HCRG Care Group

HCRG Care Group is a private provider of community healthcare and social-care services in England. Its work is commissioned primarily by the National Health Service, integrated care bodies, clinical commissioning organisations, councils and other public-sector partners. The group operates services that sit between primary care, hospitals, public health and social care, including community nursing, urgent and intermediate care, children’s health services, school nursing, immunisation, community hospitals, outpatient activity, wheelchair services, community dentistry and related support for families and people with long-term conditions. The organisation originated around 2007 as Assura Medical, a division of the property and healthcare company Assura Group. Its early model involved GP provider companies jointly owned by local GP practices and Virgin. Virgin Group acquired a majority stake in the business in 2010, and the operation subsequently became known as Virgin Care. By 2012 it had become a separate company under the Virgin Care identity. During the joint-ownership period, provider companies were generally divided between participating GPs and Virgin, with local GPs represented on governance boards. Hundreds of surgeries were associated with the model during the early 2010s. In October 2012, Virgin Care announced that it would take over the jointly owned GP-provider companies. The stated rationale was to reduce potential conflicts of interest when the organisation bid for contracts issued by clinical commissioning groups and other public bodies. The change enabled Virgin Care to compete for larger, integrated contracts commissioned by NHS organisations and local authorities. Its expansion included community-health and social-care contracts in Surrey, Bath and North East Somerset, Lancashire, Kent, Wiltshire, East Staffordshire and other English areas. The company’s growth brought both long-term contracts and public controversy. It became a prominent example in debates about the private delivery of publicly funded healthcare, particularly when it won contracts previously delivered by NHS trusts or local-authority services. Some contracts were associated with operational difficulties, service-rating concerns, disputes over procurement and disagreements about the suitability of commercial providers for public services. A procurement challenge relating to children’s services in Surrey resulted in an out-of-court settlement, while a separate legal challenge temporarily set aside Lancashire’s original procurement decision before the council reassessed the bids and again selected Virgin Care. Virgin Care was acquired in December 2021 by Twenty20 Capital, a privately owned investment firm focused on workforce-management and recruitment-related businesses. The company was immediately rebranded HCRG Care Group. The new name marked a change in ownership and corporate identity while retaining many of the organisation’s existing public-service contracts and operational activities. Following the rebrand, HCRG continued to operate community and public-health services under contracts with NHS bodies and councils. Its portfolio has included children’s public-health services in places such as Wiltshire, Lancashire, Surrey and Slough; community services in Bath and North East Somerset; services in parts of Kent; and other local programmes. Contracts have been renewed, extended, reorganised or transferred between providers over time, reflecting the changing commissioning structures created by integrated care systems and local-government procurement. HCRG Care Group has also faced significant scrutiny over information security. In February 2025, the Medusa ransomware group claimed to have attacked the organisation and taken a large quantity of data, including information alleged to involve medical records and personal identities. The organisation later sought a High Court injunction concerning publication of alleged breach material by a specialist data-breach reporting website. The episode became a prominent test of the relationship between cyber-incident confidentiality, patient notification and public reporting. HCRG subsequently notified patients that their personal information had been compromised. The incident forms part of the continuing operational and regulatory risks associated with managing sensitive health and social-care data at scale.

HCRG Care Group developed from Assura Medical, established around 2007 as the medical-services division of Assura Group. The original organisation worked through GP provider companies and was designed to support the delivery of primary and community services. In its early structure, participating surgeries and Virgin held joint interests in provider entities, while local GPs and Virgin representatives shared governance responsibilities. Virgin Group acquired a majority interest in 2010. By 2012, the business was operating separately under the Virgin Care name. The organisation’s early network included several hundred participating surgeries. In October 2012, Virgin Care announced that it would acquire the remaining jointly owned GP-provider companies. The change was intended to address possible conflicts of interest as the company began bidding for contracts from clinical commissioning groups, NHS England and local authorities. The resulting strategy focused on large, multi-service public contracts. Virgin Care expanded from GP-related activity into community nursing, urgent-care provision, children’s services, public health, social work, community hospitals, outpatient services and care for people with long-term conditions. Its contracts included substantial programmes in Surrey, Bath and North East Somerset, Lancashire, Kent, Wiltshire and East Staffordshire. The group’s expansion coincided with intense political debate about the use of private companies to deliver NHS-funded services. Supporters described integrated contracts as a way to coordinate care and introduce new management models. Critics argued that outsourcing could weaken NHS capacity, create accountability problems and transfer public funds to commercial organisations. Several of Virgin Care’s contracts became the subject of scrutiny, legal proceedings or regulatory examination. In Devon, a parent challenged the award of health and social-care contracts to Virgin Care in the High Court in 2012, but the company retained the contract. In Surrey, Virgin Care brought proceedings after losing a children’s community-services procurement. The case was settled out of court, with a payment to Virgin Care, generating public and parliamentary criticism. Virgin Care said the settlement would be invested in services rather than distributed to Virgin Group or Richard Branson. Lancashire provided another important procurement episode. The county initially selected Virgin Care for a five-year children’s public-health contract. Incumbent NHS trusts successfully challenged the process, and the High Court found that the procurement decision should be set aside. After a reassessment overseen by an independent expert panel, the council selected Virgin Care again in 2018. The contract later continued under HCRG Care Group and was renewed in 2025. Operational performance varied by location and service. The Bath and North East Somerset contract experienced substantial information-technology problems during its initial months, including cancelled appointments, delayed correspondence and difficulties updating patient records. The Lyme Regis service was rated unsafe in some respects by the Care Quality Commission in 2015, although later inspections recorded improvements. The East Staffordshire prime-provider arrangement ended after a prolonged dispute, with Virgin Care withdrawing from the prime-provider role in 2018 and terminating the remaining part of the contract in 2019. Other services received positive regulatory assessments or continued through renewals and extensions. Virgin Care was acquired by Twenty20 Capital in December 2021 for an undisclosed amount and was immediately renamed HCRG Care Group. The ownership change ended the Virgin-branded phase but did not end the company’s role as a contractor to NHS bodies and councils. Under HCRG, the organisation continued delivering children’s public-health programmes, community-health services and related local-authority and NHS work. Contracts in Surrey, Bath and North East Somerset, Lancashire, Kent, Slough and Wiltshire were renewed, expanded, reorganised or continued in different forms. In 2025, HCRG became the target of an alleged Medusa ransomware attack. The attackers claimed to have encrypted and extracted a large volume of data, including sensitive medical and personal information. HCRG pursued a UK injunction relating to publication of alleged breach examples by a US-based reporting site. The dispute raised questions about jurisdiction, transparency and the handling of cyber incidents involving patient data. HCRG later notified patients that their personal information had been breached. The incident added information governance and cyber resilience to the organisation’s existing areas of public scrutiny.

• 2025

  Ransomware incident reported

  [1]HCRG Care Groupen.wikipedia.org

  The Medusa ransomware group claimed an attack involving alleged theft and encryption of HCRG data.

• 2021

  Acquisition by Twenty20 Capital and rebrand

  [1]HCRG Care Groupen.wikipedia.org

  Twenty20 Capital acquired the business, which immediately adopted the HCRG Care Group name.

• 2016

  Major Bath and North East Somerset contract awarded

  [1]HCRG Care Groupen.wikipedia.org

  Virgin Care won a large integrated health and social-care contract covering services including community hospitals, outpatient care and adult social work.

• 2012

  Separate Virgin Care business formed

  [1]HCRG Care Groupen.wikipedia.org

  The organisation operated as a separate company under the Virgin Care brand and moved toward full ownership of jointly held GP-provider companies.

• 2010

  Virgin Group acquired a majority stake

  [1]HCRG Care Groupen.wikipedia.org

  Virgin Group became the majority owner of the developing healthcare business.

• 2007

  Assura Medical established

  [1]HCRG Care Groupen.wikipedia.org

  The business originated as Assura Medical, a medical-services division of Assura Group.

A private, public-sector-facing provider positioned around integrated community healthcare, children’s public health and social-care delivery under NHS and local-authority contracts.

• Healthcare services

  Community health services

  Locally commissioned services delivered outside acute hospitals, including community nursing, outpatient care, intermediate care, urgent care, community hospitals and support for people with long-term conditions. These services are typically organised around a defined geographic population and delivered under NHS or integrated-care contracts.

• Public health

  Children’s public-health services

  Services for children, young people and families, including health visiting, school nursing, immunisation, parenting support and wider public-health programmes. HCRG has delivered such services under contracts with councils and NHS commissioning bodies in several English regions.

• Hospital and outpatient services

  Community hospitals and outpatient care

  Community-based hospital and outpatient provision intended to complement acute hospitals and primary care. The portfolio has included clinics, local hospital facilities and services supporting recovery, assessment and ongoing treatment.

• Specialist community services

  Community dentistry and wheelchair services

  Specialist local services commissioned for defined populations, including community dental provision and wheelchair or equipment services. These programmes form part of the organisation’s broader community-care contracting model.

• 2025

  Medusa ransomware attack and data-disclosure dispute

  The Medusa ransomware group claimed to have compromised HCRG systems and obtained large quantities of data, allegedly including sensitive medical, financial and identity information. HCRG subsequently sought a UK injunction concerning publication of alleged breach material by a US-based website. The matter raised concerns about cyber resilience, patient notification, jurisdiction and transparency in reporting health-data incidents.

  Source

• 2015

  Lyme Regis service safety concerns

  A Care Quality Commission inspection of the Lyme Regis service found the minor injuries unit unsafe in important respects because systems for protecting patients were inadequate. Follow-up inspections recorded improvements, although later reviews identified areas requiring further work.

  Source

Read more

• 2025

  Response to alleged ransomware incidentStrategy

  Background

  A ransomware group claimed to have encrypted and extracted data from HCRG systems and threatened disclosure.

  Action taken

  HCRG pursued a High Court injunction relating to publication of alleged stolen-data examples and later notified patients that personal information had been breached.

  Aftermath

  The dispute drew attention to health-data security, the limits of UK orders against overseas publishers and the timing of patient communication.

  Source

• 2021

  Sale to Twenty20 CapitalM&A

  Background

  Virgin Care had developed into a major private provider of publicly commissioned community and social-care services.

  Action taken

  Twenty20 Capital acquired the company for an undisclosed amount.

  Aftermath

  The business was immediately rebranded HCRG Care Group and continued operating public-sector health and social-care contracts.

  Source

• 2012

  Consolidation of jointly owned GP-provider companiesStrategy

  Background

  Virgin Care was expanding its participation in NHS and local-authority procurement, creating potential concerns about conflicts of interest within jointly owned provider companies.

  Action taken

  The company announced that it would take over the jointly owned GP-provider companies and operate them under a more centralised structure.

  Aftermath

  The change supported Virgin Care’s subsequent bids for larger contracts from clinical commissioning groups, NHS England and local authorities.

  Source

1. 1HCRG Care Groupen.wikipedia.org