Summary
- Silicon Practice's parent company, Schappit Ltd, entered administration.
- GP practices have lost website and online consultation services, with alternative arrangements being introduced.
- The disruption concerns supplier continuity rather than a confirmed cyberattack.
GP practices across parts of England and Wales have lost access to websites and online consultation functions after Silicon Practice’s parent company, Schappit Ltd, entered administration. The disruption has required affected NHS organisations to establish alternative patient communication routes while replacement technology is arranged.
Silicon Practice provided practice websites, FootFall online consultation tools, and associated patient-facing services. Those facilities can support appointment requests, enquiries, and access to information about local surgery arrangements. When a supplier providing them stops operating, practices may need to move quickly to telephone, email, and other established channels.
West and North London Integrated Care Board said 37 practices in its area used Silicon Practice websites and three used the company’s online consultation platform. The ICB confirmed that the practices remained open and advised patients to use alternative contact routes when their usual website or online service was unavailable.
Similar problems were reported in Gloucestershire, Hertfordshire, Norfolk, and parts of Wales. NHS England said most practices had retained their usual online presence, but the provider’s withdrawal affected a number of services. The individual impact depended on which products each surgery used and whether an alternative platform was already available.
The immediate event is a commercial supplier failure, not a confirmed cyberattack. Nevertheless, the consequences are relevant to technology resilience because patient access can be interrupted whether a platform becomes unavailable through malicious activity, technical failure, or the insolvency of the company operating it.
GP services increasingly use websites and electronic forms to collect routine requests and direct patients to relevant services. These tools can reduce telephone demand and give patients additional ways to communicate with practices, but their usefulness depends on sustained operation of the software and the organisations supporting it.
Replacing a supplier involves more than publishing a new webpage. A practice must ensure that its telephone number, opening hours, appointment arrangements, and patient information are correct on the replacement site. It may also need to reconnect forms and consultation tools to its existing administrative processes.
Where online forms have collected patient enquiries, organisations need to understand what historical data remains with the former provider, who can access it, and which retention or transfer arrangements apply. These are information governance questions even where there is no evidence of unauthorised access to the data.
The failure also illustrates the concentration of operational dependencies across individually managed public services. Several GP practices can use the same external platform while retaining separate clinical systems, staff, and patient lists. One supplier problem can therefore disrupt communications at numerous locations without any common failure in their clinical databases.
Integrated care boards have a coordinating role in helping affected practices identify replacement arrangements and convey accurate information to patients. Local variation is likely because surgeries used different combinations of website, chatbot, and consultation services from the provider.
The ability to recover depends on whether website content can be exported, whether domain names remain under the practices’ control, and how quickly alternative providers can support migration. The availability of archived information and clear contractual responsibilities can influence how much material needs to be recreated.
Public sector procurement and operational resilience arrangements routinely address cybersecurity controls, but supplier continuity introduces a separate set of questions. Contracts may need to account for termination, administrative access, data portability, and support during an unexpected exit, as well as protection against unauthorised activity.
The affected practices have continued providing clinical services through alternative communications where necessary. Replacement websites and online consultations will be restored at different rates according to local arrangements and the technical work required to move each practice away from the failed provider.
The disruption demonstrates the practical reliance of patient-facing services on outsourced technology, while leaving the cause correctly identified as Schappit Ltd’s administration rather than a security breach.
