HCRG Care Group

HCRG Care Group is a private provider of community healthcare and social-care services in England. Its work is commissioned primarily by the National Health Service, integrated care bodies, clinical commissioning organisations, councils and other public-sector partners. The group operates services that sit between primary care, hospitals, public health and social care, including community nursing, urgent and intermediate care, children’s health services, school nursing, immunisation, community hospitals, outpatient activity, wheelchair services, community dentistry and related support for families and people with long-term conditions. The organisation originated around 2007 as Assura Medical, a division of the property and healthcare company Assura Group. Its early model involved GP provider companies jointly owned by local GP practices and Virgin. Virgin Group acquired a majority stake in the business in 2010, and the operation subsequently became known as Virgin Care. By 2012 it had become a separate company under the Virgin Care identity. During the joint-ownership period, provider companies were generally divided between participating GPs and Virgin, with local GPs represented on governance boards. Hundreds of surgeries were associated with the model during the early 2010s. In October 2012, Virgin Care announced that it would take over the jointly owned GP-provider companies. The stated rationale was to reduce potential conflicts of interest when the organisation bid for contracts issued by clinical commissioning groups and other public bodies. The change enabled Virgin Care to compete for larger, integrated contracts commissioned by NHS organisations and local authorities. Its expansion included community-health and social-care contracts in Surrey, Bath and North East Somerset, Lancashire, Kent, Wiltshire, East Staffordshire and other English areas. The company’s growth brought both long-term contracts and public controversy. It became a prominent example in debates about the private delivery of publicly funded healthcare, particularly when it won contracts previously delivered by NHS trusts or local-authority services. Some contracts were associated with operational difficulties, service-rating concerns, disputes over procurement and disagreements about the suitability of commercial providers for public services. A procurement challenge relating to children’s services in Surrey resulted in an out-of-court settlement, while a separate legal challenge temporarily set aside Lancashire’s original procurement decision before the council reassessed the bids and again selected Virgin Care. Virgin Care was acquired in December 2021 by Twenty20 Capital, a privately owned investment firm focused on workforce-management and recruitment-related businesses. The company was immediately rebranded HCRG Care Group. The new name marked a change in ownership and corporate identity while retaining many of the organisation’s existing public-service contracts and operational activities. Following the rebrand, HCRG continued to operate community and public-health services under contracts with NHS bodies and councils. Its portfolio has included children’s public-health services in places such as Wiltshire, Lancashire, Surrey and Slough; community services in Bath and North East Somerset; services in parts of Kent; and other local programmes. Contracts have been renewed, extended, reorganised or transferred between providers over time, reflecting the changing commissioning structures created by integrated care systems and local-government procurement. HCRG Care Group has also faced significant scrutiny over information security. In February 2025, the Medusa ransomware group claimed to have attacked the organisation and taken a large quantity of data, including information alleged to involve medical records and personal identities. The organisation later sought a High Court injunction concerning publication of alleged breach material by a…

HCRG Care Group developed from Assura Medical, established around 2007 as the medical-services division of Assura Group. The original organisation worked through GP provider companies and was designed to support the delivery of primary and community services. In its early structure, participating surgeries and Virgin held joint interests in provider entities, while local GPs and Virgin representatives shared governance responsibilities. Virgin Group acquired a majority interest in 2010. By 2012, the business was operating separately under the Virgin Care name. The organisation’s early network included several hundred participating surgeries. In October 2012, Virgin Care announced that it would acquire the remaining jointly owned GP-provider companies. The change was intended to address possible conflicts of interest as the company began bidding for contracts from clinical commissioning groups, NHS England and local authorities. The resulting strategy focused on large, multi-service public contracts. Virgin Care expanded from GP-related activity into community nursing, urgent-care provision, children’s services, public health, social work, community hospitals, outpatient services and care for people with long-term conditions. Its contracts included substantial programmes in Surrey, Bath and North East Somerset, Lancashire, Kent, Wiltshire and East Staffordshire. The group’s expansion coincided with intense political debate about the use of private companies to deliver NHS-funded services. Supporters described integrated contracts as a way to coordinate care and introduce new management models. Critics argued that outsourcing could weaken NHS capacity, create accountability problems and transfer public funds to commercial organisations. Several of Virgin Care’s contracts became the subject of scrutiny, legal proceedings or regulatory examination. In Devon, a parent challenged the award of health and social-care contracts to Virgin Care in the High Court in 2012, but the company retained the contract. In Surrey, Virgin Care brought proceedings after losing a children’s community-services procurement. The case was settled out of court, with a payment to Virgin Care, generating public and parliamentary criticism. Virgin Care said the settlement would be invested in services rather than distributed to Virgin Group or Richard Branson. Lancashire provided another important procurement episode. The county initially selected Virgin Care for a five-year children’s public-health contract. Incumbent NHS trusts successfully challenged the process, and the High Court found that the procurement decision should be set aside. After a reassessment overseen by an independent expert panel, the council selected Virgin Care again in 2018. The contract later continued under HCRG Care Group and was renewed in 2025. Operational performance varied by location and service. The Bath and North East Somerset contract experienced substantial information-technology problems during its initial months, including cancelled appointments, delayed correspondence and difficulties updating patient records. The Lyme Regis service was rated unsafe in some respects by the Care Quality Commission in 2015, although later inspections recorded improvements. The East Staffordshire prime-provider arrangement ended after a prolonged dispute, with Virgin Care withdrawing from the prime-provider role in 2018 and terminating the remaining part of the contract in 2019. Other services received positive regulatory assessments or continued through renewals and extensions. Virgin Care was acquired by Twenty20 Capital in December 2021 for an undisclosed amount and was immediately renamed HCRG Care Group. The ownership change ended the Virgin-branded phase but did not end the company’s role as a contractor to NHS bodies and councils. Under HCRG, the organisation continued delivering children’s public-health programmes, community-health services and related local-authority and NHS work. Contracts in Surrey, Bath and North East Somerset, Lancashire, Kent, Slough and Wiltshire were renewed, expanded, reorganised or continued in different forms. In 2025, HCRG became the target of an alleged Medusa ransomware attack. The attackers claimed to have encrypted and extracted a large volume of data, including sensitive medical and personal information. HCRG pursued a UK injunction relating to publication of alleged breach examples by a US-based reporting site. The dispute raised questions about jurisdiction, transparency and the handling of cyber incidents involving patient data. HCRG later notified patients that their personal information had been breached. The incident added information governance and cyber resilience to the organisation’s existing areas of public scrutiny.

1. 2025Ransomware incident reported

   The Medusa ransomware group claimed an attack involving alleged theft and encryption of HCRG data.

   Source
2. 2021Acquisition by Twenty20 Capital and rebrand

   Twenty20 Capital acquired the business, which immediately adopted the HCRG Care Group name.

   Source
3. 2016Major Bath and North East Somerset contract awarded

   Virgin Care won a large integrated health and social-care contract covering services including community hospitals, outpatient care and adult social work.

   Source
4. 2012Separate Virgin Care business formed

   The organisation operated as a separate company under the Virgin Care brand and moved toward full ownership of jointly held GP-provider companies.

   Source
5. 2010Virgin Group acquired a majority stake

   Virgin Group became the majority owner of the developing healthcare business.

   Source
6. 2007Assura Medical established

   The business originated as Assura Medical, a medical-services division of Assura Group.

   Source

A private, public-sector-facing provider positioned around integrated community healthcare, children’s public health and social-care delivery under NHS and local-authority contracts.

• Community health servicesHealthcare services

  Locally commissioned services delivered outside acute hospitals, including community nursing, outpatient care, intermediate care, urgent care, community hospitals and support for people with long-term conditions. These services are typically organised around a defined geographic population and delivered under NHS or integrated-care contracts.

• Children’s public-health servicesPublic health

  Services for children, young people and families, including health visiting, school nursing, immunisation, parenting support and wider public-health programmes. HCRG has delivered such services under contracts with councils and NHS commissioning bodies in several English regions.

• Community hospitals and outpatient careHospital and outpatient services

  Community-based hospital and outpatient provision intended to complement acute hospitals and primary care. The portfolio has included clinics, local hospital facilities and services supporting recovery, assessment and ongoing treatment.

• Community dentistry and wheelchair servicesSpecialist community services

  Specialist local services commissioned for defined populations, including community dental provision and wheelchair or equipment services. These programmes form part of the organisation’s broader community-care contracting model.

• 2025Response to alleged ransomware incidentStrategy

  A ransomware group claimed to have encrypted and extracted data from HCRG systems and threatened disclosure.

  What changed. HCRG pursued a High Court injunction relating to publication of alleged stolen-data examples and later notified patients that personal information had been breached.

  Aftermath. The dispute drew attention to health-data security, the limits of UK orders against overseas publishers and the timing of patient communication.

  Source
• 2021Sale to Twenty20 CapitalM&A

  Virgin Care had developed into a major private provider of publicly commissioned community and social-care services.

  What changed. Twenty20 Capital acquired the company for an undisclosed amount.

  Aftermath. The business was immediately rebranded HCRG Care Group and continued operating public-sector health and social-care contracts.

  Source
• 2012Consolidation of jointly owned GP-provider companiesStrategy

  Virgin Care was expanding its participation in NHS and local-authority procurement, creating potential concerns about conflicts of interest within jointly owned provider companies.

  What changed. The company announced that it would take over the jointly owned GP-provider companies and operate them under a more centralised structure.

  Aftermath. The change supported Virgin Care’s subsequent bids for larger contracts from clinical commissioning groups, NHS England and local authorities.

  Source

• 2025Medusa ransomware attack and data-disclosure disputeControversy

  The Medusa ransomware group claimed to have compromised HCRG systems and obtained large quantities of data, allegedly including sensitive medical, financial and identity information. HCRG subsequently sought a UK injunction concerning publication of alleged breach material by a US-based website. The matter raised concerns about cyber resilience, patient notification, jurisdiction and transparency in reporting health-data incidents.

  Source
• 2015Lyme Regis service safety concernsControversy

  A Care Quality Commission inspection of the Lyme Regis service found the minor injuries unit unsafe in important respects because systems for protecting patients were inadequate. Follow-up inspections recorded improvements, although later reviews identified areas requiring further work.

  Source

• 2025Lancashire renewed children’s public-health services contract

  Lancashire County Council awarded HCRG a further five-year contract for children’s public-health services.

  Other
  Source
• 2024Surrey awarded HCRG children’s services contract

  Surrey Heartlands and Surrey County Council awarded HCRG a contract for children’s services, following an earlier procurement dispute involving the same broad service area.

  Other
  Source
• 2021HCRG Care Group acquired and rebranded under Twenty20 Capital

  Virgin Care was acquired by Twenty20 Capital in December 2021 and adopted the HCRG Care Group name.

  M&ALeadership change
  Source

1. HCRG Care Group