Care Banking

Social Prescribing : Module 6

Software supporting individualised care, enabled by CareBankings modular systems approach.
The social prescribing module can link to CHC, PHB or GP Clinical systems. The product is used to support Primary Care Networks PCNs and Social Prescribers or CCGs / LA teams.
Supporting : Social Prescription, invoicing, Self Care


  • Social prescribing marketplace
  • Patient Empowerment
  • Client Empowerment
  • Monitoring and reporting capabilities for commissioners
  • Accessible on laptop, PC, mobile and tablet
  • Full auditing capabilities
  • Improved client or patient outcomes


  • Creates a competitive marketplace for social prescriptions
  • Aligns commissioners internal processes with aims of social prescriptions.
  • full visibility of all transactions
  • Improved visibility of spend
  • Commissioners are able to monitor the quality of services/providers
  • Increases flexibility and choice
  • Full audit capability from assessment to service provision and invoicing


£1000.00 per unit per year

Service documents


G-Cloud 11

Service ID

2 1 4 5 1 4 0 3 4 3 9 2 0 2 0


Care Banking


0203 633 1766

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
Any software application used to capture Clinical needs or any brokerage software
Cloud deployment model
Public cloud
Service constraints
The most significant constraint relate to the versions of browser supported. Please contact us for a list of the browsers currently supported.
System requirements
  • A FTP link will need to be established
  • Certificates for encryption will need to be exchanged

User support

Email or online ticketing support
Email or online ticketing
Support response times
24 hours but not available at weekends
User can manage status and priority of support tickets
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Onsite support
Yes, at extra cost
Support levels
Rate are set out in the rate card
Support available to third parties

Onboarding and offboarding

Getting started
Documentation is provided along with web guides, onsite training can be provided.
Service documentation
Documentation formats
End-of-contract data extraction
A request is made to the supplier and we provide a single extract from the database, data is provided back in the format it was uploaded, ie single file un-indexed data.
End-of-contract process
The provision of a single data extract is included in the price, additional effort would be charged on a day basis.

Using the service

Web browser interface
Supported browsers
  • Internet Explorer 10
  • Internet Explorer 11
  • Chrome
  • Safari 9+
Application to install
Compatible operating systems
Designed for use on mobile devices
Differences between the mobile and desktop service
Only the screen format will change,its designed to adjust to the various user interfaces available
Service interface
What users can and can't do using the API
Users can link clinical systems to the application to automate data transfers
API documentation
API documentation formats
API sandbox or test environment
Customisation available


Independence of resources
The system architecture ensures scaling does not impact existing users.


Service usage metrics
Metrics types
System usage by user or client
Reporting types
  • Real-time dashboards
  • Reports on request


Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Datacentre security standards
Managed by a third party
Penetration testing frequency
At least once a year
Penetration testing approach
Protecting data at rest
  • Physical access control, complying with another standard
  • Encryption of all physical media
Data sanitisation process
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
A third-party destruction service

Data importing and exporting

Data export approach
It depends on the users admin rights, most users can export data using the GUI export functions
Data export formats
Data import formats

Data-in-transit protection

Data protection between buyer and supplier networks
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

Guaranteed availability
We can provide a service 24/7 although this does not allow for scheduled downtime for updates and customer requested stoppages. The guarantee is 90% against contracted hours. Contracted hours are agreed with the customer.
Approach to resilience
Available on request
Outage reporting
Outages are reported via email

Identity and authentication

User authentication needed
User authentication
  • Public key authentication (including by TLS client certificate)
  • Limited access network (for example PSN)
  • Username or password
Access restrictions in management interfaces and support channels
The system has the concept of roles and responsibility, we use the roles to limit access to management interfaces and host critical applications separately to the main service.
Access restriction testing frequency
At least every 6 months
Management access authentication
Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications
Any other security certifications
  • Banking accreditation's covered by Santader Plc
  • Cyber essentials Plus

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
  • ISO/IEC 27001
  • Other
Other security governance standards
NHS Digital, Information Governance toolkit requirements level 2,
Cyber essentials Plus
Information security policies and processes
We have a information Governance steering group that reviews all policies and audits the application of them.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
The code base is modular in construction, any module being updated is operationally tested offline for a month before being released to the live environment. Automated testing scripts are used to check security impact.
Vulnerability management type
Vulnerability management approach
The partnership with Santander Plc ensures we are informed of any security threats known to the banking sector.
Patches can be deployed as rapidly as 4 hours but typically take 24 hours.
Live monitoring of any threats is provided through monitoring software.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
The system architecture prevents a large scale compromise, however we have continuous monitoring software to identify incidents and have been able to respond instantly.
Incident management type
Supplier-defined controls
Incident management approach
All incidents are reported to the information governance steering group, these can be generated by users via email or though our own monitoring software.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks


£1000.00 per unit per year
Discount for educational organisations
Free trial available

Service documents

Return to top ↑