Hicom Technology Ltd

Patient Portal

Patient Portal allows patients and carers to view diagnosis, clinical history, investigations and results; access relevant education material; view appointments; request prescriptions (CareHub Enterprise); and communicate with their healthcare team on-line. Patient Portal is an extension to Hicom's clinical care solutions including CareHub Enterprise, CareHub Elite, Diamond and Twinkle.


  • Provides 24/7 secure access to patient data to the patient
  • Traffic light performance indicators
  • Graphical representation of long term trends
  • Access to tailored/relevant education material including advice and guidance
  • Access to comprehensive medical histories including diagnosis
  • Request an appointment and manage existing appointments (CHEnterprise)
  • Access to visit summaries and referral/discharge documents
  • Patient targets including review points and results comparison
  • Messages and alerts facility (CHEnterprise)
  • Content managed pages for information, FAQs, services, etc.


  • Secure/immediate patient access to important clinical information improves patient understanding
  • Access to relevant and tailored education improves patient awareness
  • Automated reminders for up-coming appointment ensures on-time attendance (CHEnterprise)
  • Make, track and manage appointments enhancing the patient experience (CHEnterprise)
  • Improving patient engagement with healthcare professionals
  • Supports the NHS drive enabling patient access to health records


£24 a user a year

Service documents


G-Cloud 12

Service ID

3 3 6 2 2 5 2 7 5 1 3 3 5 5 8


Hicom Technology Ltd John Sanderson
Telephone: 01483 794945
Email: john.sanderson@hicom.co.uk

Service scope

Software add-on or extension
What software services is the service an extension to
Diamond, Twinkle, CareHub Elite, CareHub Enterprise
Cloud deployment model
Public cloud
Service constraints
Access to our help desk is limited to the service hours defined within this document, although the core service hours can be extended on request (at an additional charge). Hicom will notify the client of any planned service disruption or downtime, although we reserve the right to temporarily restrict access to the service outside of normal Service Hours without notice to undertake system upgrades or maintenance.
System requirements
Provision of industry standard browsers for each PC/device

User support

Email or online ticketing support
Email or online ticketing
Support response times
Response times are defined by the severity of the incident in accordance with our service level agreement, however as a guide we guarantee to respond to critical incidents within two working hours from the time of the call, urgent incidents within four working hours, and non-urgent issues and service requests within one working day.
User can manage status and priority of support tickets
Online ticketing support accessibility
None or don’t know
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Onsite support
Yes, at extra cost
Support levels
We provide:

- First-line support: Help desk and first responders. Information gathering, call logging, initial assessment, call proiritisation and escalation. Assistance with service requests and general operational support enquiries and responsible for customer communications and updates.

- Second-line support: In-depth analysis of the technical incident including troubleshooting and problem solving. Liaison with the customer technical or project team if required.
- Third-line support: Expert support by the development team for complex issues.

- Service monitoring: Automated and scheduled (daily) monitoring of the hosting service, system access, performance and stability.
Support available to third parties

Onboarding and offboarding

Getting started
Training is delivered in accordance with the needs of each organisation. We will develop individual, tailored training courses specific to the needs of the individuals being trained. Training can be delivered using a variety of different methods including cascade (train-the-trainer) training, classroom-style demonstrations, focus groups, workshops, online webinars and video tutorials.
Service documentation
Documentation formats
End-of-contract data extraction
Data is extracted by Hicom on request in a format dependent on future needs.
End-of-contract process
The following activities can take place at the end of the contract:

- Analysis and design: We would be keen to either provide the replacement system, or provide consultancy around the nature of the requirement. This would include comprehensive legacy analysis of the existing system to inform the requirements of the next (additional cost).
- Configuration and change management: Any change requests or defect reports will be passed to the developers of the subsequent system (additional cost).
- Data will be provided as IFF (included).
- Operations and support: The final release will still be supported until it is finally removed as long as this stage is still within contract(included).
- Transition consultancy: General consultancy is offered to enable the move to the replacement system. This may include consultancy around data migration and, specifically, around the data schema (additional cost)

Using the service

Web browser interface
Supported browsers
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install
Designed for use on mobile devices
Differences between the mobile and desktop service
No major difference. Some small difference in how screens are rendered.
Service interface
Customisation available
Description of customisation
Users have limited ability to customise the service. This includes menu items, data entry templates, document templates and, to a limited extent, the look and feel of the interface. This ability is limited to those users who have appropriate role based access controls.


Independence of resources
All environments utilise separate physical hardware and all networks are segregated using VLAN's, all network perimeters (internal and external) are secured with network firewalls, all servers utilise software firewalls, all environments utilise separate authentication, all hardware has a redundant layer and tolerates multiple levels of failure.


Service usage metrics
Metrics types
The following service usage metrics can be provided on request:

The following service usage metrics can be provided on request: - Core user actions: Are users consistently using predefined core user actions? - Activity time: The number of times a user visits a service and the elapsed time they spend - Visit frequency: How often does a user return to a service
Reporting types
Reports on request


Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2012
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
  • Encryption of all physical media
  • Other
Other data at rest protection approach
All customer data is encrypted at rest using Micrsoft SQL Server encryption, all storage/physical media is encrypted using FIPS level encryption.
Data sanitisation process
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Data can be exported either by using pre-formatted, customisable audit reports or by creating their own reports via MS SQL server report builder using pre-defined templates.
Data export formats
  • CSV
  • ODF
Data import formats
  • CSV
  • ODF

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
Other protection between networks
Access is via the public internet or the Health & Social Care Network dependent upon the application. All access is encrypted using SSL/TLS/IPSEC VPN, certificates utilise the latest standards.
Data protection within supplier network
  • IPsec or TLS VPN gateway
  • Other
Other protection within supplier network
All environments utilise separate physical hardware and all networks are segregated using VLAN's, all network perimeters (internal and external) are secured with network firewalls, all servers utilise software firewalls, all environments utilise separate authentication, there are multiple layers of physical security - secured electronic perimeter gates, biometric locks on external and internal doors, 24 hour monitored CCTV, 24 hour security patrols, the Hicom data centre within the main building is secured with biometric locks and IP cameras.

Availability and resilience

Guaranteed availability
Hicom will endeavour to make the service available without disruption during Service Hours; however allowances should be made within this period for essential service downtime to enable critical software upgrades and system maintenance to be carried out. Hicom provides all clients with an SLA (service level availabilty) that guarentees the availability of the service. The SLA generally guarentees availability of 99.5% during business hours however this is agreed with the client to meet their particular requirements.
Approach to resilience
All physical hardware within the Hicom data centre is redundant, this includes all servers, switches, firewalls, power, cooling, cabling, connectivity etc. There is a replication based disaster recovery solution in place, in the event of "disaster" occuring the systems can be restored to a fully operational state within 2 hours.
Outage reporting
All outages are reported via email alerts.

Identity and authentication

User authentication needed
User authentication
  • Limited access network (for example PSN)
  • Username or password
  • Other
Other user authentication
All Hicom systems require user authentication using individual/non-shared credentials, all access is restricted to the minimum level of rights and credentials are set and secured using the latest recommended standards for complexity, length and change frequency.
Access restrictions in management interfaces and support channels
All access to the system, including management interfaces, is provided by Role Based Access Control dependent on successful entering of a username and password. As the system is hosted within the HSCN network this adds a higher level of security. Where possible access control lists are used to restrict access by IP address.

Access to online support is similarly managed by Role Based Access Control, whilst those accessing telephone support may be asked to prove their identity if required. Where possible access control lists are used to restrict access by IP address.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • Username or password
  • Other
Description of management access authentication
All management and support access requires separate credentials which are restricted to key personnel, access is secured with network firewalls at each network perimeter and software firewalls on all servers, rights are provided on a "minimum level of rights to complete the task" basis and access is reviewed and revoked when no longer required.

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
How long system logs are stored for

Standards and certifications

ISO/IEC 27001 certification
Who accredited the ISO/IEC 27001
ISO/IEC 27001 accreditation date
What the ISO/IEC 27001 doesn’t cover
We believe this covers all of our activities.
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications
Any other security certifications
Cyber Essentials

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
ISO/IEC 27001
Information security policies and processes
We are ISO 27001 accredited and, as such, our information security policies and processes are guided by this. This, therefore dictates the following: • Information security policies • Organization of information security • Human resource security • Asset management • Access control • Cryptography • Physical and environmental security • Operations security • Communications security • System acquisition, development and maintenance • Supplier relationships • Information security incident management • Information security aspects of business continuity management • Compliance; with internal policies, and with external requirements, such as laws Hicom is also registered with the Information Commissioner Office and adhere to the Data Protection Act 2018 and GDPR. We have and continue to take steps to ensure we remain compliant with the General Data Protection Regulations (GDPR). Hicom also hold certification for our Information Security Management System (ISMS) under ISO27001 and manage our confidential data policy and responsibility through our ISMS. Hicom are also registered under the Data Security and Protection Toolkit for NHS digital and measure and publish our performance against the National Guardian’s ten data security standards. ISO 27001 compliance is managed by our Quality and Information Security Officer Elaine Smart who reports directly into our Board.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
All changes related to the product specification (configuration) are either captured by the Project Manager if the system is still being implemented, or by our support department or the clinical account manager if the system has already been implemented. These are then tasked as Requests for Change and prioritised for implementation

Changes in the project processes or baseline (time, money etc.) are dealt with via the Project Manager and, if necessary the relevant Hicom Product Manager. If a change is identified, all affected project parameters will be assessed, analyzed for impact and acted upon.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Hicom subscribes to/utilises multiple vulnerability alert/information services including - MS-ISAC, NCSC, CIS, Symantec, Microsoft, OWASP, the information provided is reviewed and corrective action taken to correct/mitigate any issues. Monthly vulnerability scans are carried using multiple tools to test for vulnerabilities internally and externally, the results and action are recorded and reviewed as part of the organisations security management.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Hicom utilise an SIEM (Security Information and Event Management Solution) for protective monitoring, the product currently in use is Splunk however this is subject to change as new products enter the market. The SIEM solution monitors and analyses the logs from web servers and other key systems.
Incident management type
Supplier-defined controls
Incident management approach
Our approach to incident management is informed by ITIL. As such it is made up of the following components:
- Incident detection and recording
- Classification and initial support
- Investigation and diagnosis
- Resolution and recovery
- Incident closure
- Ownership, monitoring, tracking and communication
Users report incidents through the support service defined in our standard SLA and incident reports are provided via the relevant Product Specialists.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks


£24 a user a year
Discount for educational organisations
Free trial available

Service documents