The right patients invited at the right time, in words the superintendent's team approved. Every opt-out honoured, every clinical reply answered by a pharmacist.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
The New Medicine Service (NMS) runs on fixed windows. A patient starting a new medicine for a listed long-term condition, now including depression for adults, agrees to the service when the first prescription is dispensed. The intervention consultation must happen 7 to 14 days later, and the follow-up 14 to 21 days after that. Only a pharmacist can hold the consultations, in person or by phone or video; text messages can only support them. In a busy branch, someone has to remember who is due, ring them, ring again, and book a slot the pharmacist can keep. When that slips, the window closes and the patient loses the support.
The Hypertension Case-Finding Service, known to patients as the NHS Blood Pressure Check Service, changed on 3 September 2026. Clinic checks are for adults aged 40 and over with no diagnosis of high blood pressure and no check through the service in the last five years, with exceptions recorded. Where a patient misses their ambulatory monitoring appointment, the pharmacy must try to rebook at least twice within seven days and tell the GP on day seven if it can't reach them. The specification lets the whole team promote the service, but finding eligible people and inviting them fairly is manual today.
Messaging patients sounds simple, and it is easy to get wrong. A text that names a medicine or hints at a condition can reach a shared phone. An NHS invitation with a line about a private service becomes marketing. A patient who said 'stop' on one channel is called on another. And at group scale, caps matter: NMS payments are capped at 0.9% of a branch's monthly items from June 2026, so inviting beyond capacity creates work nobody is paid for and appointments the pharmacist can't keep.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
Share of patients who agreed to the NMS and had both consultations inside the specified windows.
ExampleOver 80%, measured against today's baseline
Eligible checks completed, split by age band, deprivation and ethnicity where recorded, so outreach doesn't just favour the easiest to reach.
ExampleNo group worse off than today
Time from a patient's clinical question to a pharmacist's response, measured end to end.
ExampleSame working day
Any message sent to a patient who had opted out of that kind of message, on any channel.
ExampleZero, checked daily
How many patients opt out or complain after a message. Rising numbers mean the timing, frequency or wording needs review.
ExampleStable, and reviewed weekly
Booked consultations against each branch's NMS cap and pharmacist diary, so invitations don't create unpaid or unkeepable appointments.
ExampleWithin cap in every branch
Cross-sector rules are on the UK regulation map.
Consultations are held by a pharmacist, in person, by phone or by video. Text can only supplement them, so messages book and remind; they never ask clinical questions or replace the consultation. Messages are timed to the 7–14 and 14–21 day windows, and the design records the reason when a window is missed in exceptional circumstances.
Eligibility rules come from the specification: aged 40 and over, no hypertension diagnosis, no check through the service in the last five years, with exceptions recorded. Rules, not the model, decide eligibility. Invitations use the patient-facing name, the NHS Blood Pressure Check Service, and never suggest the patient has high blood pressure. Missed ambulatory monitoring appointments follow the rebooking and GP notification steps.
NMS caps fell to 0.9% of monthly items for activity from June 2026, and new high-level caps for the blood pressure service are still to be agreed. Caps and claim windows are configuration, not code. The messaging platform never creates or submits a claim; the service record stays the evidence.
NHS England's information governance guidance (last updated May 2026) treats invitations that are necessary for delivering a health service, such as screening and vaccination invitations, as service messages, not marketing. It is written for public authorities, and a pharmacy group is an independent contractor, so the DPO confirms the position for each message type. Either way, NHS service messages carry no promotion, and anything about private services goes through a separate, consent-based marketing flow. PECR penalties rose to UK GDPR levels from 5 February 2026.
Contacting patients about NHS services they are receiving or eligible for is direct care: public task and health care conditions (Articles 6(1)(e) and 9(2)(h)), with implied consent under the common law duty where it fits patients' reasonable expectations. The national data opt-out doesn't apply to individual care. Patients are told in the privacy notice, a wish not to receive reminders is respected, texts carry no medicine names or conditions, and a DPIA is done before the pilot.
A missed follow-up, a message to the wrong person or a clinical reply that sits unread are clinical hazards. The group needs a clinical safety officer, a hazard log and a safety case before the pilot. The standards are under review (consultation closed 11 September 2026), so expect revised versions.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Intake: events from dispensing and service systemsAgree in discovery what your PMR and service IT suppliers can send as events, and what has to be read on a schedule. | API Gateway, EventBridge | API Management, Event Grid | Kong or your existing API gateway; Apache Kafka |
| Text messagesAmazon Pinpoint reached end of support on 30 October 2026; new builds use AWS End User Messaging. Use a sender that can receive replies, because a one-way alphanumeric sender can't take a 'STOP' text. | AWS End User Messaging SMS | Azure Communication Services SMS (UK data location) | A UK SMS gateway through your API layer |
| Automated booking callsNo predictive dialling: Ofcom's persistent misuse policy covers silent and abandoned calls. Test speech recognition on UK accents and older callers. | Amazon Connect (London) with Amazon Lex and Amazon Polly | Azure Communication Services Call Automation, Azure Speech in Foundry Tools | Open-weight speech models (e.g. Whisper) with an open-source telephony platform (e.g. Asterisk) |
| NHS App and NHS NotifyNHS Notify sends to the NHS App first, then text, then letter. Work to bring it to community pharmacy systems is under way but not generally available, so design the channel as a slot to fill, not a dependency. | Through your service IT supplier, once offered | Through your service IT supplier, once offered | Through your service IT supplier, once offered |
| Contact modelPredicts the best time and channel and who may need a call from a person. It orders and routes invitations; it never removes an eligible patient from the list. | SageMaker AI | Azure Machine Learning | MLflow and Kubeflow on Kubernetes |
| Template filling and reply sortingChooses an approved template and fills its slots, and sorts replies into booking, rescheduling, opt-out or clinical. Both clouds offer a choice of models, including Claude. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| WorkflowHolds each patient's journey: window opens, invite, reminder, call, booked, or handed to the branch. | AWS Step Functions | Logic Apps or Durable Functions | Temporal, or n8n |
| GuardrailsA final check before sending: the message must match an approved template exactly apart from its slots, with no medicine names, conditions or promotions. | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Platform | Managed AWS services | Managed Azure services | Kubernetes on-prem (e.g. OpenShift, Rancher), or IONOS Managed Kubernetes |
| Identity, keys, data protectionMobile numbers are personal data in their own right. Keep them in the register, not in prompts or logs. | IAM Identity Center, KMS, Macie | Entra ID, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog every message and call: template and version, why the patient was chosen, delivery receipt, reply and who handled it. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyAzure Communication Services lets you choose a UK data location; check where calls and messages are processed for your setup. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider (IONOS AI Model Hub runs in Germany) |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
The PMR, the assured service IT and the clinical records stay where they are, with their suppliers or in the group's data centre. So does the contact-preference register if the group already runs one. The messaging platform never becomes the clinical record.
Uses cloud AI
The contact model, template filling, reply sorting and the voice service run in a UK cloud region, or on the group's own GPUs and telephony for the sovereign option. They see only what a message needs: first name, branch, due date and the patient's contact preferences.
How they connect
Through the suppliers' published APIs and an API gateway, over a private link such as AWS Direct Connect or Azure ExpressRoute from the group's network. Bookings go back into the service IT the same way, and opt-outs flow both ways.
If the link drops
No messages are sent, and nothing is sent late: an invitation whose window has passed is dropped and the patient goes on the branch's call list instead. Branch teams work from the due list in the service IT, as they do today.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Invitation agent
Where a person signs offThe superintendent pharmacist's team approves every template, every change to one, and the eligibility rules. The agent's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
Reply and call assistant
Where a person signs offA pharmacist answers every clinical reply. Replies that suggest the patient is unwell or at risk go to the pharmacist on duty straight away, with a clear safety-net message to the patient while they wait.
The PMR and the assured service IT stay the record. Dispensing a first prescription for a listed condition, a patient agreeing to the NMS, a blood pressure check or a missed monitoring appointment each becomes an event on a queue. Where a supplier can't send events, a scheduled read of the due lists does the same job.
A single contact-preference register sits between every channel and every system. Each message checks it at the moment of sending, not when the list was built, so an opt-out that arrives at 9:01 stops the 9:05 call. Every message carries an ID, so a retry never sends twice.
Bookings and outcomes go back into the service IT through its API, so the pharmacist sees them where they already work and the record supports the claim. The NHS App is added as a channel through the supplier once NHS Notify reaches community pharmacy systems; the workflow doesn't change.
Map today's NMS and blood pressure follow-up, measure window completion and opt-outs, agree what the PMR and service IT suppliers can send and receive, and confirm the PECR and lawful-basis position with the DPO.
Gate · must be true to passBaseline agreed, supplier route confirmed, clinical safety officer named, DPIA and hazard log started, templates drafted.
NMS reminders by text in 15–20 branches. The contact model runs in shadow mode, ranking patients while branch teams call as normal, and the two are compared.
Gate · must be true to passWindow completion up, zero messages against opt-outs, clinical replies answered on time, superintendent sign-off.
Text reminders live in the pilot branches, then blood pressure invitations and the monitoring rebooking steps, with monitoring and a rollback plan.
Gate · must be true to passMonitoring, support model, rollback plan, pharmacist reply rota and branch training in place.
Add branches in waves, then automated booking calls, then other recalls the specifications allow, and the NHS App once the supplier route opens.
Gate · must be true to passEach new message type and channel passes the same pilot gate.
| Activity | Superintendent pharmacist | Product owner | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | Clinical safety officer | IG & DPO | SecurityI can fill this |
|---|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Responsible | Consulted | Consulted | Informed | Consulted | Informed | Informed |
| Templates and eligibility rules | Accountable | Consulted | Consulted | Informed | Informed | Responsible | Consulted | Informed |
| Target architecture and supplier integration | Consulted | Consulted | Accountable and Responsible | Consulted | Consulted | Consulted | Consulted | Consulted |
| PECR position, DPIA and privacy notice | Consulted | Consulted | Consulted | Informed | Informed | Consulted | Accountable and Responsible | Consulted |
| Clinical safety case and hazard log | Accountable | Consulted | Consulted | Informed | Consulted | Responsible | Informed | Consulted |
| Build and integration | Informed | Consulted | Accountable | Responsible | Responsible | Consulted | Informed | Consulted |
| Go-live decision | Accountable | Responsible | Consulted | Responsible | Informed | Consulted | Consulted | Consulted |
| Run, monitor and improve | Accountable | Responsible | Consulted | Consulted | Responsible | Consulted | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the events from your PMR and service IT, the contact-preference register, the messaging and voice services, the model and the gates. I'd work closely with your clinical safety officer and DPO, and report to your programme board and superintendent pharmacist.
Option B
If your partner or your own team already has an architect, I'd take on the messaging workflow, the opt-out register and the supplier integration under their lead, and give them a second senior opinion on the model, the voice service and the clinical safety evidence.
Goes wrong
A text names the new medicine, and the patient's family reads it on a shared phone.
How the design avoids it
Templates with no medicine names or conditions, checked by guardrails before every send.
Goes wrong
An NHS reminder gains a line about the travel clinic, and becomes marketing.
How the design avoids it
Service messages and marketing in separate flows, with separate owners, and a template check that blocks promotions.
Goes wrong
A patient says 'stop' by text and gets a call the next day.
How the design avoids it
One register for every channel, checked at the moment of sending, and a daily opt-out audit.
Goes wrong
A patient replies 'I feel dizzy since starting these' and the reply sits in a queue overnight.
How the design avoids it
Clinical replies routed to the pharmacist on duty straight away, with a safety-net message telling the patient what to do if it gets worse.
Goes wrong
The model learns to invite the people most likely to say yes, and outreach drifts away from those who need it.
How the design avoids it
The model orders invitations but never drops an eligible patient, and a monthly equity review checks who was reached.
Changes already announced or under way that affect this design. More in the UK horizon scan.
Build the channel as a slot in the workflow, with the same templates and opt-outs, so adding the NHS App is a configuration change.
Keep caps and claim windows as configuration, and plan invitations against them per branch.
Keep the hazard log and safety case structured and current, so moving to the new versions is an update, not a rewrite.
Keep the reason each patient was chosen, and the human handling of every reply, in a form you could show the ICO.
Record bookings and outcomes in the service IT through national standards, so they can flow into a fuller record later.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.
