What does the GP IT operating model say about your practice website?
By Sreeni, Editor · Last reviewed 20 October 2026 · 6 minute read
What the operating model is
The primary care (GP) digital services operating model is NHS England’s rulebook for IT in general practice: what the NHS provides, what ICBs provide, and what practices do themselves. Version 6.02 was last updated on 25 September 2026. Most of it is about clinical systems and infrastructure, but it has a section on practice and PCN websites.
Who’s responsible for the website
Your practice. The operating model lists websites as a practice business system, alongside telephony: “practice determines and procures”. Your ICB doesn’t buy or run the website, but it does support you and ask about it in its yearly review.
What your website needs
| Requirement | What it means |
|---|---|
| An up-to-date, accessible and secure website, and an NHS website profile | The GP contract requirement the operating model builds on. |
| Accessibility to WCAG 2.2 AA | Described as a legal requirement, for the practice as a public authority. |
| Links to every core NHS App feature available on the NHS website | Online consultation, prescriptions, record access, appointment management, GP registration and patient messaging. |
| A prominent link to download the NHS App on the homepage | Not just on an inside page. |
| Links to online services that don't need a login | For example, your online consultation tool. |
| HTTPS on the website and every link embedded in it | Including links to third-party services. |
| No tools like the Meta Pixel | Where the site handles patient-identifiable information, nothing that passes visitors' details to third parties without their knowledge or consent. |
| A responsive maintenance service | To fix problems and make changes the contract needs in good time. |
It also repeats two GP contract rules: key practice information should be available as standardised data other platforms can use, and you mustn’t advertise private services on the website you use for NHS services.
What it recommends
- Research with real people. Design the site with a representative range of patients and staff, using qualified user researchers.
- Look at how the site is used. Use analytics that someone at the practice actually reviews. If you do, read our guide to cookies and analytics first.
- Ask suppliers for the DTAC. Where a website handles patient-identifiable information, NHS England recommends asking suppliers to complete the Digital Technology Assessment Criteria. It applies to each product, not to the supplier as a company.
- Follow NHS England’s website guidance: creating a highly usable and accessible GP website and the step-by-step guide to improving online journeys.
What your ICB will ask each year
ICBs review practices through the digital primary care maturity assurance (DPCMA) indicators. One indicator asks which of these is true of your website:
- Links on your pages, including to third-party suppliers, are as secure as your own site.
- Your website has been tested with NHS England's benchmarking tool in the last 12 months, by you, your ICB or your supplier.
- Patients can start key tasks from links on the homepage and the menu at the top of the page.
- Your supplier's template meets WCAG AA, the supplier has given you proof, and the site has an accessibility statement.
- The template uses NHS design components, the NHS look and feel.
- You're on the latest version of your supplier's template.
- Key pages use NHS written content templates, for a reading age of 9 to 11.
- Your NHS.uk profile and opening times are up to date.
The second one is the easiest to act on: run your site through NHS England’s benchmarking tool, or ask us to do it for you with the free check below.
Web Check has closed
The operating model says ICBs will help practices get an NCSC Web Check for their website. But the National Cyber Security Centre retired Web Check on 31 March 2026, and the operating model hasn’t caught up yet. Our guide to checking your website’s security now covers what to do instead.
Questions
Is the GP IT operating model a legal requirement?
It's NHS England's framework for GP IT, built into the agreement between your practice and your ICB. Some of what it says about websites, such as accessibility, comes from the law and the GP contract.
Does our website need to meet WCAG 2.1 or 2.2?
WCAG 2.2 at level AA. The operating model and GOV.UK's accessibility monitoring both use WCAG 2.2. Some older NHS guidance still mentions 2.1.
Does the operating model let us use analytics?
Yes. It recommends analytics that staff review. It also says tools like the Meta Pixel, which pass visitors' details to third parties without consent, shouldn't be on the site.
Correct as of October 2026. This guide reflects version 6.02 of the GP IT operating model, last updated by NHS England on 25 September 2026. Check the latest version (linked above) before acting on it.
This guide is general information, not legal or contractual advice.