Why buying the same software as your neighbors removes your fallback
Ransomware at one NHS supplier took urgent care systems offline across many providers at once. Peers could not cover for each other because they ran the same product. U.S. health systems buying shared SaaS face the same exposure, and procurement holds the levers.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On August 4, 2022, Advanced, a software supplier to the UK’s National Health Service, detected a ransomware attack that took several of its hosted products offline. They included Adastra, used by NHS 111 and out-of-hours urgent care services for patient records and call handling, and Carenotes, used by mental health and community care providers. Affected services, including NHS 111 in England and Wales, fell back to paper and manual processes, some for weeks, while the supplier restored systems in stages. Advanced later confirmed that LockBit ransomware was involved and that some data had been taken. The providers that lost their systems had not been attacked themselves. Their shared supplier had.
When one hospital loses its systems, its neighbors usually absorb the overflow. Ambulances divert, calls reroute, patients are seen elsewhere. That informal mutual aid is the health sector’s oldest resilience mechanism. The Advanced incident showed how shared software defeats it. Urgent care services that might have leaned on one another found that their neighbors ran the same platform and were down too.
U.S. health systems buy on the same model every day: hosted electronic health records for smaller hospitals and clinics, revenue cycle and clearinghouse services, scheduling and telehealth platforms, behavioral health and lab systems. For a buyer, the episode raises three distinct procurement questions. The first is how concentrated each critical service is across peers, which determines whether neighbors can help. The second is what the contract obliges the supplier to do before and during an incident. The third is what fallback the health system pays for that depends on neither the supplier nor its peers.
Concentration: when peers share the failure
Healthcare software markets are concentrated by design. In many specialties a handful of suppliers serve most providers, which brings shared investment, common workflows and easier data exchange. It also turns one supplier’s failure into a regional event. The same is true one layer down: several suppliers may host on the same cloud region or depend on the same managed service provider, so diversity at the contract level can hide concentration underneath. Asking suppliers where they host and who operates their infrastructure is part of the same picture.
A health system’s third-party risk program assesses its own suppliers. It rarely asks which peers in its region depend on the same platform, and so it cannot see when its diversion plan points at hospitals that will fail at the same moment. A concentration view adds that column. For each critical hosted service, it records the supplier and an estimate of how many nearby providers share it, drawn from regional coalitions, health information exchanges and the supplier’s own reference lists.
Where the share is high, the service should be treated as systemic. That changes the scenario plan: assume regional partners are down, and test whether emergency department diversion, transfer agreements and call handling still work. It may also change sourcing. A second supplier for a narrow function, such as an independent telehealth or patient messaging tool kept warm for emergencies, can restore a channel when the primary platform and its peers are dark. The cost is a second license and some training. The benefit is a route that does not share the failure.
The contract: what the supplier owes before and during
Hosted software contracts in healthcare focus on functions, uptime percentages and HIPAA business associate terms. A business associate agreement covers privacy obligations. It does not, on its own, require the supplier to restore service by any particular time.
Renewals are the moment to add terms that matter in a ransomware event. Notice within a short, defined period of any security incident affecting the service, not only of a confirmed breach. Annual evidence of security controls, including multi-factor authentication on every remote and customer access path, since the UK regulator later found that the attacker entered through a customer account without it. Recovery time objectives for the service as a whole, tested and reported. A right to export the health system’s data in a usable format at any time, including during an outage. And a commitment on how restoration is sequenced across customers, so a large system knows whether it waits behind hundreds of others.
Each term has a price. Suppliers charge more for tested recovery and data export features, and smaller providers have little bargaining power alone. Group purchasing organizations and regional coalitions can negotiate common terms that individual clinics cannot. Organizations should check with counsel on how incident, breach and business associate obligations interact in their agreements.
Fallback: capability that depends on no one else
The UK services that coped best had practiced paper processes, kept recent data available offline and could add staff for slower manual work. A hosted service changes what that preparation looks like, because the health system cannot restore the system itself and does not know how long it will wait.
Three items belong in the budget for any critical hosted service. The first is a periodic local extract of the data needed to operate: patient lists, active orders, medication information and open referrals, readable on a device that does not depend on the supplier. The second is downtime procedures and forms that staff have actually used in a drill, with a named clinical owner. The third is a reconciliation plan for entering paper records once the system returns, which in a long outage can take longer than the outage itself.
These costs are easy to leave out of a SaaS business case, because the vendor’s price looks complete without them. A total cost of ownership that includes extracts, drills and reconciliation staff gives a truer comparison between suppliers, and between hosted and self-run options. A supplier that makes local extracts easy is cheaper to own than one that makes them hard, even at the same subscription price.
With hindsight
Advanced restored its services over the following weeks and months. In March 2025 the UK Information Commissioner’s Office fined its health and care subsidiary about 3.07 million pounds, citing gaps including the lack of multi-factor authentication on the account the attacker used. It was reported as the first such fine against a data processor rather than a controller. The U.S. counterpart arrived in February 2024, when ransomware at Change Healthcare disrupted claims, pharmacy and authorization processing for providers nationwide for weeks and prompted emergency federal funding arrangements. That made the concentration argument impossible to ignore. By 2026, more health system contracts include incident notice, recovery and data export terms, and more organizations hold offline copies of critical data. Concentration itself has not declined much, so contracts and practiced fallbacks remain the main defense.