30-year-old NHS Supply Chain System Hit By 35 Major Alerts In 11 Months

Updated A state-owned company that handles £4.5 billion ($5.7 billion) annual spending on behalf of the NHS has suffered 35 high-priority computer system alerts in 2024, leading to delays in shipping thousands of products to UK hospitals.

NHS Supply Chain, which is owned by the Department of Health and Social Care, relies on a 30-year-old computer system called RESUS to support the delivery of clinically assured medical products to medical facilities throughout England and Wales.

A recent court case has revealed that the systems – run by medical software company iSoft under an arcane public finance initiative (PFI) contract – suffer from its age.

The case involves NHS Supply Chain Coordination Limited, which runs NHS Supply Chain, and GXO Logistics Limited, which won a recent £4.4 billion ($5.6 billion) contract to run logistics services, as an interested party. On the other side are Unipart Group Limited and DHL Supply Chain Limited, which are contesting the contract award and have used the courts to get the contract delayed.

The High Court judgment [PDF] in Unipart Group Limited v Supply Chain Coordination Limited t/a NHS Supply Chain was handed down last week by Technology and Construction Court judge Mr Justice Constable.

The judgment reveals, among other things, that in its legal argument to get the delay lifted, SCCL said GXO needed to start work on the contract so it could begin the procurement of a new computer system, which it urgently needs.

In a statement to the court, Andrew New, CEO of SCCL, said the SCCL's infrastructure is "based on a system called RESUS, which is around 30 years old."

He said there had been 35 highest priority "P1" alerts in the 11 months to the end of November 2024. One such alert, on 1 November 2024, is said to have resulted in 17,000 warehouse order lines not being picked and "consequent delays which affected the shipping of those products to hospitals."

The judgment quotes SCCL Board Minutes for the November 2024 meeting, which are not otherwise publicly available.

The minutes said: "It was noted that the fragility of the existing IT system meant that the risk relating to IT stability had crystallized and was now creating wider issues for the Company meaning that it was suffering contagion between risks and the Committee felt that this position was intolerable…."

SSCL is planning to modernize the system on a SaaS solution, but it needs its logistics supplier in place to inform system architecture decisions and technical roadmap.

"It is on this basis that delay to the letting of the New Contract impacts the progression of the IT modernization project, even though the logistics supplier is not carrying out that project itself," the judgment says.

Mr Justice Constable adds: "It also seems to me that Mr New's evidence that IT modernization is now critical is effectively a statement of public record. I do not regard the fact that the failure to have been able to progress this sooner – whether through funding difficulties or otherwise – detracts from that urgency or means that further delay is tolerable for the NHS or the public who may be impacted."

According to the judgment, New said in his statements to the court that "the only option is to build a new network, deploy new ERP technology and at the same time transform the service proposition and then transition demand between the old network and new network before changing the use or closing the legacy warehouses."

The judge then said the risks to the tech modernization if the logistic supplier was not in place were "very credible" and that any further hold up to the letting of the new contract would cause "real delays to SCCL's broader modernisation programme, the progress of which is obviously very important to the NHS and of extremely high public interest." The court thus agreed to the application to lift the suspension of the contract award.

• Medusa ransomware gang demands $2M from UK private health services provider
• Already three years late, NHS finance system replacement delayed again
• Cyberattack on NHS causes hospitals to miss cancer care targets
• Spending watchdog blasts UK govt over sloth-like progress to shore up IT defenses

The provenance of the RESUS system is obscure. Still, an NHS Supply Chain and Business Continuity Plan from St George's Hospital in London [PDF], written in 2009, tells us it is "the core business application and runs the Warehousing and Commercial operations of NHS Supply Chain."

Its hardware and operating system are "subject to PFI contractual arrangements with [health tech company] iSOFT who provide a managed hosting service in line with a formal service level agreement."

Meanwhile, the application code itself is "owned by IB Solutions and licensed to NHS Supply Chain. IB Solutions are contracted to provide software development services."

IB Solutions was an iSoft sister company which was sold to Capita in 2010. Meanwhile, iSoft became part of CSC in 2011. ®

Updated to add at 1219 UTC, February 28

An NHS Supply Chain spokesperson told The Register: "We are delighted with the judgment and now look forward to working with GXO once we have obtained final approval to our business case from ministers and Treasury. Whilst there are no current issues and the service operates as expected, our submitted evidence sets out details of our modernization plans."