Guides
A UK patient portal typically costs between £180,000 and £600,000, driven mainly by how many clinical systems it integrates with, the depth of the clinical safety case required, and how many sites or trusts it serves. A single-practice booking and messaging portal sits at the low end; a multi-trust platform with full record access sits at the high end.
£180k–£600k
Integration with EMIS Web or SystmOne, HL7 v2 or FHIR UK Core messaging with a hospital EPR, DSPT alignment, and a DCB0129 or DCB0160 clinical safety case are the factors that separate a £180,000 build from a £500,000 one — more so than raw feature count.
What moves the number
| Cost driver | Low end | High end | Indicative impact |
|---|---|---|---|
| Integration count | One GP system (EMIS Web or SystmOne) for a single workflow, e.g. appointment booking. | Both EMIS Web and SystmOne, plus a hospital EPR via HL7 v2 or FHIR UK Core, plus a pharmacy or repeat prescription route. | Each accredited clinical integration typically adds £20,000–£60,000, driven by approval and testing cycles as much as engineering time. |
| User count | Single practice or small PCN, a few thousand registered patients. | Multi-site trust or federation-wide rollout across hundreds of thousands of patients. | Adds load-testing, scaling and support-desk requirements; £15,000–£50,000 at the high end. |
| Compliance scope | DSPT baseline compliance and a standard DPIA. | Full DCB0129/DCB0160 clinical safety case, clinical safety officer engagement, and independent IG audit. | Clinical safety case work typically adds £15,000–£40,000; IG audit and pen testing are commissioned separately, see below. |
| Data migration volume | No historical patient data migration; portal reads live from source systems. | Migrating historical appointment, message or document history from a legacy portal or paper-based process. | £10,000 for a light sync layer; £40,000+ where historical clinical records must be migrated and reconciled. |
| Design complexity | Standard forms for booking, messaging and viewing results, following NHS design system patterns. | Accessible multi-language interfaces, carer/proxy access models, and bespoke clinical workflows beyond booking and messaging. | Adds £20,000–£60,000, particularly where proxy access and accessibility conformance (WCAG 2.2 AA) are contractual requirements. |
| Ongoing support | Business-hours support with a defined SLA for non-clinical issues. | 24/7 clinical-safety-relevant incident response with defined escalation to a clinical safety officer. | Not part of build cost; typically 18–25% of build cost per year given the incident-response requirement. |
Three budget levels
£180,000–£240,000
A single-practice or small-PCN patient portal covering appointment booking and secure messaging, integrated with one GP system (EMIS Web or SystmOne) via an accredited route, DSPT-aligned security controls and a DCB0160 clinical safety case for the deploying organisation.
Timeline
16–20 weeks, including integration approval cycles
Team shape
1 tech lead, 2 full-stack engineers, 1 integration engineer, 1 designer, 1 QA engineer, 0.2 clinical safety officer (advisory)
£320,000–£420,000
A trust or federation-wide portal covering booking, messaging, repeat prescriptions and results viewing, integrated with both major GP systems and one hospital EPR via HL7 v2 or FHIR UK Core, with a full clinical safety case and independent penetration testing prior to go-live.
Timeline
24–30 weeks, with clinical safety and IG work running in parallel
Team shape
1 principal engineer, 1 tech lead, 3–4 full-stack engineers, 1–2 integration engineers, 1 designer, 1 QA engineer, 0.3 project manager, 0.3 clinical safety officer (advisory)
£500,000–£600,000+
A multi-trust platform integrating with multiple GP systems, several hospital EPRs and a pharmacy dispensing system, with proxy/carer access, multi-language accessible interfaces, historical data migration from a legacy portal, and a full DCB0129 manufacturer safety case in addition to DCB0160 at each deploying site.
Timeline
36–48 weeks for the first release, phased rollout across sites thereafter
Team shape
1 principal engineer, 1 tech lead, 5–6 full-stack engineers, 2 integration engineers, 1 data engineer, 1 designer, 2 QA engineers, 0.5 project manager, 0.5 clinical safety officer
Day rates assume £600–£800 for a principal engineer or clinical integration specialist, £450–£600 for a full-stack engineer, and a clinical safety officer engaged on an advisory day-rate basis rather than full time, blended across our UK, Germany and Pakistan delivery teams.
Not included
Where the money goes
A patient portal spends proportionally more time in discovery than a general business system, typically 15–20% of total cost, because the integration route into EMIS Web or SystmOne has to be agreed and accredited before meaningful build work can start, and because the clinical safety case needs a hazard log that is genuinely reviewed against the design, not written retrospectively to match it.
Integration approval cycles with GP system suppliers are a scheduling risk as much as a cost one: they run on the supplier's timetable, not yours, and a build that assumes approval will land inside a fixed sprint boundary is usually wrong. We build calendar slack around these approvals rather than pricing them as fixed- duration tasks, which is one reason the timelines in the worked examples below are given as ranges rather than fixed week counts.
Clinical safety work itself — the hazard log, the safety case document, and the clinical safety officer's sign-off — typically runs in parallel with the later half of the build rather than as a discrete phase afterwards, so that hazards identified during safety review can still be addressed in the design before go-live rather than requiring rework post-launch.
How we produce an estimate
These ranges are indicative, not quotes. A real estimate comes from a discovery and scoping sprint, scoped against your actual GP or EPR integration targets and your clinical safety requirements. See patient portal development, EHR integration and healthcare compliance for how we structure this work, and our custom CRM cost guide if the portal sits alongside a staff-facing CRM.
Questions
Clinical integration and clinical safety. Connecting to EMIS Web or SystmOne, handling HL7 v2 or FHIR UK Core messages correctly, and producing a DCB0129 or DCB0160 clinical safety case all require specialist knowledge and time that a general customer-facing portal does not.
DCB0129 applies if you are the manufacturer of the health IT system; DCB0160 applies to the NHS organisation deploying it. Most patient portal builds need a clinical safety case under one or both, with a clinical safety officer involved. Confirm which standard applies to your deployment model with your clinical safety adviser.
Both require accredited integration routes rather than direct database access, and both involve an approval and testing process with the supplier. Cost differences usually come from which specific data (appointments, records, messaging) you need to exchange rather than from one platform being inherently harder than the other.
DSPT (the Data Security and Protection Toolkit) is a baseline self-assessment, not a substitute for a full information governance review, a data protection impact assessment, or penetration testing of the finished system. Budget for all three separately.
Yes, for any system holding patient data connected to NHS infrastructure. This is typically commissioned from an independent CHECK-approved or CREST-accredited tester and is not included in the build cost ranges in this guide.
Sixteen to thirty-plus weeks depending on integration scope, with clinical safety case sign-off and IG approval often running in parallel with, rather than after, development.
Yes, and this is the lower end of the range. Scope that is genuinely limited to one integration and one clinical workflow (appointment booking, for example) is a meaningfully smaller build than a portal offering full record access, messaging and repeat prescriptions across multiple systems.
Tell us which GP systems and trusts are in scope and we will tell you which band you are in.
Talk to us