Primary care clinical system support: who provides it in the UK?

Primary care clinical system support is provided by a mix of clinical system vendors (EMIS, SystmOne), NHS Digital-approved suppliers and specialist IT firms who handle updates, backups and user training; practice-level onboarding typically takes days and wider service contracts are often annual under NHS Digital rules.

First week

In the opening days after choosing a support arrangement you need three concrete wins: access, continuity and logging. Make sure every clinician has functioning logins to the clinical system (EMIS or SystmOne are the common platforms), secure remote access if used, and a named contact for incidents. Confirm who will take the initial incident calls — is it the vendor’s helpdesk, an in-house manager or an outsourced team? That matters because response times and escalation pathways differ.

Practical checks to run in week one:

  • Verify user authentication and two-factor settings for a sample group of users.
  • Test one clinical workflow end-to-end (appointment booking to record update) so you spot immediate integration gaps.
  • Ask for a runbook or simple escalation chart that shows who to call at 9am, 5pm and out-of-hours.

Insist on a single shared channel for incident reports (email or ticketing portal) and get the first incident logged yourself so you can measure response time. Early friction usually comes from unclear ownership between vendor and practice IT — resolve that in writing before you proceed.

First month

During the first month the work shifts from access to stability and data safety. Expect configuration tweaks, a first wave of user questions, and at least one patch or update. Ask the support provider for a short plan covering backups, version control and a training session schedule. Prioritise backups and restores — having a backup is not enough unless you have tested a restore.

Use this month to tidy contracts and responsibilities: who verifies backups, who applies security patches, who runs staff training? If you’re using a third-party IT supplier, link them into your clinical-system vendor support plan so tickets don’t bounce. For practical help on managing healthcare IT suppliers, see the healthcare IT support overview on the site linked here: healthcare IT support options.

Also capture a simple service level agreement (SLA) for common problems — for example, account lockout within one working hour, downtime notification within 30 minutes for major outages — and record agreed working hours and out-of-hours cover.

First quarter

By month three the focus is resilience and compliance. Expect to have completed at least one patch cycle and several staff training sessions addressing common errors. Now you should see whether the support model scales: are tickets falling, or are repeat issues still consuming clinical time? Ask for a quarterly report that summarises incident types, times to resolution and any recurring configuration faults.

Compliance tasks become urgent in this phase. Complete or update the Data Security and Protection Toolkit (DSPT) — this is an annual requirement for many primary care providers as set out by NHS Digital — and ensure your support provider can supply evidence for controls and audits. For DSPT details consult NHS Digital’s DSPT guidance.

Adopt a simple governance rhythm: monthly incident review with clinicians, quarterly technical review with the supplier, and a named data protection lead to own evidence for audits. If you find unresolved technical debt — legacy integrations, unsupported plugins, or large numbers of workarounds — make a plan to remediate or isolate them.

First year

After 12 months you should be able to judge whether the chosen support model delivers the outcomes that matter: fewer interruptions, predictable costs and reduced clinical frustration. A mature arrangement will include routine patching, annual DSPT evidence, regular training refreshers and a documented upgrade schedule.

Year-one checks to run:

  • Review the incident ledger and ask for a breakdown: what percentage of tickets were vendor-resolvable vs third-party problems?
  • Confirm upgrade windows and downtime history — were SLAs met?
  • Assess staff competency: have training needs fallen or are errors repeating?

If outcomes aren’t improving, change the support model. That might mean moving to a managed service, re-negotiating SLAs with your vendor, or switching to a supplier that specialises in primary care systems. Make cost comparisons on total cost of ownership (support fees plus clinical downtime), not on headline monthly charges alone.

What to watch for next

Track three signals over the coming months: repeat incidents, slow vendor response, and audit gaps. If repeat incidents exceed a small handful per month or if major incidents recur, escalate to contractual remedies or consider a specialist provider. Keep the DSPT calendar in your diary and refresh staff training every 6–12 months.

Finally, if you need a reliable partner who understands clinical workflows rather than generic IT, look for suppliers who publish healthcare-specific SLAs and who can show you evidence of previous primary care integrations — that saves time and cash. A short review now will protect clinical time and your reputation; aim to reduce incident-driven clinician interruptions within the next quarter.

Related reading

FAQ

Who is responsible for fixing an EMIS or SystmOne outage?

Responsibility splits: the vendor handles core application faults, while the practice or contracted IT supplier manages local connectivity, access and workstations; confirm ownership in your SLA to avoid ticket ping-pong.

How long does it take to onboard support for a practice?

Basic user access and incident handling can be set up in a few days, while full configuration, backups and training commonly take between 2 and 6 weeks depending on practice size and integrations.

How often must I complete the DSPT for my clinical systems?

The Data Security and Protection Toolkit is an annual assessment — you should complete it once every 12 months and retain evidence suppliers provide for each control.

What are common hidden costs with clinical system support?

Watch for per-incident fees, out-of-hours charges, and extra costs for integrations or upgrades; ask for an example annual invoice to compare likely totals rather than advertised monthly rates.