The NHS could have avoided the crippling effects of the “relatively unsophisticated” WannaCry ransomware outbreak in May with “basic IT security”, according to an independent investigation into the cyber-attack.

The National Audit Office (NAO) said that 19,500 medical appointments were cancelled, computers at 600 GP surgeries were locked and five hospitals had to divert ambulances elsewhere.

“The WannaCry cyber-attack had potentially serious implications for the NHS and its ability to provide care to patients,” said Amyas Morse, the head of the NAO.

“It was a relatively unsophisticated attack and could have been prevented by the NHS following basic IT security best practice. There are more sophisticated cyber-threats out there than WannaCry so the Department and the NHS need to get their act together to ensure the NHS is better protected against future attacks.”

The NAO said the Department of Health was unable to cost the impact of the outbreak and the full extent of the damage may never be known. Overall, 81 NHS organisations in England were affected, a third of the total.

WannaCry was a type of malware known as a ransomware worm. It was capable of travelling from machine to machine directly, infecting new computers by automatically seeding itself across corporate networks. When it did manage to infect a new machine, it first silently worked in the background to infiltrate itself within the operating system, then restarted the computer and began the process of encrypting the hard drive, rendering it impossible to read without the encryption key. Victims were offered the chance to buy the key, for $300.

The worm nature of the virus, spreading automatically, means that some NHS regions were far worse hit than others, the report says. The North and Midlands & East regions contained 32 of the 37 NHS trusts affected, simply because they were the first regions to be hit, giving the virus most of the day to spread throughout their networks.

The damage would have been substantially worse had a young security researcher, Marcus Hutchins, not found and activated a “kill switch” that prevented future infections from locking devices. After the kill switch was enabled, infections continued to mount: a further 92 organisations appear to have been infected after that point, all of which owe their continued operation to luck.

Yet the attack could the been prevented by basic IT practices, the report says. As early as 2014, the Department of Health and the Cabinet had written to NHS trusts, saying it was essential they had “robust plans” to migrate away from old software. In March and April 2017, NHS Digital issued critical alerts warning organisations to fix the exact bug in their Windows computers that later enabled WannaCry to rapidly spread.

Before the attack, NHS Digital carried out an “on-site cybersecurity assessment” at 88 out of the 236 health trusts in England. None passed, but the agency had no powers to make them “take remedial action even if it has concerns about the vulnerability of an organisation”, the report says.

Dan Taylor, NHS Digital’s Head of Security, said WannaCry had been “an international attack on an unprecedented scale” and the NHS had “responded admirably to the situation”.

He added: “Doctors, nurses and professionals from all areas pulled together and worked incredibly hard to keep frontline services for patients running and to get everything back to normal as swiftly as possible.”

Meg Hillier, the chairwoman of the public accounts committee, said: “The NHS could have fended off this attack if it had taken simple steps to protect its computers and medical equipment. Instead, patients and NHS staff suffered widespread disruption, with thousands of appointments and operations cancelled.

“The NHS and the department need to get serious about cybersecurity or the next incident could be far worse.”

The WannaCry ransomware managed to spread to more than 150 countries in less than a day, using a computer exploit discovered by the NSA and leaked by a suspected Russian hacking group called The Shadow Brokers to bounce from machine to machine. When it was installed on a computer, it proceeded to encrypt the hard drive, stopping it from being used and preventing the recovery of any data.

The software demanded a ransom to be paid in the cryptocurrency bitcoin worth $300 for the key to unlock the drive. More than £100,000 was eventually paid to the hackers, who withdrew the funds in August.

Since WannaCry, two other major ransomware attacks have been recorded: NotPetya, which began in Ukraine in July and brought down businesses including Maersk and Merck, and Bad Rabbit, which hit Eastern Europe earlier this week.

In June, Britain’s National Cyber Security Centre completed an internal investigation into WannaCry and concluded that North Korean actors were behind the malware. While the NCSC did not release its findings, other security researchers came to the same conclusion based on elements in the code of the program that were similar to known North Korean malware.