VECTORCARE SOLUTIONS LTD

VectorCare Solutions

VectorCare is a centralized, cloud-based platform for managing all aspects of patient logistics from transport coordination and benefits management to workforce credentialing and invoicing. It offers an integrated SaaS solution for healthcare providers, payers, and service vendors to streamline care journeys, reduce administrative friction, and ensure high-quality, timely service delivery

Features

• Online scheduling for services such as transportation
• Realtime tracking and coordination
• Instant messaging between requestor and vendor
• No-code workflow builder
• EHR integration
• Business intelligence tools
• Vendor management

Benefits

• Reduction in time on task
• Right care at the right time
• Reduction in no shows
• Reduce cost

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ashley@vector-care.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

143818326140724

Contact

Justin Lewis
01604279760
ashley@vector-care.co.uk

About your service

• Service categories:

  Applications

  Supply chain management

  • Logistics and transportation management
  • Supply chain planning
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Most Electronic Health Record (EHR) systems such as EPIC, ORACLE / CERNER etc.
• Cloud deployment model: Private cloud
• Service constraints: Nil
• System requirements:
  • Internet access
  • Windows 11 and above
  • Any browsers

User support

• Email or online ticketing support: Yes
• Support response times: 24/7 Support within 1 hour including weekends
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: No
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: Fully tested with Pylon
• Onsite support: Yes
• Support levels: Critical Issue: “Red Phone” Immediate response (see requirements for Red Phone use) Examples of critical issues include complete service outages, significant data loss, or security breaches that impact the system's integrity or confidentiality. Red Phone Protocols; ; High-Priority Issue: Response within a few hours to one business day; High-priority issues may involve functionality impairments that affect core operations or critical features of the application.; ; Medium-Priority Issue: Response within one business day; Medium-priority issues typically refer to non-critical problems that affect specific functionalities but do not significantly impact overall operations or is a question on how to use the product.; ; Low-Priority Issue: Response within 24-48 hours; Low-priority issues are typically minor bugs, cosmetic issues, or feature requests that have minimal impact on the application's functionality or user experience.; ; No costs for the different support levels; ; Each account has a technical account manager and cloud support engineer.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: We offer onsite training, online training and user documentation.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: On request files will be sent securely.
• End-of-contract process: No additional costs users are notified within 30 days of shut-down.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: No difference
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: 1) Self-service inside the workflow builder.; 2) API is used for sending and receiving data.; 3) No limitations all self-configured on what data to send and receive.; ; RESTful open API
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: 1) No code workflow builder allows for unlimited customized workflows; 2) No code workflow builder in the admin panel; 3) Administrators

Scaling

• Independence of resources: Auto scaling with AWS cloud services and multi-zone availability.

Analytics

• Service usage metrics: Yes
• Metrics types: User activity and event tracking across the platform.
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: No
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Access to the business intelligence tool to create and download files.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 99.98% SLA
• Approach to resilience: Available on request
• Outage reporting: Public dashboard and email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Role based permissions defined by administrators.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: You control when users can access audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: CSA CSM version 4.0
• Information security policies and processes: VectorCare maintains robust information security policies and processes aligned with HIPAA compliance and SOC 2 Type I certification, ensuring the protection of sensitive healthcare data, including Protected Health Information (PHI).; ; - Key Policies and Practices; - Data encryption at rest (hard disk encryption) and in transit (HTTPS); - Secure coding measures (SQL injection prevention, CSRF protection); - Strict access controls; - Regular vulnerability scanning; - Penetration testing; ; We execute Business Associate Agreements (BAAs) with covered entities and implement a comprehensive Incident Response Plan for timely detection, reporting, and remediation of security events.; ; Reporting Structure; Our dedicated Security and Compliance team, reporting directly to executive leadership, oversees all security matters. Employees must report potential incidents immediately via secure channels to this team for investigation and escalation as required.; ; Policy Adherence; We ensure adherence through:; - Mandatory annual security training for all staff; - Continuous compliance monitoring via our Drata-powered Trust Center; - Third-party audits; - Policy enforcement tools (e.g., credential management in VectorCare Trust); ; This structured approach fosters accountability, risk mitigation, and ongoing improvement in our security posture, safeguarding patient logistics data across our platform.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: VectorCare uses a formal configuration and change management process aligned with SOC 2 and HIPAA, on AWS infrastructure.; ; Components (infrastructure, code, dependencies) are tracked via Git version control, Terraform IaC, and AWS Config for inventory, tagging, drift detection, and regular audits.; ; Changes are managed in Jira: submitted, reviewed by engineering/security for impacts (with SAST/DAST scans and CodePipeline checks). High-risk changes need Security team approval. ; ; Deployments employ blue-green/canary methods with rollback. All activity is immutably logged in AWS CloudTrail for auditability and compliance.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: VectorCare maintains a proactive vulnerability management process aligned with SOC 2 and HIPAA.; ; Potential threats are assessed via continuous automated scanning (AWS Inspector, GuardDuty), dependency checks (Snyk), and third-party penetration testing. Information sources include AWS security bulletins, NVD/CVE feeds, and industry alerts.; ; Critical vulnerabilities are prioritized and patched within 48-72 hours for high-severity issues, using automated CI/CD pipelines (CodePipeline) for rapid, tested deployments with minimal downtime. Lower-risk items follow a 30-day remediation schedule, with all actions tracked in Linear and audited.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: VectorCare employs continuous protective monitoring using AWS GuardDuty for threat detection, CloudTrail for audit logging, and Inspector for vulnerability alerts, integrated with real-time notifications via PagerDuty.; ; Potential compromises are identified through anomaly detection, unauthorized access attempts, and malware indicators. Upon alert, the Security team investigates immediately, following our Incident Response Plan: triage within 15 minutes, containment for critical incidents within 1 hour, and full remediation with root cause analysis. All events are logged for compliance auditing.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: VectorCare follows a documented Incident Response Plan aligned with SOC 2 and HIPAA, including pre-defined processes for common events like data breaches, outages, and unauthorized access.; ; Users report incidents via secure email (security@vectorcare.com), in-app support tickets, or phone. Internal staff use dedicated channels.; We provide detailed incident reports to affected customers under BAAs, including root cause, impact, remediation, and preventive measures, with initial notifications within 24 hours for breaches and timely updates throughout resolution.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 4914bd3a-d98c-4874-b4c2-39ebc4335c9f
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: Yes
• Any other security certifications: DTAC Compliance

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ashley@vector-care.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.