A major NHS Foundation Trust in the North of England — 9,800 staff, 3 acute hospital sites, 1.4 million outpatient appointments per year. The Trust delivers general, specialist, and tertiary services including trauma, oncology, and cardiac surgery. Like most Foundation Trusts of this scale, it runs Oracle E-Business Suite (EBS) as its core finance, HR, and procurement system — a deployment that has been running since 2007 and is deeply embedded in both administrative and clinical financial workflows.
The Trust's Oracle estate at the time of engagement included Oracle EBS R12.2.10 (finance, HR, procurement, and inventory modules), Oracle Database 19c (three-node RAC on AIX), Oracle WebLogic 12.2.1.4 (EBS application tier), and Oracle Forms 12c (legacy custom forms still in use in 14 clinical departments). Annual Oracle Software Support fees had reached £1.41M — a 19% increase from the previous contract year, driven by Oracle's standard price escalation.
The Trust's CIO faced a specific financial constraint: the NHS capital envelope for 2024–25 included an approved budget for an Electronic Patient Record (EPR) procurement — a multi-year transformation that would represent the most significant technology investment in the Trust's history. The £1.41M Oracle support bill was consuming a disproportionate share of the IT revenue budget, reducing the staffing and resource capacity available to support the EPR programme.
Oracle's standard annual escalation had pushed the Trust's support bill from £1.18M to £1.41M in a single renewal cycle. Oracle's UK public sector account team framed the increase as non-negotiable.
The Trust's SIRO (Senior Information Risk Owner) needed written assurance that third-party support would maintain DSPT (Data Security and Protection Toolkit) compliance requirements for software patch management.
Oracle EBS R12.2 is in Premier Support until 2034, but the Trust's Sustaining Engineering exposure on older components (Forms 12c, older WebLogic modules) created a mixed support status that Oracle was using to justify premium pricing.
14 clinical departments relied on Oracle Forms-based workflows for ward inventory, theatre scheduling integration, and pharmacy purchase orders. Any disruption to EBS availability had direct operational consequences.
NHS or healthcare organisation with Oracle support costs above £500K? The DSPT compliance consideration is addressable — we provide written security patch documentation for every Oracle CVE issued against your version. Request a healthcare-specific assessment.
Request Healthcare Oracle Assessment →GoVendorFree conducted a 48-hour assessment of the Trust's Oracle estate, establishing the full support scope, identifying the Sustaining Engineering exposures on Forms 12c, and confirming that all EBS modules in active use were within a supportable TPS framework. Critically, GoVendorFree provided the Trust's SIRO with a written Security Patch Framework — a document mapping each Oracle Critical Patch Update (CPU) category to GoVendorFree's equivalent patch coverage and detailing the process for issuing security patches against the Trust's specific Oracle versions.
The SIRO accepted the Security Patch Framework as sufficient for DSPT compliance purposes. This resolved the key internal objection and allowed the Trust's procurement team to proceed with a TPS contract under existing framework agreement terms. The transition was structured as a 5-week programme, aligned with the Trust's ICT change freeze calendar to avoid conflicting with month-end financial close or scheduled system maintenance windows.
| Oracle Product | Version | Annual Oracle Cost | Annual TPS Cost | Saving |
|---|---|---|---|---|
| Oracle EBS R12.2 (Finance/HR/Procurement/Inventory) | R12.2.10 | £620,000 | £225,000 | £395,000 (64%) |
| Oracle Database 19c (3-node RAC on AIX) | 19.17.x | £480,000 | £178,000 | £302,000 (63%) |
| Oracle WebLogic 12.2.1.4 (EBS app tier) | 12.2.1.4 | £185,000 | £72,000 | £113,000 (61%) |
| Oracle Forms 12c (14 clinical dept. workflows) | 12.2.1.4 | £125,000 | £50,000 | £75,000 (60%) |
| Total | £1,410,000 | £525,000 | £885,000 (63%) |
The transition delivered £885,000 in annual savings against the Oracle contract — supplemented by £5,000 annual saving on Oracle Support Tools licences that the Trust was able to terminate, bringing the total saving to £890,000 per year. The 3-year saving is £2.67M — sufficient to fund two Band 7 IT programme managers for the EPR programme for the full project lifecycle.
Annual saving redirected to EPR programme staffing and infrastructure
SLA breaches across all Oracle products in 18 months of TPS coverage
DSPT compliance maintained — no SIRO escalations related to Oracle patch management
Clinical departments continued Forms-based workflows without modification or disruption
"We had a straightforward business case: Oracle's 19% price increase was not justifiable for software that had been stable for three years. GoVendorFree provided the DSPT security patch documentation we needed to satisfy our SIRO, completed the transition in five weeks without touching the production environment, and delivered exactly the saving they projected. The saving is now funding two senior programme managers on our EPR. That is a tangible clinical benefit."— Chief Information Officer, NHS Foundation Trust (identity confidential)
NHS organisations considering third-party support face a specific compliance question that private sector organisations do not: the Data Security and Protection Toolkit (DSPT) requires organisations to demonstrate that software used to process patient data is maintained within vendor-supported lifecycles — or that equivalent alternative controls are in place. GoVendorFree addresses this requirement directly.
For each Oracle Critical Patch Update (CPU) issued by Oracle, GoVendorFree issues a Security Patch Assessment that identifies which CVEs are relevant to the Trust's specific Oracle versions, the severity assessment under NHS Digital's risk framework, and the mitigation applied (backported patch, configuration control, or compensating control). This documentation is formatted for DSPT Assertion evidence and is reviewed and accepted by NHS Digital as part of the Trust's DSPT submission.
The DSPT compliance route for TPS is not a loophole — it is the intended mechanism for organisations that have made a reasoned decision to defer vendor-mandated upgrades. GoVendorFree's security patch documentation has been accepted for DSPT compliance by NHS Digital and by NHS trusts audited by the CQC for information governance. It is a tested and documented compliance path.
Need DSPT compliance evidence for Oracle TPS? GoVendorFree provides written Security Patch Framework documentation for every NHS trust client. Contact us to review the evidence template before committing to a transition.
Review DSPT Compliance Approach →The transition assessment identified a secondary opportunity: the Trust's Oracle Database licences included Partitioning, Advanced Security, and Diagnostic Pack options that had been provisioned in the original 2007 contract but were no longer in active use. Under Oracle's licensing model, these options were being renewed annually. The GoVendorFree licence optimisation review identified £145,000 in annual licence fees attributable to unused options — options that the Trust could eliminate by running an Oracle licence audit to confirm non-use and terminating the relevant support lines.
This additional saving was not included in the original TPS transition scope — it was identified as part of GoVendorFree's standard deployment audit. The total annualised saving across TPS transition and licence right-sizing reached £1.035M per year.
Tell us about your Oracle environment. We'll provide a detailed cost model and — for NHS organisations — a DSPT compliance framework within 48 hours.
Your Turn
Results like these aren't outliers — they're what happens when you stop paying vendor tax. Our free assessment shows your exact savings potential in 48 hours.
Est. 2016 · 500+ clients · 40+ countries · 15-min response