How we helped a world-leading NHS Trust build a digital home that reflects their reputation

Royal Brompton and Harefield Hospitals make up the UK’s largest specialist heart and lung centre, renowned for their pioneering approaches in research, technology and patient care.

When they came to us in 2017, they had two separate websites – one for NHS patients and one for private care. Both were falling short. The NHS site was dated, hard to use on smaller devices, and weighed down with years of legacy content. The private site was in better shape, but it still didn’t reflect the Trust’s standing, and the two sites felt disconnected from each other.

They needed a digital presence that reflected their world-class reputation, and that would help their experts and patients easily find the information they needed. We helped them build it, and nine years on, we’re still working with them to make sure it stays that way.

The details

Client: Royal Brompton and Harefield Hospitals

Project type: Website redevelopment

Software: Drupal, AWS Cloud Infrastructure

Services delivered:

• Discovery 
• UX/UI design
• Technical development
• Support and maintenance
• Continuous improvement

The challenges

• Serving diverse user needs
  The sites had to work for both NHS and private patients, as well as academics, healthcare professionals, and international agencies, all with varying levels of digital confidence.
• Two sites with different priorities
  We needed to create distinct NHS and private care sites that still felt connected, while balancing NHS compliance and governance with the commercial priorities of the private care team.
• Sorting and simplifying content
  The new sites had to remove duplication, tidy up legacy content, and make sure all users could find the information they needed. 
• A shifting NHS landscape
  A lot can change in the NHS over nine years. Part of our role has been helping the hospitals respond to change and supporting them through a merger with Guy’s and St Thomas’ NHS Trust.  

How we solved the challenges

The tech

Drupal to give the hospitals full control of both sites in one place

Drupal Multisite meant the hospitals could easily manage the two distinct websites from one CMS and create multi-tiered user access control for different staff roles.

ClamAV for antivirus

We integrated ClamAV antivirus to automatically scan uploaded documents, protecting the site and its diverse user base from malware.

Search that works for patients and professionals

Apache Solr and Tika allow users to effortlessly search across web pages and inside complex documents (like PDFs) to find specific specialists, conditions, or treatments.  

Moving to AWS for security and stability

In 2022, we migrated the sites to AWS, which brought stronger infrastructure, better security controls, and improved reliability. We also upgraded to PHP 8 at the same time and switched email to AWS SES, modernising the underlying stack in a single coordinated move.

The process

Discovery and testing to understand diverse user needs

Hospital websites serve a very broad range of people. Before we built anything, we ran discovery workshops, user interviews, and surveys to understand what each group needed to find and how they’d go about finding it. We then used those insights to map user journeys, define the site structure, and validate the designs through first-click and task-based user testing to make sure the sites were intuitive and easy to navigate.

Tools and features to improve user experience

Throughout our partnership, we’ve worked with the hospitals to identify and implement features that make it simple for their teams to publish and manage content, and improve the experience for the patients and professionals using the sites. These have included:

• News items that auto-publish and hide date stamps, so infrequent updates don’t make the site feel dated
• A custom module that automatically centres image focal points, so content always looks polished regardless of who uploads it
• Multi-tiered user access, so content can be managed across teams rather than relying on one central team
• A content syndication API to share content across platforms, including News API extended with Vimeo support and additional fields
• Booking forms, event registration and payment integration 
• A ‘find an expert’ feature to help journalists and media teams connect with the right specialists
• A secure phonebook, with SSO (single sign on) through the Trust’s Microsoft 365 estate, so that users can quickly and easily find time-critical information and contact details.

Support as the Trust evolved

When the Trust merged with Guy’s and St Thomas’ NHS Trust in 2021, we worked closely with the team through a period of significant change. This included updating the brand and making sure everything stayed in line with NHS guidelines, evolving the application and infrastructure, working alongside security teams, and being on hand to advise as the two organisations came together.

Best practice for security and accessibility

As part of continual improvement, we’ve delivered:

• WCAG AA accessibility improvements in 2020 and again in 2024
• Regular Drupal updates, including from 8 to 9 in 2021 and 9 to 10 in 2023
• Form flood, spam and bot protection
• Multi-factor authentication rolled out in 2025.

The impact

Royal Brompton and Harefield’s approach to patient care is grounded in research, innovation, and a commitment to always improving. We’ve tried to bring the same thinking to their website.

Thanks to thorough discovery and thoughtful planning, and with continual testing and improvements over nine years, the hospitals have a robust, scalable platform that consistently delivers for the people who rely on it. Feedback gathered after launch was overwhelmingly positive, and the hospitals have chosen to keep working with us ever since.

From a disjointed and disappointing experience, today the hospitals have a secure, accessible and reliable digital presence that reflects their world-leading reputation.