HCRG Care Group is a private provider of community health and social services in parts of the UK, commissioned by the National Health Service and by local authorities in England.
Founded in 2007 as Assura Medical, the company became majority-owned by the Virgin Group in 2010 and was known as Virgin Care. In December 2021, it was acquired by Twenty20 Capital and rebranded under its current name.
History
Logo as Virgin Care
The company originated in around 2007 as the Assura Medical division of property company Assura Group. A majority share was purchased by Virgin Group in 2010, and by 2012 it was a separate company under the Virgin Care brand.[1]
Until October 2012, each GP provider company was 50% owned by the surgery GPs and 50% by Virgin, and these companies were run by a board consisting of locally elected GPs and one Virgin representative. 358 surgeries were listed [where?] as being involved in mid-2012.
In October 2012 the company announced that it would be taking over all jointly owned GP-provider companies, in order to avoid any conflict of interest arising in respect of contracts with clinical commissioning groups.[2] Following this change, the company made bids for contracts put out by these clinical commissioning groups, NHS England and local authorities, and has contracts stretching for more than a decade with a total potential value (as of 2018[update]) of £2bn.[3]
In December 2021, the company was acquired for an undisclosed sum by Twenty20 Capital,[4] a privately-owned investor in companies that provide workforce management and recruitment services.[5] It was immediately rebranded as HCRG Care Group.[6]
Ransomware
HCRG was the target of a cyberattack in February 2025 from the Medusa ransomware group. Medusa claimed to have encrypted over 50tb of data, with over 2tb of data of it being uploaded, including sensitive medical records, financial records, and identities. The group demanded $2m ransom to not release the data.[7][8][9][10]
In March, HCRG attempted to use a UK court-ordered injunction to compel a cybersecurity breach reporting website, databreaches.net, to remove references the breach of HCRG Care Group's systems. The injunction was issued by High Court judge Michael Soole, based on the request by HCRG's attornies at Pinsent Masons. The US-based maintainer of the website refused to comply due to the injunction's inapplicable jurisdiction, and published details of the injunction online, noting the chilling effects of suppressing speech. Their domain registrar also declined to comply.[8][11][12][13]
Profit
The company said in 2018 that it had never made a profit overall from its NHS services,[14] and that it had invested its own money into the business, although accounts show that individual parts of the group with NHS contracts have made profits.[15]
Over the last 50 years, I have been fortunate to build many successful companies and do not want or intend to profit personally from the NHS. Indeed, I have invested millions in Virgin Care to help it transform its services for the better and to improve both the patient and employee experience.Contrary to reports, the Virgin Care group has not made a profit to date. If and when I could take a dividend from Virgin Care (which would make us a profit over and above our overall investment), I will invest 100% of that money back into helping NHS patients young and old, with our frontline employees deciding how best to spend it.
In December 2021, the company's press release said: "Neither Virgin, nor its founder, has ever taken a penny from the business, committing instead to reinvest any returns back into the company and its frontline services."[16]
Former contracts
Lyme Regis Medical Practice
In 2012, Virgin Care won a contract to provide services in Dorset, at the Lyme Regis Centre, for five years.[17] When the service was inspected by the regulator in August 2015, the Minor Injuries unit was found 'not safe' by the Care Quality Commission because "patients were at risk of harm because systems and processes were not in place to keep them safe". Inspectors returned in February 2016 and found improvements, and again in August 2016 when a desk-based inspection based on information the company provided was deemed sufficient to rate the practice 'good' in all areas. The service was rated 'good' again by the CQC in October 2018, but inspectors said it needed to do more and rated it 'requires improvement' for services for people with long term conditions.[18] This contract ended in 2019 after a short extension, when the NHS merged it with another local GP practice.[19]
The company won a seven-year contract worth £270 million for providing long-term and elderly care for about 38,000 people with long-term health conditions in East Staffordshire in March 2015, known as the "Improving Lives" programme.[21] A report by the Care Quality Commission published in October 2019 rated the service 'good'.[22] Virgin Care terminated its role as prime provider in October 2018 after an 18-month-long dispute[23] and went on to terminate the remaining part of the contract in May 2019.[24]
Current contracts
Surrey
Virgin Care won a contract to provide community health services in Surrey from 2012 until 2017.[25] This includes the Jarvis Breast Centre in Guildford, which in October 2014 was subject to an investigation by North West Surrey Clinical Commissioning Group after 35 patients were not tested within two weeks of their GP referrals during April and July.[26] In 2017, Surrey's CCGs split the contract again and procured elements of it separately, with Virgin Care awarded some adult community services in the Surrey Heath CCG and North East Hampshire and Farnham CCG areas, as well as continuing to operate community dental services and wheelchair services.[27]
The company won a seven-year £700m prime provider contract to run health services in Bath and North East Somerset in 2016.[31][32] This included running adult social work services, something that had not been done by a commercial organisation in the UK before. Forty-three social workers were transferred to the company.[33] The service experienced significant IT issues during its first three months of operation which resulted in the cancellation of patient appointments, correspondence not being sent out and problems with updating patient records.[34]
In 2021, as a result of this contract, the company's Managing Director was noted to have been given a seat on the BSW Partnership Board.[35]
In that year, the services provided were reported to include two community hospitals, outpatients' clinics, and school nursing and immunisation services.[36] The organisation's contract was extended to 2027, taking it to the full 10-year term, at a slightly reduced £54.5m as a result of two services being brought back in-house. Councillor Rob Appleyard told a scrutiny panel meeting that awarding the contract was "not universally accepted" and there was "continual distrust", but "Covid was the making of the relationship with Virgin Care".[37]
West Lancashire
In 2016, the company won a five-year contract from West Lancashire CCG to provide adult community health services and urgent care services across the area. Commissioners said that the contract would lead to more "joined up" care.[38] In May 2021, the service was rated good by the CQC in its first inspection.[39]
Kent
Community services in part of Kent, previously provided by Kent Community Health NHS Foundation Trust, were transferred to Virgin Care by Swale CCG and Dartford, Gravesham and Swanley CCG in January 2016 in a contract worth £18 million a year for the seven years from April 2016, with an option to extend by a further three years.[40]
Legal cases
In October 2012, a mother of two children mounted a challenge in the High Court against Devon County Council's decision to award health and social care contracts to Virgin Care.[41] The court allowed Virgin Care to keep the contract.[42]
In early 2017, Virgin Care began legal proceedings against NHS England, Surrey County Council and the county's six clinical commissioning groups, claiming there were defects in the procurement process which led to another provider winning an £82 million three-year children's community services contract.[43] The lawsuit was settled out of court with a £328,000 payment to Virgin Care, resulting in some controversy. This included a petition signed by over 100,000 people addressed to Richard Branson and Virgin Care, demanding that they "return the NHS’s money, and never sue the NHS again", as well as criticism in Parliament from Shadow Health Secretary Jonathon Ashworth, who claimed that the NHS is already "underfunded" without having to make payments to private health companies.[44] Virgin Care stated that the money would be invested in services, rather than paid out to Virgin Group or Richard Branson.[45]
Lancashire County Council (LCC) planned to award Virgin Care a five-year £104m contract in 2017 to provide public health services for children aged 0 to 19. Two Lancashire-area NHS Trusts,[a] who were the incumbent service providers, had jointly bid for the contract. They contested the decision to award a contract to Virgin Care on the grounds that the Council had not properly followed the procurement process. The High Court upheld the Trusts' concern and concluded that the procurement decision should be set aside.[46] In 2018, after LCC had re-evaluated the bids, in a process overseen by an independent panel of experts, it again chose Virgin Care. The decision was criticised by UNISON on the grounds that it would destabilise the NHS in Lancashire, that the gap between the two bids was only 0.07%, and that the council was helping to privatise the delivery of key NHS services.[47]
↑ Jessica Lyons (13 March 2025). "Medusa ransomware infects 300+, uses 'triple extortion'". theregister.com. Retrieved 31 March 2025. When DataBreaches.net reported those details, it said it was hit with a London High Court injunction brought by HCRG, which the website ultimately ignored because the dot-net's US-based operators are outside the jurisdiction of the High Court of England and Wales. The lawyers said the injunction compels publishers to not assist in the dissemination, direct or otherwise, of "some or all of the confidential information stolen during the cyber-attack," and demanded two articles about the Medusa infection be taken down. DataBreaches.net had in those two stories linked to a separate blog that had obtained and published redacted samples of the stolen healthcare data.
↑ "Partnership Board Agenda"(PDF). Bath and North East Somerset, Swindon and Wiltshire Partnership. 28 May 2021. p.2. Archived from the original(PDF) on 2 June 2021 – via Internet Archive.
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
