Ransomware Reporting Consultation: What Practice Managers Need to Know

As ransomware continues to threaten organisations worldwide, the UK government has proposed new rules on ransomware incident response

CREDIT: This is an edited version of an article that originally appeared in SME Today

These proposals are part of wider reforms to UK cybersecurity, due to take shape in 2025. For practice managers, understanding these changes is critical and practice leaders will play a central role in ensuring compliance and safeguarding both operations and community trust.

What is Ransomware?

Ransomware is a type of malicious software (malware) that cybercriminals use to block access to a computer system or data until a ransom is paid. For GP surgeries, ransomware can be especially disruptive. It can lock staff out of essential systems such as patient records, safeguarding files, financial data and even everyday tools like email or invoicing platforms. The core aim of ransomware is simple: to extort money. But the impact goes far beyond financial cost. For GP surgeries, it can mean weeks of disruption and significant stress.

What is the Government’s Ransomware Reporting Consultation?

The government’s consultation sets out new approaches to ransomware incident response, with the aim of reducing payments to criminals, improving law enforcement’s ability to disrupt attacks and enhancing understanding of ransomware threats.

The consultation outlines three key proposals:

Targeted ban on ransomware payments for the public sector and operators of critical national infrastructure (CNI). This would mean that GP surgeries, as part of the public sector, would be prohibited from making ransomware payments.

Payment prevention scheme where any organisation intending to pay a ransom must first notify the government. This would give authorities time to assess the situation and decide whether intervention is required.

Mandatory reporting regime where all ransomware incidents must be reported to the government within 72 hours, followed by a detailed report within 28 days, regardless of whether the organisation pays or not.

What This Means for GP surgeries

For practices, these proposals have significant implications. Many already face stretched IT resources, and ransomware has become a growing problem in the healthcare sector, where attackers know that personal, financial and safeguarding data are highly valuable. Under the new regime, GP surgeries will not be allowed to make ransom payments and will be legally required to report any ransomware incident.

How GP surgeries Should Prepare

Practice managers can take the lead by embedding cyberresilience into practice operations. Practical steps include:

• Clear reporting lines: Establish communication channels with local authorities and the National Cyber Security Centre (NCSC) so ransomware incidents can be reported promptly.
• Designated responsibility: Assign clear roles within the practice’s leadership or IT team for managing incident reporting and ensuring accurate records are kept.
• Backups and recovery: Ensure the practice has air-gapped, immutable backups of critical data. The ability to restore systems without paying a ransom is the single biggest defence against extortion.

The proposals, if implemented, mean GP surgeries cannot rely on ransom payments as a way out of an attack. Instead, they must have confidence in their ability to recover independently. Practice managers, with their oversight of finance, compliance and risk, are well placed to drive this preparedness agenda. The government’s ransomware proposals may still evolve, but the message is clear: practices must prepare for a future where incident reporting is mandatory, and ransom payments are not an option. For practice managers, this is an opportunity to lead, ensuring GP surgeries are resilient, compliant and confident in the face of one of the most pressing cyber threats today.