The NHS has demonstrated an unexpected kind of resilience this week, not through cutting-edge digital infrastructure, but by falling back on pen and paper. A coordinated cyberattack targeting several major hospital trusts across the UK forced clinicians to revert to manual record-keeping, a method many had assumed was obsolete. Yet remarkably, patient care continued. Waiting lists did not explode. Chaos did not ensue. The system held.
This is not a failure. It is a lesson in robust systems design. In an age where we fetishise digitisation, the NHS’s ability to operate offline reveals something profound about the nature of critical infrastructure. When the power grid fails, a hospital’s backup generators kick in. When the network goes down, the paper form becomes the backup. This is not a bug. It is a feature.
The attack, attributed to a ransomware group targeting unpatched vulnerabilities in legacy software, locked staff out of patient records, appointment systems, and diagnostic tools. At one trust in London, radiology reports were being typed on typewriters. At another in Manchester, nurses carried handwritten notes between wards. The media’s instinct was to frame this as a crisis. But the data tells a different story.
No patient deaths were reported. No cancelled surgeries. No delays in emergency treatment. The waiting lists, already strained from pandemic backlogs, grew by a negligible margin. The NHS, for all its faults, has a distributed, decentralised workforce trained to adapt. That training, often dismissed as outdated, became the last line of defence.
Compare this to the private sector. In the United States, a similar ransomware attack on a large hospital chain in 2020 led to a three-week shutdown of their entire electronic health record system. Ambulances were diverted. Surgeries were cancelled. Patients were transferred to other facilities. The system collapsed. Why? Because there was no fallback. The digital infrastructure was so deeply integrated that the analogue alternative had been eliminated.
The NHS, constrained by chronic underfunding and a fragmented IT landscape, never fully eliminated the analogue. Each trust has its own legacy systems, its own protocols, its own paper forms. This is often cited as inefficiency. But it is also redundancy. When the network fails, the paper exists. The human process exists. The clinical workflow continues.
This is not an argument against digitisation. Digital systems are faster, more accurate, and enable data-driven improvements. But they introduce single points of failure. The more complex the system, the more pathways for catastrophe. The NHS’s hybrid approach, born of necessity and budget cuts, inadvertently built resilience.
We need to rethink our obsession with total digitisation. Critical infrastructure, especially in healthcare, must be designed with offline capability as a core requirement, not an afterthought. This means investing in training staff on paper-based workflows, maintaining stocks of paper forms, and testing offline procedures regularly. It also means designing digital systems with graceful degradation, where a failure does not lead to a blackout but a dimming.
The pen and paper triumph is not a victory for nostalgia. It is a victory for systems thinking. It is a lesson for every hospital, every grid operator, every data centre in the world. The most resilient system is not the one that never fails. It is the one that can fail gracefully.
The NHS, often maligned for its reliance on outdated methods, has shown that sometimes the old ways are not weaknesses but adaptations. In a world where cyber threats are multiplying and climate change threatens infrastructure, resilience is gold. And the NHS, it turns out, is sitting on a vein.
