When a technology vendor supplying NHS systems suffers a significant security incident, or is found to have supplied systems with documented security vulnerabilities, what happens to their contracts? Analysis of NHS procurement data against ICO and NCSC security incident records suggests the answer, consistently, is: very little.
The Contractual Framework
NHS England’s standard contract terms for technology suppliers include provisions relating to security standards: requirements to maintain ISO 27001 certification, to notify of material security incidents within specified timeframes, and to remediate identified vulnerabilities within agreed timescales. Contracts also include termination for material breach provisions that could, in theory, be triggered by serious security failures.
NHS Shared Business Services, the body that manages centrally-procured NHS IT frameworks, publishes framework agreements and contract notices on Contracts Finder. These show the suppliers awarded places on major IT frameworks — including the Technology Products and Associated Services framework and the Health Systems Support Framework — and the value of subsequent call-offs.
The Pattern of Awards
Exposed News cross-referenced suppliers who had been named in ICO regulatory notices, NCSC advisories, or parliamentary committee reports in connection with significant NHS security incidents against subsequent NHS contract awards over a five-year period. The analysis identifies several suppliers who continued to receive significant contract awards after security-related incidents.
The analysis does not imply that the suppliers acted unlawfully or that the contract awards were improper. It does identify a gap between the contractual framework — which includes security obligations and breach provisions — and the procurement practice, in which security incident history does not appear to be a material factor in subsequent award decisions.
NHS England’s procurement guidance requires contracting authorities to assess suppliers’ “technical and professional ability” as part of selection criteria. Guidance published by the Cabinet Office allows exclusion of suppliers on security grounds. In practice, NHS trusts making procurement decisions within existing frameworks have limited ability to exclude suppliers already on centrally-approved frameworks, reducing the leverage that security performance should theoretically provide.
The Lock-In Problem
A significant structural driver of continued contract awards to suppliers with poor security records is the lock-in created by legacy clinical systems. Electronic patient record (EPR) systems, laboratory information management systems, and imaging archive systems typically represent multi-year, high-switching-cost investments. Once implemented, they are extremely difficult to replace within a reasonable timeframe or budget — regardless of the supplier’s subsequent security performance.
This creates a perverse incentive structure: suppliers know that once their system is embedded in clinical workflows, the cost of replacement is prohibitive. The leverage that security performance standards are meant to create — the threat of contract termination — is hollow in practice because NHS trusts cannot operationally afford to terminate embedded clinical systems on security grounds without a realistic replacement path.
What the Framework Owners Should Do
NHS England’s framework agreements include provisions for suspending or removing suppliers, but these provisions have not been publicly invoked in any case related to security failures. NHS Shared Business Services told Exposed News: “Supplier performance is regularly reviewed and suppliers are expected to meet all contractual obligations including security requirements. We do not comment on individual supplier relationships.”
The National Audit Office’s examination of NHS cyber resilience, published in 2024, noted the lock-in problem but did not examine how security performance information flows into procurement decisions. The NAO recommended that NHS England develop a systematic approach to integrating security performance data into procurement and contract management. NHS England accepted this recommendation; implementation timelines have not been published.