LIO

LIO

LIO is a contactless patient monitoring platform for inpatient health. It combines ambient monitoring, digital observations and management reporting. LIO enhances how clinicians observe, intervene and plan, and is proven to help providers deliver safer, higher-quality and more efficient care.

Features

• Contactless pulse, breathing rate, movement and sleep monitoring
• Digitally time-stamped, accurate observations
• Personalised risk based notifications to meet patients needs
• Incorporates two class IIa regulated medical devices
• Infrared vision enables patient safety checks in all light conditions
• Secure access through tablets and nursing station screen
• Automated activity reports to review nighttime and daytime activity
• Exportable reports to integrate into electronic patient records
• Secure cloud and onsite data storage
• Offline capabilities for low wifi areas without compromising accuracy

Benefits

• Enables patient safety checks without disturbing sleep
• Releases staff time through quicker digitally enhanced processes
• Enables staff to respond proactively to improve patient safety
• Automated reports provides insight into physical health
• Supports learning with enhanced data on incidents
• Supports staff to reduce assaults, self-harm and restrictive practice
• Automated integration into EPR
• Enhanced physical checks even when patient is refusing observations
• Intuitive, easy to use system supports effective staff training
• Improves accuracy and compliance of observations

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at richard.elliott@liohealth.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

147175041707301

Contact

Richard Elliott
+44 (0) 1865 900 599
richard.elliott@liohealth.com

About the service

• Service categories:
  • Applications
    • Production and operations
      • Service industry and public sector operations
        • Healthcare
        • Police
        • Adult Social Care
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Hybrid cloud
• Service constraints: LIO receives regular maintenance, updates, upgrades and patches without the requirements for system downtime. In the scenario where downtime is required for maintenance or upgrades, this will be communicated and agreed with the customer to ensure ample time and support for business continuity. LIO includes software and hardware. The provision of software, hardware and its maintenance, updating and upgrading is fully included in the service license.
• System requirements:
  • Wifi access throughout ward
  • Adequate, suitable space for local server
  • Suitable internet connection to the cloud, including firewall requirements
  • OIDC API (if implementing User Authentication functionality)

User support

• Email or online ticketing support: Yes
• Support response times: Our customer support team is available 24/7, 365 days of the year to answer calls via our Support Line or, responding to email and feedback forms via the LIO system. Response and resolution times are fixed as per the Service Level Agreement, which is comprised of 6 categories - with response and resolution options being 24 hours (7 days a week), 72 hours (7 days a week) and 96 hours (7 days a week). The Service Level Agreement is the same across all customers.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes
• Support levels: All support is included in the contract as a standard service provided to all customers. Services include:; Where a reported issue requires an onsite visit (such as hardware replacement), LIO provide this as part of the service agreement which also details ther Service Level Agreement. ; ; Additional training and support is available via online training modules (provided to customers to integrate into their own training systems) and in person via our Customer Success Team.; ; A dedicated Account Manager is also provided for support throughout.; ; We do not provide a dedicated Technical Account Manager or Cloud support engineer.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Product Training is packaged into comprehensive courses and delivered to organisations via LMS compatible files (SCORM 1.2), allowing them to upload all materials directly to their LMS. This lets them manage training alongside other platform documents and track staff training progress internally. In addition, we are on-site during the go-live process and have a dedicated customer support service that is available 365 days of the year. ; In addition to the above all users have access to the Instructions For Use for the platform from LIO devices.
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats: Digital training resources (SCORM, Videos)
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: LIO produces eight types of data ("data categories"). Customers are the Data Controller of these data, and therefore determine what happens to these data when the contract ends. The retention and storage of this data is agreed with the customer and written into the contract in the Generated Data Guide and Description of Data Processing.
• End-of-contract process: LIO is decommissioned by LIO and the customer. LIO removes the equipment from the customer's locations, seeking access and/or support when the equipment requires their Estates or IT teams (e.g. to access the server room, to access the ward). Customers remove the empty housing units, as these are part of the customer's physical building infrastructure, directly - customers can choose to leave or remove the empty housing units. No additional costs are charged by LIO.

Using the service

• Web browser interface: Yes
• Supported browsers: Chrome
• Application to install: Yes
• Compatible operating systems:
  • Android
  • Linux or Unix
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Functionality is the same on fixed screen displays and mobile devices.
• Service interface: Yes
• Description of service interface: The LIO User Interface enables staff to:; - Measure a patient’s pulse and breathing rate completely contact-free; - verify patient safety at night without disturbing them; - undertake digital observations and track compliance and observation history; - View activity trends and provide information and notifications to clinical staff about a patient’s location in their room.; - View vital signs trends; - view sleep data; - view overview of patient status in rooms and highlight areas of risk
• Accessibility standards: WCAG 2.2 A
• Accessibility testing: None - the interface does not currently support third party assistive technology as it is a secure system offering closed functionality.
• User support accessibility: WCAG 2.2 A
• API: No
• Customisation available: Yes
• Description of customisation: Most LIO functionality is configured at a ward-level, although with the introduction of "adaptive monitoring" later this year, additional personalisation will be available on a per-room basis. Risk based notifcations (alerts and warnings) can be switched on or off (for all or part of the time) depending on the needs of the ward or patient. For digital observations, locations, risk factors and observation levels can be adapted to suit the ward layout, ward type and patient needs.

Scaling

• Independence of resources: LIO is a single tenant solution that runs on-premise with backup to AWS cloud and to a specification that is validated as meeting system and user demand

Analytics

• Service usage metrics: Yes
• Metrics types: LIO provides usage metrics on vital sign attempts, alert resets, alert reset response times, which devices are used and which rooms have been switched on and off.; Usage metrics are provided in a weekly and/or monthly report. Metrics are shown day by day, by time of day, and presented as trends over time.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Other
• Other data at rest protection approach: Personal data stored within the service is encrypted at rest using AES-256, including the local database on customer-hosted servers and data stored in approved third-party cloud services. Where data is stored on customer infrastructure, physical access controls are managed by the customer in accordance with their local policies. Where data is stored within third-party cloud services, physical security controls are provided by the cloud provider and supported by independent assurance (e.g. CSA CCM v 4.0, ISO 27001 aligned controls and SOC 2 Type II certification).
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Reports are available for export via PDF. HL7 and FHIR compatible integrations to EPR systems are available.
• Data export formats: Other
• Other data export formats: Pdf
• Data import formats: Other
• Other data import formats:
  • HL7 / FHIR compatible integrations allows for import of data
  • N/A note: LIO captures data by clinicians directly

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection between networks: Data is encrypted at rest with AES-256bit encryption on LIO managed cloud servers and access to data for remote support is via a VPN connection. Any data transfer is encrypted to a minimum of TLS1.2.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection within supplier network: Data is encrypted at rest with AES-256bit encryption on LIO managed cloud servers and remote access to the corporate network is via a VPN connection. Any data transfer is encrypted to a minimum of TLS1.2.

Availability and resilience

• Guaranteed availability: LIO provides support and maintenance for the LIO Service as outlined in their Service Level Agreement details of which are included in the Service Definition document. Support is provided without additional charge and is covered within the overall service licence cost. The SLA describes 6 scenarios where support might be required and outlines the service and timing provided including for serious incidents access to 24/7 support. Service Level Failures are reported for resolution and remediation at the Partnership board (steering board comprising customer and LIO) meeting.
• Approach to resilience: Available on request
• Outage reporting: Direct communication with customer, via email or phone. Each customer's system is segregated /ringfenced.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Other user authentication: Users are authenticated via their organisation’s Single Sign-On (SSO) system using OpenID Connect. The organisation controls the authentication method (e.g. username/password, MFA). Upon successful authentication, the user is redirected back to the platform with cryptographic proof of identity.
• Access restrictions in management interfaces and support channels: Access is restricted using Role-Based Access Control (RBAC) combined with authentication-based access guards.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Description of management access authentication: Management access is authenticated using the same OpenID Connect-based SSO mechanism, combined with elevated role-based permissions.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: Between 6 months and 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Top level information security and privacy policy (part of ISO 27001 /ISO 27701 certified information security management system). Information and infrastructure assets security classification, risk management, incident management, management review, staff competence/training; access control, cryptographic and key management, media re-use and disposal.; Management appointments for regulatory compliance, quality assurance and security and privacy management within the ISMS/PIMS and QMS: Chief Information Security Officer; Information Security and Privacy Manager, Data Protection Officer.; All staff are trained on policies and procedures within the ISMS/PIMS within their first week of joining LIO and role specific security training is carried out prior to granting access. All staff must complete refresher training at least once a year, or more where there are changes to policies/procedures. ; Policy compliance is monitored through operational security reviews chaired by the Director of Engineering and non-conformances are reported at Security Management Reviews. Monitoring takes place through biannual internal audit carried out by a qualified external auditor and LIO through annual surveillance / recertification audits from the ISO 27001/27701 certification body. ; A sanctions policy is in place which provides line managers with guidance on appropriate sanctions for non-conformance with policies and procedures in line with LIO's disciplinary policy.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Configuration and change management is controlled through documented internal procedures aligned to ISO 27001. Changes to production systems follow a formal change control process including risk assessment, peer review, approval, testing in non-production environments, and controlled deployment. Emergency changes are permitted only via defined exceptions and are retrospectively reviewed. Access to production environments is restricted and monitored, and configuration changes are logged.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Vulnerability management is aligned to recognised security standards (e.g., ISO 27001 and NCSC guidance). Vulnerability scanning is performed within each software release cycle: static analysis during development; pre-release scanning of all libraries and SOUP against multiple vulnerability databases; and grey-box scanning of the full deployed system (OS, server build and application). Critical and high vulnerabilities must be remediated (or formally risk accepted) before release. Monthly credentialed platform scans are performed, and CREST-accredited third parties conduct penetration testing biannually. Patches are tested as part of release validation.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Protective monitoring is implemented through security logging, alerting and regular review of events across the service. System and application logs are generated to record authentication events, administrative actions, access to sensitive data and security-relevant errors. For cloud-hosted components, AWS monitoring and logging services are used to collect operational and security telemetry and to generate alerts for anomalous activity. Access to logs is restricted and logs are retained in line with defined retention periods. Alerts and events feed into our incident management process, and security issues are triaged and responded to based on risk.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: Yes
• Incident management approach: LIO's Security and Privacy Incident Management Procedure ensures an effective approach to the management of information security incidents. The procedure outlines how security weaknesses and events are identified, defines when a security incident and/or a data breach has occurred, the requirement for immediate containment and protection of assets, risk analysis, incident management actions, verification of effectiveness requirements for reporting security incidents and data breaches. Customers are notified of incidents which impact them and can report any events or suspected incidents via the 24/7 support number, by email or by the system feedback form.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 13%
• Between £500,001 and £1,000,000: 26%
• Between £1,000,001 and £2,500,000: 26%
• Between £2,500,001 and £5,000,000: 26%
• Over £5,000,001: 26%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: NQA
• ISO/IEC 27001 accreditation date: Thursday 5 September 2019
• What the ISO/IEC 27001 doesn’t cover: All Annex A Controls are in scope, there are no exceptions.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 61d6baae-f5e3-4611-8922-7bc4bf287a47
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 4902c5d7-5045-4efe-a4c1-c6f6fe5b230a
• Other security certifications: Yes
• Any other security certifications:
  • Data security and protection toolkit (NHS Digital) standards exceeded
  • ISO 27701 Privacy and Information security management
  • ISO 13485 Quality management system

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Volunteering opportunities for staff
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
  • Working conditions which promote an inclusive working environment and promote retention and progression
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of issues relating to entering the contract workforce
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at richard.elliott@liohealth.com. Tell them what format you need. It will help if you say what assistive technology you use.