Getting Prescriptions When GP or Pharmacy Systems Are Down

When a cyber attack or major IT failure takes out the systems your GP practice or pharmacy relies on, the electronic prescriptions that normally move between them stop working. That does not mean your medicine stops being available. Pharmacies can provide certain emergency medicines even if you do not have a prescription, and NHS 111 can direct you to the best place to get help, including where to get emergency supplies of your prescribed medicines and how to get a repeat prescription¹. If you have run out of prescribed medicine and need some urgently, there are a few ways to get an emergency supply, including out of hours¹.

The two main routes are simple: contact NHS 111 by telephone or through its online emergency prescription service, or contact a community pharmacy directly and request an emergency supply². NHS 111 will tell you which pharmacy to go to, or direct you to an urgent care centre if that is more appropriate². If the medicine is supplied through NHS 111, you will be charged the relevant prescription charge unless you are eligible for free prescriptions².

This page sets out what to do step by step, what to keep at home so an outage is an inconvenience rather than a crisis, and what the NHS's own reviews of past cyber attacks tell you about how long disruption tends to last. For the wider picture of appointments, A&E and tests during an IT outage, see NHS Appointments, A&E and Tests During an IT Outage; for keeping your own records on paper, see Keeping Key Records Offline.

What to do if your GP practice or pharmacy cannot access its systems

Start with the pharmacy. A pharmacist who cannot see your electronic record can still help: pharmacists can help with minor illnesses and can give you an emergency supply of some medicines if you have run out³. Walk in, explain that your GP practice's systems are down or that your electronic prescription is not working, and bring whatever you have: the medicine box, an old repeat slip, or a written list of what you take. If you are away from your usual area, pharmacists can still arrange an emergency supply of medications even if you do not live locally, though visitors are advised to call their own GP rather than the closest one⁸.

If the pharmacy cannot help, use NHS 111. You can call 111 or use the online service at 111.nhs.uk, which is a digital triage service that asks a series of questions about your main symptom³. The dedicated emergency prescription service at 111.nhs.uk/emergency-prescription asks questions including where you are and when you are due to take your medicine, so it can suggest the best option for you¹. NHS 111 is available 24/7 by phone, online or via the NHS App⁹, and it is the right route when you do not have a GP to call or your GP is not available¹⁰.

There are two things worth knowing in advance. First, an emergency supply is meant to tide you over, not to replace your repeat prescription, so once systems are restored, order your repeat through your GP, local pharmacy or NHS-approved apps including the NHS App⁷. Second, if a shortage rather than an outage is the problem, the pharmacy or GP may ask you to go to another pharmacy, offer a different formulation such as a tablet instead of a capsule, give you a smaller quantity to collect more frequently, or ask you to go back to your GP for a new prescription for an available medicine¹¹. Speak to your pharmacist or doctor, or contact NHS 111, with any questions about a medicines shortage¹¹.

If you rely on medical equipment that needs electricity

A cyber attack on the NHS is not the only way systems you depend on can fail. If electricity is crucial for any medical equipment you have, contact your distribution network operator at any time, as they may be able to put you on their Priority Register for assistance during a power outage¹². Households that rely on powered medical equipment will find more on this in Extra Help in an Emergency.

Keeping a home supply of regular medicines

The most useful preparation is the simplest: do not let your regular medicines run down to the last tablet. Always order repeat prescriptions before you run out, through your GP, local pharmacy or NHS-approved apps including the NHS App, and take your prescribed medication as directed⁷. This matters most just before periods when surgeries and pharmacies close, such as public holidays, when the usual routes to a prescription are slower¹³. NHS guidance for holidays and closures repeats the same point: if you run out of your regular medicine and your GP practice is closed, there are ways to get an emergency supply, but ordering ahead avoids the problem entirely¹⁴.

Alongside your repeats, keep a small home medicine kit. Official winter health advice is to keep essential medicines at home, such as painkillers, upset stomach relievers, antihistamines, plasters and bandages¹⁵. A household emergency kit should also include spare batteries and essential medication to take with you if you have to leave your home¹⁶. If you are travelling, take essentials including plasters, paracetamol and antiseptic, and order enough regular medication from your own GP ahead of your stay⁸.

Write down what you take. An up-to-date paper list of your medicines, doses and any allergies works when electronic records cannot be read, and it is exactly what a pharmacist needs to arrange an emergency supply. Keep it with your medicine kit, and keep a copy in any bag you would take if you left home in a hurry. For what else belongs in a household's offline records, see Keeping Key Records Offline and the wider guidance in Health Emergencies.

One further item belongs in the same drawer: a small amount of cash for essential purchases if mobile payment apps are disrupted¹⁷. A pharmacy supplying medicine in an emergency will charge the relevant prescription charge unless you are eligible for free prescriptions², and during an IT outage card payments may not be possible.

595 GP practices were hit when WannaCry struck the NHS

The clearest picture of what a cyber attack does to prescriptions and GP services comes from WannaCry in May 2017, the largest cyber attack to affect the NHS in England⁵. On 12 May 2017, NHS England initially identified 45 NHS organisations including 37 trusts that had been infected by the WannaCry ransomware⁵. In total, the ransomware affected at least 80 out of the 236 trusts across England, because they were either infected by the ransomware or had turned off their systems as a precaution⁴. A further 603 primary care and other NHS organisations were infected, including 595 GP practices⁵, which were locked out of their devices and could not access records or issue electronic prescriptions.

The scale matters for context. The NHS in England cares for over 1 million patients every 24 hours, in 236 trusts and 7,454 GP practices¹⁸. Even so, the official lessons learned review found that in total 1% of NHS activity was directly affected by the WannaCry attack, and 1,220 pieces of diagnostic equipment, also 1% of the NHS total, were affected¹⁸. For most households, the attack meant delayed appointments and slower access to records rather than a halt to care. There were no reports of patient harm¹⁸.

The cause, according to the official reviews, was unpatched software. None of the 80 NHS organisations affected by WannaCry had applied the Microsoft update patch advised by NHS Digital's CareCERT bulletin on 25 April 2017¹⁸, and the majority of infected NHS devices were running the supported but unpatched Microsoft Windows 7 operating system¹⁸. A community risk register summarises the lesson plainly: many organisations had not applied the recommended software updates in a timely manner, which left systems vulnerable¹⁹. The same principle applies to your own devices, as covered in Software Updates for Phones, Computers and Browsers.

Most practices were back within a week of the attack

Recovery from WannaCry was faster than many expected. NHS England declared a major incident at 16:00 on 12 May 2017 after reports of ransomware rose from four trusts to 16¹⁸, and stood the incident down on Friday 19 May, after a week of emergency response⁴. During that week, 1.2% of first appointments, 6,912 in total, were cancelled and re-arranged between 12 and 18 May¹⁸. Practices and trusts worked on paper in the meantime, and the emergency supply routes described above carried patients through.

That one-week pattern is a reasonable expectation for a single widespread attack, but it is not a guarantee for every incident. In WannaCry itself, 6,912 first appointments, 1.2% of the total, were cancelled and re-arranged between 12 and 18 May, and at least 80 out of 236 trusts were affected: 34 were infected and locked out of their devices, of which 27 were acute trusts, while a further 46 were not infected but still reported disruption²⁰. So plan on two horizons: a week or so of acute disruption for most attacks, and a longer tail of re-booked appointments and delayed non-urgent tests.

Why urgent care kept running: A&E diverts and mutual aid

The consistent lesson from every NHS cyber incident is that urgent and emergency care keeps going. During the Synnovis incident, all urgent and emergency services such as A&E, urgent care centres and maternity departments remained open as usual, although there were possible delays for blood tests⁶. People should still call 999 and go to A&E in an emergency, when someone is seriously ill or injured and their life is at risk²¹. A&E departments are for life-threatening illnesses and injuries only, are open 24 hours a day, 7 days a week, and attending unnecessarily could delay treatment for someone more seriously ill⁸.

The system also shares the load. Hospitals that are not affected by an attack create capacity to take patients from those that are⁶. NHS 111 can book you in to be seen quickly and safely at your local A&E if you need urgent care, and if you do arrive at A&E without contacting NHS 111 you will still receive medical care, with emergency treatments prioritised²². GP out-of-hours services remain reachable: call your practice, or if your practice is closed, call NHS 111 to book²³, and all patients are assessed by a clinician over the phone⁷.

For less urgent health needs, contact your GP or visit your local pharmacy in the usual way¹⁰. Consider other services such as your local pharmacy, your GP practice, or an urgent treatment centre for minor illnesses and injuries²⁴. Pharmacy First services can be reached by walking into the pharmacy or contacting them virtually, and GP receptionists, NHS 111 and emergency care providers can direct you to pharmacies offering the service²⁵. If you are not sure which service you need over a holiday period when the GP surgery or pharmacy is closed, go to 111.nhs.uk or call 111²⁶.

What a cyber attack on the NHS means for appointments and tests

The Synnovis attack in June 2024 shows the longer tail. Synnovis is a pathology laboratory that processes blood tests on behalf of several NHS organisations, primarily in south-east London²⁷, providing pathology services including blood, urine and specimen testing²⁸. The attack resulted in the cancellation of appointments and operations⁶: as a result, 10,152 acute outpatient appointments and 1,710 elective procedures were postponed at King's College Hospital NHS Foundation Trust and Guy's and St Thomas' NHS Foundation Trust²⁷. NHS England warned that the need to re-book tests and appointments would mean some disruption from the cyber incident would be felt over coming months⁶.

Urgent work continued throughout. Synnovis put additional resources in place to ensure that urgent samples received from GPs or hospitals could still be processed within appropriate timeframes⁶. The practical effect for patients was slower non-urgent blood tests and postponed routine appointments, not a loss of emergency care. If a test or appointment of yours is affected, the organisation involved should contact you; if you are unsure, NHS 111 can point you to the right place²¹.

For households, three preparations follow from this. Keep your paper list of medicines and conditions, because a postponed test is easier to re-book if you can state what was ordered. Do not treat a postponed routine appointment as a reason to go to A&E, which is for life-threatening illnesses and injuries only⁸. And if you rely on regular blood monitoring for a medicine you take, ask your GP practice in advance what the plan would be if pathology services were disrupted, so you are not working it out during an incident. More on the wider effects is in NHS Appointments, A&E and Tests During an IT Outage.

Scam calls and messages after an NHS cyber attack

After any cyber incident that involves data, expect criminals to exploit it. The official advice from the Synnovis incident is to verify unexpected or suspicious emails claiming to come from the NHS by contacting the organisation directly, and not to use an address or phone number from the message itself, but the details from the official organisation's website²⁸. This applies equally to phone calls and texts: if someone contacts you claiming your prescription is ready, your records were compromised, or you must pay a fee to restore access, look up the organisation's number yourself and call back.

Ransomware, which locks users out of their files or device in exchange for money to restore access, has previously affected some NHS organisations¹⁹, and the National Risk Register records the Synnovis attack among recent incidents²⁷. No NHS body will ask you to pay to unlock your own records or to release a prescription. If you have given details or money to a scammer, see Lost Money to a Scam and Gave Your Bank Details to a Scammer; for spotting the messages themselves, see Phishing and How to Spot Scam Messages After a Data Breach.

If a communications outage accompanies the cyber incident, the government's preparedness advice is to keep a small amount of cash for essential purchases if mobile payment apps are disrupted¹⁷. People with additional communication needs should continue to use established accessibility services such as Relay UK, Emergency SMS and 999 BSL to contact the emergency services, but during a widespread communications outage these services may also be affected, in which case seek help directly from emergency responders or go to your nearest police station, fire station, ambulance station or hospital¹⁷.

How NHS systems have been made harder to attack

The NHS's own reviews record what changed after WannaCry, and it is worth knowing because it shapes how future outages are likely to run. Before the attack, the NHS operated what a parliamentary committee described as a "vast estate of legacy infrastructure", including IT systems that were out of support or had reached the end of their lifecycle²⁰. In December 2015, 15 to 18% of NHS systems were on Windows XP; by the time of the lessons learned review this was down to 4.7%¹⁸, and the number of unsupported devices decreased from 18% to 1.8% by January 2018¹⁸. A plan was put in place to remove or isolate unsupported software in the NHS, including XP by April 2018 and Windows 7 by January 2020¹⁸.

Two technical findings explain why the attack spread as it did. Whether organisations had patched their systems or not, taking action to manage their firewalls facing the internet would have guarded organisations against infection⁵. And over half of local NHS organisations reported they had not patched systems when required, due to concerns about the impact of necessary downtime on clinical services¹⁸, a reminder that updates carry a cost even when the risk of skipping them is larger. NHS Digital had alerted the service to the WannaCry vulnerability before the attack via its CareCERT service; had this advice been acted on in a timely manner, the scale and impact of the attack could have been much reduced¹⁸.

Protection since then has been built up. Real-time protection now covers over 2 million computers across the NHS network, monitored 24 hours a day, 7 days a week²⁸. The NHS Cyber Improvement Programme, continued since June 2024, supports the NHS to respond to changing cyber threats, expand protection and reduce the risk of a successful attack²⁸. NHS Digital provides advice and support to health organisations during a cyber incident through CareCERT React, and its Data Security helpline is available 24/7, with a full service from 9:00 to 17:00 and a national service desk handling out-of-hours calls¹⁸. On 12 May 2017, CareCERT alerted the Department of Health just after 13:00, following reports from four NHS trusts¹⁸, which is why national response now begins within hours. For how the NHS, government and regulators respond to a major incident more widely, see How the NHS, Government and Regulators Respond to a Major Incident.

Scotland: NHS 24 and the 111 service

Arrangements differ in Scotland, and the differences matter if you are trying to get medicine there. When your local GP and local pharmacy are closed and you are too ill to wait, phone 111 to reach NHS 24²⁹. If you are advised you will get a callback, you will receive it from your local health board, not NHS 24, and you should only phone NHS 24 again if your symptoms worsen while waiting³⁰. The 111 service cannot arrange appointments at your GP, so during normal working hours always contact your own GP for urgent advice and treatment³⁰.

Community pharmacists in Scotland can help with coughs and colds, sore throat, indigestion, diarrhoea or constipation, aches and pains, and can help if you run out of a repeat prescription²⁹. NHS inform has self-help guides for a range of conditions²⁹, and its guidance for public holidays confirms the same core advice as in England: if you run out of your regular medicine and your GP practice is closed, there are ways to get an emergency supply¹³. NHS organisations have been targeted by cyber attacks, and the parliamentary committee's report records the WannaCry attack of May 2017, in which at least 80 out of 236 trusts in England were affected²⁰.