NHS England Probe Suppliers for Cybersecurity Controls

The National Health Service in England will reach out directly to suppliers to ensure they implement proactive and robust cybersecurity risk management measures, officials said Wednesday.

See Also: Reduce Cloud Risk in Healthcare with Security by Default

The move comes in the wake of recent high-profile ransomware attacks on NHS vendors that seriously disrupted patient care.

In an open letter, top cybersecurity officials from NHS England said it or “the relevant contracting authority” plans to contact suppliers to discuss their security controls, and potentially request evidence or supporting information.

Suppliers that deliver services, critical patient care or operational continuity will likely be subject to closer scrutiny, said the letter signed by Mike Fell, executive director of national cyber operations at NHS England, and Phil Huggins, national CISO for the Department of Health and Social Care.

The outreach followed other efforts by NHS England and the Department of Health and Social Care to shore up cybersecurity of third-party vendors, which health systems around the globe have identified as a growing vulnerability (see: Free Healthcare ‘Toolkit’ Ranks and Maps Third-Party Risk).

That includes a “Cybersecurity Supply Chain Charter” launched in May 2025 that established “shared expectations of good cyber practices.”

An undisclosed number of suppliers signed up for the charter, NHS England said.

For suppliers that have multiple NHS customers, NHS England aims to minimize duplicated requests when possible. “This is not an audit, and it is not a pass or fail exercise. This program is about identifying risk and working in partnership to agree on proportionate remediation activity that strengthens resilience for everyone,” officials wrote in the open letter.

To prepare for NHS England’s outreach, suppliers are advised to review the expectations set out in the Cyber Security Supply Chain Charter, including:

• Keeping systems patched for known vulnerabilities;
• Implementing multifactor authentication and enabling it on NHS-facing products where appropriate;
• Deploying monitoring and logging of critical IT infrastructure;
• Testing recovery plans and ensuring that backup cannot be changed;
• Conducting board-level cyber exercises;
• Complying with the Department for Science, Innovation and Technology and National Cyber Security Center’s software code of practice.

Among the most disruptive cyber incidents affecting patient care in the United Kingdom was a 2024 ransomware attack on pathology laboratory services firm Synnovis. Hackers incapacitated Synnovis’ ability to perform a host of services, including blood testing.

That incident led to the cancellation or postponement of 10,152 acute outpatient appointments and 1,710 elective procedures at the most affected NHS trusts – London’s King’s College Hospital and Guy’s and St. Thomas hospitals (see: Synnovis Notifying UK Providers or Data Theft in 2024 Attack).

In the United States, government watchdogs are urging the U.S. Department of Health and Human Services also to take proactive steps in bolstering its oversight of third-party contractors and the security risk they introduce to federal IT systems and the healthcare sector at-large (see: HHS Watchdog Urges Cyber Governance Overhaul).