Security, governance & compliance you can trust

Yes. Medicus is a cloud-native Foundation GP system, assured by NHS England through the TIF and built to the Foundation Clinical System standard. Our security is certified to ISO 27001 and Cyber Essentials Plus, and we are rated Standards Exceeded against the NHS DSPT, its highest rating. We have also completed the NHS Digital Technology Assessment Criteria (DTAC), the national baseline covering clinical safety, data protection, security, interoperability and accessibility.

Yes. As the system manufacturer we comply with DCB0129, the NHS clinical risk management standard, and we are registered with the MHRA as a Class I medical device. Every hazard is logged, our Clinical Safety Case is owned by a named Clinical Safety Officer on the GMC register, and we give your practice the safety case and templates to make its own DCB0160 sign-off straightforward.

All patient data is hosted in the UK on AWS, encrypted in transit and at rest. Access is role-based and protected by two-factor authentication and automatic log-out, with a separate database for every practice. Security is managed through an ISO 27001 information security management system and Cyber Essentials Plus, with continuous vulnerability management and independent penetration testing by a CREST-accredited provider.

Your practice is the Data Controller and Medicus is the Data Processor, processing patient data only on your instructions under a signed Data Processing Agreement and in line with UK GDPR. We are rated Standards Exceeded against the NHS DSPT and maintain a DPIA.

Medicus runs across multiple availability zones in the AWS London region, with automatic failover on every component. Data is protected by nightly snapshots kept for 45 days and point-in-time recovery, backed by tested disaster recovery and business continuity plans. We monitor the platform continuously, with a defined major-incident process and automated escalation if anything goes wrong.

Yes. The platform scales automatically, so the same system serves a single practice, a PCN or an entire ICB without redesign or migration. Our performance targets are 95 per cent of requests served within one second and 99 per cent within three seconds, reported to NHS England every month.

Medicus is built on national open standards, including GP Connect, GP2GP, EPS, e-RS, PDS, the Summary Care Record, Smartcard authentication and the NHS App, rather than custom point-to-point links. Practices can also keep the third-party tools they choose, from online consultation and telephony to document management, medicines optimisation, diagnostics and shared care records. A full, current integration register is available on request.

Migration follows a proven kick-off to go-live method, typically six to eight weeks, led by a dedicated implementation manager who is your single point of contact. We combine a full data extraction with a final delta migration and a weekend cut-over to a Monday go-live, with data validation and clinical safety sign-off at every gate and a documented rollback plan should it ever be needed.

Medicus leads the implementation from start to finish, so your ICB plays a facilitative role rather than a delivery one. We run discovery and planning, configuration and readiness, the weekend cut-over migration (governed by the NHS England Data Migration Standard) and all training, with in-person sessions for super users and clinical leads and role-based online training for everyone else. Our specialists are on site on go-live day and available throughout, followed by daily check-ins before each practice settles in with our dedicated Medicus support team.

The ICB's main involvement is to support the procurement process for the NHS England call-off. Medicus provides the assurance evidence directly, including the DPIA, DCB0129 Clinical Safety Case, DSPT evidence and information governance documentation, so the ICB's role is to receive and acknowledge it rather than produce it.

There is no cost to your practice. As an approved Foundation Clinical System on the NHS England TIF, Medicus is funded centrally by the NHS. You can procure it through the Digital Care Services Buying Catalogue call-off under Practice Choice, supported by local clinical safety and governance approval and a signed Data Processing Agreement.

Our product specialists are on hand through a dedicated support desk. Core support runs 06:30 to 20:30 every day, including bank holidays, with non-core cover from 20:30 to 06:30. Right after go-live your practice moves into hypercare with hands-on help from your implementation lead, and we ship weekly updates with no downtime.