Health and care

The suppliers, products and customers in this chapter are in the landscape database, filtered to health and care, with known spend and sources. The graph shows how they connect.

Sector overview

The health-and-care estate is the largest single concentration of public-sector digital spend in the UK. It comprises six broadly distinct sub-sectors:

• Primary care: general practice, mostly delivered by independent contractor practices using a small number of dominant clinical systems.
• Secondary care: acute hospital trusts running electronic patient records (EPRs) for inpatient, outpatient, and emergency care.
• Community and mental health: trusts running community health services, mental health, and increasingly integrated community-based care.
• NHS national infrastructure: the spine, the demographic service, e-Referral, electronic prescribing, NHS Login, the App, the Federated Data Platform.
• Adult social care: commissioned by upper-tier councils, delivered by local-authority and private providers; case management is patchwork.
• Children’s social care: statutory casework with safeguarding obligations, dominated by two case-management vendors.

Funding comes from several sources. NHS England funds national infrastructure and a portion of secondary-care digital investment. Integrated Care Boards (ICBs) commission and pay for primary-care IT (the GP IT Futures framework) and contribute to community digital programmes. Trusts hold their own digital budgets for EPRs and trust-level systems. Local authorities fund social-care IT directly out of council budgets. Devolved-nation bodies (NHS Scotland, NHS Wales, HSC Northern Ireland) operate parallel national infrastructures with significant variation, particularly in Scotland.

Total digital spend

The combined annual digital spend across NHS and social care in the UK is in the region of £5–8 billion Low, with a central estimate around £6.5 billion Est. The range is wide because:

• Trust-level digital spend is reported inconsistently and often blended with broader operational categories.
• Social-care digital spend is rarely separated from generic IT.
• Devolved-nation figures are not reported on a consistent basis with NHS England.

Inside that range, three large blocks dominate: the NHS England national infrastructure programme and Federated Data Platform; the secondary-care EPR estate (frontline digitisation programme and trust-level investments); and primary-care IT under the GP IT Futures framework. National infrastructure alone (spine, NHS Login, e-Referral, electronic prescribing, e-RS) is in the region of £700m–£1.2bn per year Med.

Major systems inventory

Spend breakdown

Licensing and subscription is the dominant ongoing cost, particularly for the GP IT estate (paid through the GP IT Futures framework) and for Microsoft 365 across the NHS. Acute trust EPR licensing is large but lumpy: contracts are renegotiated on multi-year cycles and trusts can face price increases of 10% or more at renewal.

Implementation and integration dominates capital spend during EPR procurement. The NHS frontline digitisation programme has earmarked over £2bn for trust EPR implementations, with implementation services typically costing as much as or more than the licence itself.

Hosting and infrastructure is shifting rapidly to cloud, primarily AWS and Azure under national NHS framework agreements. This adds a dependency on US cloud providers that is not always visible when spend is reported by vendor.

Sunk consultancy and programme costs are significant in this sector. The historical National Programme for IT (NPfIT, 2002–2011) is the best-known example, estimated at £9.8bn in the National Audit Office assessment High. Current programmes (FDP, frontline digitisation, the New Hospital Programme digital strands) have already drawn substantial consultancy fees.

Lock-in and concentration analysis

The GP clinical-systems market is a duopoly: EMIS Health (now part of Optum/UnitedHealth) and TPP between them cover ~94% of English practices. The acute EPR market is more fragmented but is consolidating around two US vendors, Oracle Health (Cerner) and Epic, with a small number of UK and European alternatives surviving in the long tail. Mental health and community is dominated by RiO and SystmOne. Social care is a duopoly: Liquidlogic and Mosaic.

The main lock-in mechanisms are:

• Data formats. Most clinical-system data exports are partial. Medication histories, structured observations, and consultation narrative are hard to extract in a way that re-imports cleanly into a competing product. The General Practice Extraction Service (GPES) provides a national pathway for some data, but moving a practice between systems remains slow and disruptive.
• Accreditation. Clinical safety standards (DCB0129, DCB0160), the GP IT Futures framework, and the NHS Digital Technology Assessment Criteria (DTAC) are necessary. They are also barriers to entry that favour incumbents who have already paid the certification cost.
• Integration monopolies. The Spine, e-Referral, and EPS are the national integration points. Vendors with established, certified integrations to these have an advantage over new entrants.
• Acquisition-driven concentration. EMIS was acquired by Optum (UnitedHealth) in 2023. Cerner was acquired by Oracle in 2022. A growing share of clinical data on UK patients is now controlled by US-incorporated parents.
• Skills lock-in. Clinical and administrative staff become deeply trained in one system. Switching requires retraining, which procurement business cases rarely cost in full.

Replaceability assessment

Primary care: GP clinical systems B

Open alternatives exist in the international market (most notably OpenMRS and OpenEMR) but have not been built around UK GP workflows, the QOF reporting requirements, the NHS prescribing model (FP10, EPS), or NHS Number lookups. Clinical safety and DTAC accreditation add significant cost and time. A UK-focused open GP system would need a multi-year, multi-million-pound build with clinical safety and integration certification included from the start. That is feasible for a well-funded national sovereign-tech programme but not as a CIC project on its own. The CIC’s plausible role is component contributions (e.g. a clean open EPS-integration library, an open prescribing module, or an open clinical-coding browser).

Acute EPRs: Oracle Health, Epic, System C, Altera C

Replacement is possible in principle but is the hardest case in this sector. Acute EPRs are deeply integrated with hospital workflows, medical-device interfaces, prescribing, ordering, and clinical safety. A failed transition can harm patients. There is no mature open EPR for UK acute care; international open systems (OpenMRS, OpenEHR-based platforms) are designed for low-resource settings and are not credible competitors at scale. The CIC is unlikely to replace an acute EPR. It could contribute tools that sit alongside one: open APIs, open data-export tools, and open auditing and observability layers that reduce a trust’s dependency on the EPR vendor.

Mental health and community: RiO, SystmOne B

Workflows are less safety-critical than acute and more structured than primary care. Open EHR-based platforms (such as Better and others) have made some inroads in European community-care settings. A credible UK community-mental-health open alternative is more tractable than acute EPR replacement, particularly if scoped as a single trust pilot with strong clinical-safety governance. This is beyond a small CIC engagement but is a reasonable long-term Tier-2 candidate.

Social care case management: Liquidlogic, Mosaic A

This is the strongest replaceability candidate in the sector. Social-care case management is essentially a structured workflow with statutory reporting overlays, attached documents, and audit. The data model is well-understood. Clinical-safety regulation does not apply in the same way as it does for NHS systems. The two incumbent products are functional; their users frequently describe them as dated and rigid. A modern open case-management platform configured for adult and children’s social care is a realistic CIC-aligned project, particularly if developed with one or two willing local authorities as anchor partners. Statutory returns (SSDA903 for children, SALT for adults) are well-documented and can be exported from any compliant system.

NHS national infrastructure: Spine, e-RS, EPS, NHS App D

Already publicly owned, in many cases built largely in-house by NHS England, with growing API openness. Because ownership is already public, the sovereignty question here concerns how the code is governed and how transparent its development is. The CIC’s role would be to argue for more openness.

Federated Data Platform: Palantir B

This is the most politically contested system in the sector. Awarded to Palantir in 2023 for a programme valued up to £330m initially. Concerns are well-documented: vendor concentration of population-scale health data, US-incorporated supplier with intelligence-sector roots, opaque internals. A publicly-owned federated data platform is technically feasible: the underlying patterns (federated query, attribute-based access control, audit) are well-understood and similar systems exist in other domains. The build cost would be substantial, though lower than the contract value over the medium term. This is a Tier-1 candidate at sector level, though delivering it is well beyond CIC scale alone.

NHS Microsoft 365 and Teams C

The NHS-wide Microsoft estate is the largest case in the sector of day-to-day operations depending on one supplier. Replacement is not realistic in the near term. Mitigation is realistic: open-source collaboration tools (Nextcloud, Element, Jitsi) for specific use-cases, and procurement terms that preserve audit and exit rights. The CIC has no plausible direct role here; this is a matter for national procurement.

The human dimension

The NHS Staff Survey and successive reports from the Royal College of Physicians, the BMA, and the Nuffield Trust report similar findings: clinical staff find current digital systems a major source of frustration and a meaningful contributor to burnout. The repeated findings include excessive clicks per consultation, slow response times, poor mobile experiences, fragmented information across multiple systems, and longer consultations, which lead clinicians to take shortcuts in documentation.

Adaptation sovereignty is very limited. Clinical staff and trust-level digital teams have very limited ability to shape what their systems do next. Vendor roadmaps prioritise the largest customers and the most common requests; local needs are met through workarounds, local integration code and separate spreadsheets.

Skills lock-in affects staff careers. A clinical-systems analyst with long EMIS experience finds it much harder to move to an organisation that runs SystmOne, and vice versa. This is rarely scoped into procurement decisions.

The reported problems are greater in social care. Social workers routinely say that case management systems add to their administrative load, and that they are poorly fitted to the realities of safeguarding and assessment work.

Hands-off and out of scope

Sector summary

Sequencing

Anchor-partner work in social care could begin in a Phase-Two CIC with one or two willing council partners. Open GP-infrastructure components are a longer-horizon initiative requiring sustained funding and clinical-safety governance. The federated-data-platform alternative would need funding on the scale of a national sovereign-tech fund; the CIC’s role would be to argue for it and contribute components.