This week, up to 600 GP practices across England and Wales lost their websites after the company that provided them went into administration. Patients can no longer use the online consultation forms. The chatbots and the FootFall online consultation platform have gone too, and some practices have warned that requests patients had already sent may never have been received.
Many surgeries say they had little or no warning. For a practice that has moved a large share of its patient contact online, that is a very sudden loss of a front door, and the lessons apply well beyond the NHS.
What happened?
The supplier, Silicon Practice, is owned by Schappit Ltd, a Leicestershire company that filed a notice of intention to appoint administrators earlier this month. Silicon Practice says it has worked with the NHS since 2005 and claims to have hosted around 1,000 GP websites. Reports say Schappit’s unaudited accounts showed net liabilities of £2.67 million as at June 2025.
NHS England has contacted affected practices with actions to maintain business continuity and has asked them to confirm their mitigation plans with their integrated care board. One ICB has told surgeries to assume the services will not return and to put contingency plans in place without delay. Another health board warned that its practices had not been told when their websites would stop working, and that any notice was likely to be very short.
Practices have done what they can. Several have turned to Facebook and text messages to tell patients what is happening and how to get in touch, while their phone lines take the extra demand. That is sensible, quick crisis communication, and it is being done by people who are also trying to run a surgery.
Insolvency is a different kind of supplier failure
When organisations plan for a supplier letting them down, they usually picture an outage. A system goes down after a cyber attack or a technical fault, and the plan is about coping until it comes back. Recovery time objectives and workarounds are built around that assumption.
Insolvency doesn’t fit that pattern. The service may not come back at all, there is no status page counting down to recovery, and the administrators’ job is to look after the creditors rather than the continuity of the supplier’s customers. Websites, data and even domain names can become hard to reach while that process plays out. A plan that assumes a supplier will eventually restore service has nothing to offer when the supplier no longer exists.
Requests that may never have arrived
The part of this story that concerns me most is the warning that some patient requests may not have been received. A consultation request sent through a practice website is personal data, often health data, and for a patient it may be the only way they tried to ask for help.
Under UK GDPR the practice is normally the controller and the website provider its processor. Losing access to personal data, even temporarily, can count as a personal data breach, because availability is one of the things the law expects controllers to protect. Each practice will need to work out what may have been lost, whether any patient could have come to harm as a result, and whether that reaches the threshold for reporting to the ICO within 72 hours. That is a difficult assessment to make when the processor is in administration and may not be answering the phone.
The warning signs were on the public record
Most GP practices are small businesses without a procurement department, and many will reasonably have assumed that a supplier working with the NHS since 2005 had been checked by someone. I don’t think the practices are the ones to blame here.
But the wider point stands for every organisation. Supplier due diligence is usually done once, when a contract is signed, and then filed away. A company’s financial position can change a great deal over the life of a contract, and much of that is visible at Companies House to anyone who looks: net liabilities, late filing, changes of ownership and charges registered against the business.
ISO 27001 expects organisations to monitor and review their suppliers’ services, not just to vet them at the start, and ISO 22301 expects you to understand the dependencies behind your critical activities. A simple annual check of a critical supplier’s accounts won’t predict every failure, but it costs very little and it can buy you the one thing this week’s practices didn’t have, which is time.
Questions to ask about your own critical suppliers
Start with the things you would need on the first morning. Is your domain name registered in your organisation’s name, and do you have the login, or is it held by the supplier? Do you have an up-to-date copy of your website content and of any data the supplier holds for you, in a format another provider could use?
Then look at the contract. Does it say what happens to your data if the supplier becomes insolvent, and how it would be returned to you? For software that you depend on, is there any form of escrow? And would the supplier be obliged to tell you if they were in financial difficulty, or would you find out from your customers?
Finally, look at the plan itself. Have you identified an alternative supplier, even informally? Do you know how you would tell customers, patients or service users that a channel has gone, and what they should do instead? The practices using social media and texts this week show how valuable it is to have another way of reaching people that doesn’t depend on the system that has failed.
It won’t be the last
Silicon Practice will not be the last small technology supplier to fail while holding a critical service for its customers. More and more organisations rely on specialist online tools run by small companies, and that brings real benefits along with a concentration of risk that rarely appears on a risk register.
The useful question to ask this week is a simple one. If your most important online supplier stopped trading tomorrow, would you hear about it from them, from an administrator’s letter, or from the people who could no longer reach you?
