Synnovis put a price on pathology consolidation that no contract carried

The week

On June 3, 2024, Synnovis was hit by ransomware later attributed to the Qilin group. Synnovis is a pathology partnership between the laboratory company SYNLAB and two London hospital trusts, Guy’s and St Thomas’ and King’s College Hospital. It was created in 2021 from an earlier joint venture, under a contract SYNLAB described as running 15 years. Blood testing, transfusion support and results reporting across much of south-east London were disrupted. The two trusts declared a critical incident, and GP practices in six boroughs saw blood test capacity sharply cut. Without fast electronic access to blood group results, hospitals fell back on O-type blood, and on June 10 NHS Blood and Transplant appealed for O-negative and O-positive donors. Later in June, the attackers published data taken in the attack.

Pathology is a classic case for consolidation. Laboratories have high fixed costs, expensive analyzers and scarce specialist staff. Pooling the work of several hospitals and their GP practices into one operator lowers the cost per test, and the saving recurs every year. The business case for a partnership like Synnovis counts those savings with care. What it rarely counts is the other side of concentration: a low-probability event in which the whole region loses the service at once. That loss is large, lumpy and slow to recover from. In June 2024 it arrived, and it landed on parties who had never agreed to carry it. Three places should have priced it, and none did: the contract, the spare capacity around it, and the allocation of the financial loss. We take them in that order, because each is a decision made years before any incident.

The contract

Long outsourcing contracts for clinical services are written around steady-state performance. They specify turnaround times, availability targets and service credits for missed levels. Service credits are built for a bad month of slow results. Against a regional outage measured in weeks, they are close to irrelevant. They return a fraction of the fee and do nothing for patients waiting on results.

The terms that matter in a destructive event are different, and most long contracts are thin on them. They include who sets restoration priorities, and how clinical urgency enters that decision. They cover how fast the supplier must share forensic findings that affect the buyer’s own network. They set what interim manual service the supplier must staff, and at whose cost. And they define what assurance the buyer receives before reconnecting interfaces. When those terms are missing, they get negotiated during the incident, by the same people running the response.

A 15-year term adds a second problem. Security expectations in 2021 were not those of 2024, and will not be those of 2036. A contract that freezes its security schedule at signing needs a mechanism to raise it: periodic re-baselining, a right to require specific controls, and a price adjustment path so the supplier can fund them. Without that, the buyer’s only lever is renewal, which may be a decade away. Joint ownership does not solve this. The trusts were co-owners of Synnovis, and that gave them a seat at the board, not a fallback laboratory.

The spare capacity

Consolidation removes alternatives by design. A region that once had several hospital laboratories now has one network, with ordering, results and blood bank records running through shared systems. When that network fails, the fallback is other laboratories with capacity to spare, compatible test catalogs, transport, and a way to return results to the right patient record. None of that exists by default, and it cannot be built in a week.

Spare capacity has to be bought in quiet years, which is why it is usually cut. It can take the form of a standing mutual aid agreement with laboratories outside the network, with agreed volumes and prices. It needs pre-built order and result interfaces, tested at least annually, even if they carry no daily traffic. It requires a short list of tests that will be protected in a degraded state, agreed with clinicians in advance. And it needs a plan for data the clinicians lose, such as historical blood group results. The O-type blood appeal showed how a narrow data gap can create a national supply call.

In budget terms, this capacity looks like duplication. It is better understood as an option premium. The buyer pays a modest, predictable amount each year for the right to move urgent work elsewhere at short notice. Whether that premium is worth paying depends on the cost of the event it hedges, which brings us to the third decision.

The loss allocation

An event like Synnovis spreads costs widely. The supplier pays for forensics, rebuilding and its own lost revenue. The hospitals absorb postponed operations and outpatient clinics, overtime, agency staff and the cost of running manual processes. GP practices and patients absorb delay. Some of that delay causes clinical harm, which carries its own legal and human cost.

Outsourcing contracts allocate only a small slice of this. Liability is commonly capped at a multiple of annual fees, and consequential losses are often excluded outright. The supplier’s cyber insurance has limits, sublimits and exclusions, and responds to the supplier’s losses first. The buyer’s own cover may treat a supplier outage as a contingent business interruption event with its own sublimit, if it covers it at all. The result is that most of the loss sits with the buyer and its patients, uninsured and unbudgeted.

The honest procurement response is to estimate the loss. A hospital finance team can model a four-to-six-week loss of pathology: cancelled elective activity, outpatient slots, extra staffing and recovery backlog. That figure should sit next to the annual savings in the business case. It then sets three numbers: the size of the option premium worth paying for spare capacity, the liability cap and insurance requirement worth negotiating, and the residual risk the board knowingly accepts. US health systems with outsourced or joint-venture laboratory, imaging and pharmacy services face the same arithmetic. A HIPAA business associate agreement governs protected health information, and says nothing about restoring service. Organizations should check with counsel how indemnity, caps and insurance in their agreements would respond to a prolonged outage.

With hindsight

The scale of the event became clearer over the following year. NHS England’s tallies put postponements above 10,000 outpatient appointments and 1,700 elective procedures. In January 2025 Synnovis said the attack had cost it more than £32 million, a figure that excludes the trusts’ own losses. In June 2025, King’s College Hospital confirmed that a patient’s death had been linked to the attack, with a long wait for a blood test result identified as one contributing factor.

Policy moved slowly toward suppliers. In November 2025 the UK government introduced the Cyber Security and Resilience Bill, which would bring managed service providers into the network and information systems regime. Legislation addresses the supplier’s security. It does not change who carries the loss when a consolidated service fails. That still depends on the contract, the spare capacity bought around it, and whether the business case priced the bad month alongside the good years.