GP practices impacted by major cyber attack to see local income protection

GP practices impacted by a cyber attack earlier this year will see their income from locally commissioned services protected following LMC negotiations with the ICB.

However, a decision on national contracts such as QOF has not yet been made, with NHS England still ‘considering how best to provide income protection’ to practices.

At the start of June, Synnovis, a provider of lab services for a group of London hospitals, was the ‘victim of a ransomware cyber attack’ which disrupted its pathology services. 

Blood testing from GP practices in south east London was only recently restored, with GP practices experiencing disruption for months after the attack. 

In the immediate term, South East London ICB provided £420,000 of compensation to GP practices to manage unprocessed tests. 

But the ICB also recognised the ‘broader impact’ of the Synnovis incident on practice income, and committed to protecting ‘core and enhanced income’ pending NHS England approval. 

A document shared with practices in June said: ‘All financial incentives within the core contract and directed enhanced services and any locally commissioned services (including LIS/LES, PMS, prescribing incentives etc) will be reviewed to identify the impact of reduced access to pathology services. 

‘Where a financial incentive is identified as being impacted by reduced access to pathology services, our intention will be to offer income protection. 

‘It should be noted that the ICB is required to gain approval from NHSE before we can make any changes to nationally set core contracts and associated incentive schemes (such as QOF). We have initiated discussions with NHSE on this.’

In its most recent update, SEL ICB confirmed that GP practice income from locally commissioned schemes will be maintained against 2023/24 achievement levels. 

However, the ICB said that ‘nationally commissioned contracts will not be varied and payments to practices will be made in line with contract achievement’. 

It continued: ‘The ICB will invest funding resulting from any under-delivery of the national contract into the recovery and restoration of care across South East London. 

‘This will be applied on an individual practice basis to support practice recovery and income remaining stable in 2024/25.’

When asked whether NHS England refused the ICB’s request to protect national income, a spokesperson for SEL told Pulse: ‘NHS England are considering how best to provide income protection to practices in south east London affected by the cyber attack on pathology services provider Synnovis. 

‘A review of the full impact of the cyber attack is being carried out in order to ensure practices and PCNs are not unduly disadvantaged as a result of the attack.’

Londonwide LMCs told Pulse that problems caused by the Synnovis cyber attack have ‘taken up vast amounts of GP time’ but practices have seen ‘only modest compensation’ for the initial round of records reviews. 

A spokesperson continued: ‘No additional funding has gone into South East London to cover all the further activity created as practices worked tirelessly to keep patients safe in the face of reduced and disjointed testing capacity.

The LMCs said its successful negotiation for local income protection is a ‘step in the right direction’ but called for wider support from NHS England. 

‘Really there should be further support in the form of additional funding from a national level to reimburse practices for the continuing time and resources required clearing up a mess that was not of their making,’ they added.

Following the attack in June, Synnovis confirmed that some patient data was published by the cyber criminals, but said there was ‘no evidence’ that this included patient test results.