ransomware group leaked a “large volume” of data belonging to the health board after it refused to follow through with payment demands.

Earlier this week the NHS board told everyone living in the region, where the population is around 150,000, that their data is likely to have been leaked as part of the attack. 

According to the FOI release, Gray has attended just one meeting on the matter, held on 9 May, but excused himself before Police Scotland briefed attendees on how to mitigate the risk to patients and staff. It also gave an update on its investigation.   

During the meeting, the health board's chief executive, Judy White, also confirmed that individual data including letters and test results had been accessed as part of the data leak.

The FOI release said that Gray “had to leave the call before Police Scotland were able to update on their investigation and requested a written summary be provided”.

On 7 May, two days before the meeting, Gray had said he would be “receptive” to providing emergency funding to the health board, after being questioned by local Labour MSP Colin Smyth.

A separate FOI revealed that information on correspondence and meetings between current and former first ministers and NHS Dumfries and Galloway “does not exist”.

It is unclear whether Alister Jack, who was MP for Dumfries and Galloway before parliament was dissolved, attended any meetings about the attack. His office responded to an FOI by refusing to confirm whether it had the relevant information.

Scottish Labour health spokesperson Jackie Baillie criticised Gray, saying Scotland "cannot afford to have another health minister who takes their eye off the ball".

"A health secretary should be attending any meeting that relates to the breach of patient data for its entire duration, yet Neil Gray clearly felt he had to be somewhere more important," she added.

Oliver Mundell, the Tory MSP for Dumfriesshire, accused the SNP of neglecting rural Scotland. 

"No one would accept this if it was a large health board in the central belt but when it comes to Dumfries and Galloway it is clear this SNP government doesn’t believe it matters," he said.

However, a  Scottish Government spokesperson has told Holyrood that upon the request of the health secretary the health board held a briefing on March 18 to keep local representatives up to date. 

The spokesperson continued:

"He then received regular written updates on progress, again at his request. When the situation escalated on May 9 he requested a further verbal update that day, which Mr Gray attended for the scheduled duration of the meeting before having to leave for business in the parliamentary chamber. Officials remained to pick up any follow-up actions."

"The First Minister and the cabinet secretary continue to be fully briefed on the situation in Dumfries & Galloway. Officials meet senior leaders from NHS Dumfries and Galloway and partner agencies, including Police Scotland and national cyber experts, every week with Ministers briefed shortly thereafter."

“The UK Government’s National Cyber Security Centre (part of GCHQ) are part of these multi-agency meetings, as are Agents from the UK Government's National Crime Agency. Officials are also liaising with NHS England as required.”