This is a software solution that provides a total market management solution for health or social care. The software is typically used by brokerage functions within commissioning, or commissioning support organisations.
- Market Management
- Structured and efficient invoicing and purchasing
- The product enables supplier markets to be managed effectively
- Purchases, contracts and correspondence are captured in one location
- Online invoice validation
- Reduction in transactional staffing levels
£1.79 per person per month
0203 633 1766
|Software add-on or extension||Yes, but can also be used as a standalone service|
|What software services is the service an extension to||Existing clinical or assessment systems, invoicing, contracting and payment systems.|
|Cloud deployment model||Public cloud|
|Service constraints||Support is not provided for early versions of internet browsers. Please contact us for more details|
|Email or online ticketing support||Email or online ticketing|
|Support response times||
no responses at weekends
|User can manage status and priority of support tickets||No|
|Web chat support||No|
|Onsite support||Yes, at extra cost|
Bug resolution is included in the costs.
We utilise account managers.
|Support available to third parties||No|
Onboarding and offboarding
|Getting started||Online training is provided.|
|End-of-contract data extraction||An export from the database is provided on request.|
|End-of-contract process||A single extract from the database is included in the costs. Any additional work will be billed to the customer.|
Using the service
|Web browser interface||Yes|
|Application to install||No|
|Designed for use on mobile devices||Yes|
|Differences between the mobile and desktop service||Only screen formatting is different.|
|What users can and can't do using the API||The API is for transferring clinical data between systems|
|API sandbox or test environment||No|
|Independence of resources||The architecture ensure scaling does not cause performance issues for users. More information can be made available to potential users if required.|
|Service usage metrics||Yes|
|Metrics types||User tracking, expenditure, customers can also request specific usage metrics at the time of ordering.|
|Supplier type||Not a reseller|
|Staff security clearance||Other security clearance|
|Government security clearance||Up to Developed Vetting (DV)|
|Knowledge of data storage and processing locations||Yes|
|Data storage and processing locations||United Kingdom|
|User control over data storage and processing locations||No|
|Datacentre security standards||Managed by a third party|
|Penetration testing frequency||At least once a year|
|Penetration testing approach||Another external penetration testing organisation|
|Protecting data at rest||
|Data sanitisation process||Yes|
|Data sanitisation type||
|Equipment disposal approach||A third-party destruction service|
Data importing and exporting
|Data export approach||Csv file|
|Data export formats||CSV|
|Data import formats||CSV|
|Data protection between buyer and supplier networks||
|Data protection within supplier network||
Availability and resilience
The defined Service level is 90 % during core hours, core hours are considered to be 9 to 5 weekdays. Service maintenance and system updates are scheduled outside of core hours. Any planned downtime (i.e. for maintenance) will be conducted outside of core service hours and the service must be provided with a minimum of 48 hours’ notice.
Where system maintenance is urgently required, the policy is to switch to the backup facility, users will be provided with as much information as possible should this occur.
|Approach to resilience||Available on request|
|Outage reporting||Email alerts are reported to all registered users|
Identity and authentication
|User authentication needed||Yes|
|Access restrictions in management interfaces and support channels||
The design of the My Care Bank solution ensures that the systems and software supplied enable personal information to be handled legally, securely, efficiently and effectively in order to deliver the best possible care. The system components used singularly or in combination, meet or exceed the current minimum requirements.
Privacy and data protection has been built into the system architecture from the start, the underlying design relies on three databases; two cloud based and an independent local database application, accessed through a role based protocol.
|Access restriction testing frequency||At least every 6 months|
|Management access authentication||Username or password|
Audit information for users
|Access to user activity audit information||Users have access to real-time audit information|
|How long user audit data is stored for||At least 12 months|
|Access to supplier activity audit information||Users have access to real-time audit information|
|How long supplier audit data is stored for||At least 12 months|
|How long system logs are stored for||At least 12 months|
Standards and certifications
|ISO/IEC 27001 certification||No|
|ISO 28000:2007 certification||No|
|CSA STAR certification||No|
|Other security certifications||Yes|
|Any other security certifications||Cyber Essentials Plus|
|Named board-level person responsible for service security||Yes|
|Security governance certified||Yes|
|Security governance standards||Other|
|Other security governance standards||We comply with the NHS standards for the Information Governance toolkit.|
|Information security policies and processes||All information security is monitored by a information governance steering group.|
|Configuration and change management standard||Supplier-defined controls|
|Configuration and change management approach||
We run automated test routines on all releases in a reproduction environment, before undertaking limited user testing.
A formal group approves all updates and monitors bug fixes on live sites.
|Vulnerability management type||Supplier-defined controls|
|Vulnerability management approach||
Automated monitoring systems track threats and inform the head of security and the deputy head of security.
Patches can be deployed immediately if required.
|Protective monitoring type||Supplier-defined controls|
|Protective monitoring approach||
Automated systems track all users and alert system security of any inappropriate or suspicious activity.
Pre-release testing identifies areas of weakness that are addressed in the preproduction environment.
|Incident management type||Supplier-defined controls|
|Incident management approach||All incidents are reported to the information governance steering group,this group maintains and updates the policies for managing all incidents.|
|Approach to secure software development best practice||Supplier-defined process|
Public sector networks
|Connection to public sector networks||No|
|Price||£1.79 per person per month|
|Discount for educational organisations||No|
|Free trial available||No|