GRC

NHS England tells GPs to weigh ICO reports after supplier collapse

After Silicon Practice’s collapse, NHS England tells GPs to protect patient data and consider ICO reports. Supplier exit lessons for UK firms.

Illustration of a server with a warning motif representing the collapse of a GP website supplier

NHS England has written to GP practices, according to The Register, telling them to protect patient information and think about reporting to the ICO after Silicon Practice, a supplier of practice websites and online consultation tools, went into administration. With the services offline, patient data held on them may no longer be accessible, and the letter, as reported, treats that as a data protection problem as well as an IT one.

What happened

Schappit Ltd, the parent of Silicon Practice, entered administration earlier in October 2026. The firm says it has worked with the NHS since 2005, and its own marketing claims around 1,000 GP practice websites. On Wednesday 28 October patients of surgeries in London, Hertfordshire, Gloucestershire and Swansea were told their practice website was no longer available. One North London surgery said the provider had gone into administration “without warning”, according to ITV News.

The NHS West and North London Integrated Care Board (ICB) posted a notice to practices the same day. It listed three services that had stopped working: the FootFall online consultation platform, practice website hosting and a chatbot feature. Practices on FootFall were told to let patients know that online consultation requests were unavailable and to offer other ways to reach clinicians until a replacement was in place. Swansea Bay’s health board was aware of three practice sites down, and IBTimes UK reported further disruption in Norfolk and Derby.

The development that matters for compliance came on 30 October. The Register reported a letter, sent that week by NHS England’s chief technology officer, Kevin Humphries, to practices and NHS organisations setting out what they should prioritise. Most GP practices are independent contractors, and The Register described the letter as an unusual step.

The detail

According to The Register, which has seen the letter, it sets out three operational priorities. The first is to preserve historical patient information, especially anything that never reached the clinical record system. The second is to bring the online consultation backlog under control so that no further requests are added. The third is to find ways for patients to make contact until new online systems are running. The risk is real: IBTimes UK reported that several practices warned that forms sent just before the outage may never have reached clinicians.

The governance points are the important ones. The Register reports that practices are asked to judge whether they must tell the ICO where the “availability, integrity, confidentiality or recoverability of personal data” has been affected. ICBs, which commission GP IT, are reminded that assuring suppliers on clinical safety, data and cyber security, and continuity is their job. Each ICB is expected to name someone to lead recovery, contact the practices and trusts affected, and help them decide whether to activate business continuity and disaster recovery plans.

The Register also pointed out that the company joined a government framework in July, only months before it failed. What financial checks were done then is not yet known. IBTimes UK reported net liabilities of £2.67 million in the company’s unaudited accounts to June 2025.

Timeline of the Silicon Practice collapse from its July framework listing to NHS England's 30 October letter to GP practices

Why it matters for UK organisations

Many people think of a personal data breach as a hacker stealing records. UK GDPR defines it more widely, and the definition covers the accidental loss of, or loss of access to, personal data. If a processor fails and patient messages, consultation forms or contact details can no longer be reached, that is a loss of availability, whether or not anyone malicious was involved. The controller, here each GP practice, then has to judge the risk to individuals. Where a report is needed, it must reach the regulator without undue delay and, where feasible, within 72 hours of the practice becoming aware. NHS England’s letter brings that obligation into the open.

The lesson applies well beyond the NHS. Every UK organisation that relies on a small SaaS provider for something customers use directly, such as booking, forms, chat or a public website, faces the same exposure. Article 28 of UK GDPR requires processor contracts to cover returning or deleting data at the end of the service. That clause is no help if the supplier stops operating overnight and administrators control the servers. UK regulators, from the FCA and PRA on operational resilience to the incoming Cyber Security and Resilience Bill regime, increasingly expect a tested, orderly supplier exit.

Expert view

In my experience, third-party risk reviews spend most of their time on how a supplier might be breached. They rarely ask what happens if the supplier simply disappears. Questionnaires cover testing, encryption and certifications, which all matter. They seldom ask who owns the domain, where the data lives, how fast it can be exported, or what an administrator can hand back. A common finding is a business-critical service with a small vendor where nobody internally holds the admin credentials or a recent copy of the data.

The detail I would focus on is the online consultation backlog. A patient request that was submitted but never read is a clinical safety risk as well as a data protection one, and that is why the letter puts preserving information and closing the intake channel ahead of everything else. I would also expect questions about the framework onboarding in July. Financial health checks are part of supplier assurance, not an extra, and a framework listing should not be treated as proof that a firm is resilient.

The harder question is whether supply chain assurance tested vendor continuity as well as product security.

What to do now

  1. Affected practices: log the incident. Record what data was held on Silicon Practice systems, when it became unavailable and whether any requests may have been lost. Use that record to decide on, and document, whether to report to the ICO within 72 hours of becoming aware.
  2. Reconcile the backlog. Contact patients who may have submitted forms just before the outage. Make sure the old channels are visibly closed so nothing else goes into them.
  3. Take control of your domain and accounts. Confirm who is the registrant for the practice domain and DNS. Reset or remove any credentials and integrations linked to the failed supplier (Cyber Essentials: user access control).
  4. Build any replacement securely. Whether you use a new vendor or an in-house template, apply secure configuration, enforce MFA on admin accounts and keep it patched (Cyber Essentials: secure configuration, security update management).
  5. Every organisation: test supplier exit. For each external service that touches personal data, confirm you can export the data, that a recent copy is held somewhere you control, and that the contract covers what happens on insolvency.
  6. Add financial health to supplier due diligence and review it each year, not only at onboarding.

Bottom line

NHS England’s letter frames a supplier collapse as a possible personal data breach and a test of supply chain assurance, and that is the right framing. For any UK organisation, the question to ask now is simple: if your smallest critical supplier vanished tomorrow, could you get your data back and keep serving people? If the honest answer is no, the exit plan is the control that is missing.

Sources

Related Posts