Patchwork Health

Patchwork: Practicing Privileges Management System

Streamline clinical governance with Patchwork’s digital Practicing Privileges system. Automate compliance via real-time GMC, DBS, and ICO links. Centralised dashboards track indemnity, appraisals, and CQC standards across sites. Enhances patient safety through automated expiry alerts and secure, email-free data sharing. Ensure robust, audit-ready oversight for private healthcare providers.

Features

• Storage and real time updating of CQC regulatory information
• Doctors data sits centrally updating dashboards of all organisations simultaneously
• Doctors can share information from within system without sending emails
• Live link to GMC FtP status
• Subscription to DBS
• Live link to ICO status
• Automatically updates Appraisal information
• Store and share Medical Information Practice Transfer (MPIT form)
• Track updates on status of Medical Indemnity certificates
• Dashboard to indicate the practising privileges status of every doctor

Benefits

• Provides instant, multi-site visibility of clinician credentials.
• Ensures continuous compliance with national regulatory standards.
• Protects patients through real-time monitoring of fitness-to-practise.
• Automates criminal record monitoring for ongoing safeguarding assurance.
• Guarantees clinicians maintain essential data protection registrations.
• Links clinical performance directly to current practicing rights.
• Streamlines the mandated transfer of professional information.
• Identifies non-compliant clinicians at-a-glance to prevent risk.
• Simplifies cross-provider vetting through centralised digital collection.
• Eliminates the risk of clinicians practicing without insurance.

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at procurement@patchwork.health. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

910929975025464

Contact

Anas Nader
02033717556
procurement@patchwork.health

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Enterprise performance management
  • Project and portfolio management

  Human capital management

  • Core Human Resources Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: No
• System requirements:
  • Minimum browser requirements
  • Internet connection

User support

• Email or online ticketing support: Yes
• Support response times: SLA is one hour. In practice, we respond to almost all queries in under 20-minutes; We support all end-users directly, not just managers and administrators.; ; Out of hours infrastructure-only support is; provided by the Patchwork Health Senior; Leadership Team and senior engineering team; members, as appropriate.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: Access via mobile or web app
• Web chat accessibility testing: N/A, we use a third party solution
• Onsite support: Yes
• Support levels: Customer Support Services operates Monday-Friday 9am-5pm,; we also have an emergency out-of-hours service that provides 24-hour; support for any urgent technical issues. Delivering in-app support; Customer Support acts as a first line of; support. Any issues that require more specialised support are triaged; to our Engineering and Client Partnership Teams.; ; We operate the following escalation process:; ; - Account Manager - Once 75% of the workaround target service level time has been exceeded without a workaround being implemented .; - Account Director - Workaround target service level exceeded; - Head of Accounts - Further escalation relating to service availability or response times; - Chief Operating Officer - Unacceptable response to escalation process; ; This support is provided at no additional cost.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: - For single users such as doctors, simple video training guides are all that is required although the system is very intuitive.; - Administrators, managers and service leads are trained through a library of video guides as well as live training. Ongoing training can also be supplied via webinar (generally on the same day as the request).; During the go-live phase, Patchwork provides 'Hyper-Care' for your administrators so that come up within minutes, we will be online with you helping you deal with each and every query as requested.
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats: Video
• End-of-contract data extraction: Users are able to download all information as PDFs and zip files of any uploaded supporting information. Before a user is removed from a client institution, the administrator is prompted to download any information required. Single users can retain their login to the system or request Patchwork for any downloads required.; On an institution-wide basis (at the end of the contract), Patchwork will off-board your data in a format that can be used in another system, e.g. PDF, or flat file
• End-of-contract process: Client organisations download any data required should they remove a user from their system.; If an organisation is decommissioning Patchwork they can either download all the data as zip files, or request Patchwork to do so for a charge.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Documents can be accessed via email by request, or directly from the system under the help section.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: No difference.; Smartphones - Application specifically to upload supporting information.; The main application is best used on computers or tablets.
• Service interface: No
• User support accessibility: None or don’t know
• API: No
• Customisation available: Yes
• Description of customisation: There are more than 200 configuration settings in Patchwork across all of our modules.; If you have a specific requirement that is not already available, then Patchwork will programme this requirement into the system for you.; Clients can choose from multiple different modules. Available modules are:; - Appraisal and Revalidation,; - Multi-Source Feedback,; - Job Planning,; - Medical Educators,; - Healthcare Leadership Module (2 different formats),; - Post Appraisal Questionnaires (including bespoke questionnaires),; - Quality Assurance,; - Disclosure and Barring Service check module (automated checking and reminders),; - ICO module (automated checking and reminders),; - Resources modules,; - Bespoke Checklists,; - Mandatory training module,; - Fees Payment Module.; - Full notes module as standard.; In the configuration of the system for the client, there are also multiple different settings that can be applied - e.g. different emails and different timings of emails, and different configurations of the dashboards.; As the software has evolved over 12 years, based on client feedback, the vast majority of specification change requests have been applied universally to the system. However, clients are offered the opportunity to tailor the system specifically for their organisation.

Scaling

• Independence of resources: Patchwork is deployed in a highly secure cloud environment. Capacity planning is undertaken regularly and we monitor server usage - both front end web servers and database/file servers- continuously. We deploy a very generous margin of extra capacity to ensure that computing resource is never over-utilised, even by spikes in demand. We deploy load-balancers to ensure that demand is distributed evenly between resources. We have complete insight into the demands created by each new customer implementation and new servers can be provisioned within 24 hours.; We regularly increase the number of support staff to cope with the increased demand.

Analytics

• Service usage metrics: Yes
• Metrics types: Patchwork can show how many end-users are using the system and provide a wide range of user reports. This includes % of users logging in during specific date parameters, length of session, number of documents uploaded on average for your Trust or Board, how many times per year your users log in on average.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Users can download files as summary or full PDFs or as zip files.; Users can also create permission to share with third parties from within Patchwork. This enables those who have permission will receive a unique login to receive update of information.; All management reports, including the raw data, can be exported in Excel format
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • PDF
  • JPEG
  • PNG
  • Excel
  • Word
  • RTF
  • Powerpoint
  • Video

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: We offer 99% uptime SLA for end-users. Should SLA availability not be met, we offer 0.5% of total charges for each percentage under target
• Approach to resilience: Our server provider (AWS) guarantees 99.99% network up-time. Further information can be provided upon request.
• Outage reporting: We provide live updates using the website - https://status.patchwork.health/. Updated every 60 seconds, this outlines the level of uptime over the last 90 days, overall uptime, and status updates over the last 30 days.We would also provide email and telephone alerts to all affected users during an outage. Account managers and Customer Support Team would provide ongoing support.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Patchwork has a full set of roles and permissions for user accounts, with different access privileges for Patchwork staff, customer's managers, customer's administrators and clinicians.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Our security policies and processes are fully aligned with the standards and principles of ISO 27001, and we maintain and enact all expected policies and processes. This includes access control policy, cryptography policy, data and information retention policy, data protection policy, information classification policy, information security policy, password policy and removable media device policy. Our practices meet the full NHS Data Security standards required through the Data Security and Protection Toolkit (DSPT), as well as UK Data Protection Legislation. Our practices are outlined in our Privacy Policy (available here: https:// www.patchwork.health/privacy/) and user T&Cs accessible on our website/mobile app.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All changes to code are peer reviewed during development and prior to release. All features are QA tested by a team separate from the product development team to provide additional safeguarding and operational review. Automated tooling to ensure compliance to development standards is enforced as part of our CI and deployment pipelines. Major changes use a Feature Flag system to allow code to deployed and then activated on a per-organisation basis alongside the necessary organisational process updates and training. All features are continually tracked from both a technical and operational perspective.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: As part of our CI and deployment pipeline all code is automatically scanned for potential vulnerabilities in the code by static analysis tooling. Additionally imported libraries are checked against a registry of known vulnerabilities. In all cases, detection of a risk prevents shipping the code. We have multiple monitoring solutions at each level of our solution stack which includes pro-active error notifications, performance monitoring and automated blocking of potential risks detected. Patches and hotfixes are deployed on demanded with zero down-time rollouts following the Blue/Green deployment pattern.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Ongoing automated monitoring at both an infrastructure and application level with alerts configured to detect unusual activity, errors, or performance been impacted in any way. Audits of logs are performed on an ongoing basis. If issues are detected engineering resources immediately priorities further investigation, patching, and prevention of the issue. If required an account manager will liaise with the Trust. Breaches are logged with the ICO within 72 hours as per GDPR requirements.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Application errors are automatically tracked and reported to the engineering team to be dealt with as a priority without needing to be reported by the end user. Infrastructure has monitoring and reporting in place to alert the engineering team of issues and health checks automatically replace servers exhibiting issues. Users can report issues via support channels or escalated to named senior account managers. All issues are reviewed within the product development process to address why it happened, our response, and how we can improve the system to prevent it in the future.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: We offer a limited free use period for Patchwork Health. The length and scope of the free use period is decided on a case by case basis.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 15%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: F0fddf42-34ed-4eed-8994-ca6df6d43d6b
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 394b167c-66fc-46fd-995f-aef66e090690
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Volunteering opportunities for staff
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at procurement@patchwork.health. Tell them what format you need. It will help if you say what assistive technology you use.