CYBER MEDIA SOLUTIONS LTD

Theseus: Drug and Alcohol

Theseus: Drug and Alcohol is a secure substance misuse caseload management system with integrated NDTMS National Drug Treatment Monitoring System CDS dataset compliant returns and reporting features. Theseus: Drug and Alcohol has powerful case management functions including Drug and Alcohol treatment episodes, TOP Treatment Outcomes Profile and NEX Needle Exchange.

Features

• Customisable episodic workflows tailored to your drug and alcohol service
• NEX Needle Exchange features support configurable items and packs
• Substitute prescribing features enable clinicians to create and print prescriptions
• Substance misuse groupwork features for easy management of group sessions
• Diary and Booking System Module facilitates appointment booking for teams
• Broad range of assessment tools available for deployment, e.g. AUDIT
• Colour-coded dashboard summary of patient/client follow-ups (including upcoming and overdue)
• Pre/Post Appointment Assessment Forms Module captures patient information before/after sessions
• Post-Treatment Follow-Ups Module sends patients/clients tokens for automated follow-ups capture
• ISO 27001:2022, ISO 9001:2015 and Cyber Essentials+ certified. DCB0129 compliant.

Benefits

• Flexible, scalable platform; only pay for the modules you need
• Excellent, robust data entry validation for hassle-free NDTMS submission
• YP, CJIT, Community and Secure Settings caseloads and datasets supported
• KPI Dashboards for Caseworkers, Managers, Data Analysts and Commissioners
• Email Notifications Module reduces missed appointments and sustains patient/client engagement
• Easy onboarding and access with Entra ID Module Single Sign-On
• Increase efficiency through transcription with Ambient Voice Technology Enablement Module
• Data API Module enables data deep-dives in business intelligence systems
• Supported by knowledgeable and experienced UK team
• Build an integrated ecosystem; search 'Theseus' for additional wellbeing models

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at neil.lovell@cyber-media.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

213069943993437

Contact

Neil Lovell
01785 222350
neil.lovell@cyber-media.co.uk

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
  • Other
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: No
• System requirements:
  • Web browser
  • Internet / data connection

User support

• Email or online ticketing support: Yes
• Support response times: Target response times are summarised as follows. Critical Priority Issue: 2 hours; High Priority Issue: 4 hours; Medium Priority Issue: 1 day; Low Priority Issue: 2 days; Request for Enhancement: 14 days.; Support is available Monday - Friday, 9am - 5pm (excluding Bank Holidays).
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support is provided as standard as part of the annual Theseus product licence. We have a dedicated product support team that provides professional support to clients. The target response times, identified by our Theseus Service Level Agreement (SLA), are summarised as follows. Critical Priority Issue (system unavailable): 2 hours; High Priority Issue (partially unusable, significantly affecting operation): 4 hours; Medium Priority Issue (aspect causing difficulty): 1 day; Low Priority Issue (a general question): 2 days; Request for Enhancement: 14 days.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Our standard offer includes high quality online training materials, plus live webinar 'train the trainer' training to nominated Superusers.
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats: Training portal / video media
• End-of-contract data extraction: Data may be extracted by the customer using Theseus Key Data Extracts.; We will provide a complete CSV extract of service data and arrange for secure transfer via an agreed secure method.
• End-of-contract process: We will provide a complete CSV extract of service data and arrange for secure transfer via an agreed secure method. If additional data migration or extraction services are required, these are available via G-Cloud 15 Lot 3 'Theseus Support Services'.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: A Mobile Worker Module is available which provides a streamlined user interface for mobile (and desktop) working. The interface is fully responsive for ease of use on mobile and tablet devices and is optimised for efficient and accurate working away from traditional desk-based environments.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: A Client Portal Module is available for citizens that can be configured with a broad array of features, including care plans, review / booking of next appointment and journal keeping.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The Client Portal Module has been subject to thorough accessibility testing against WCAG 2.2 'AA' standards, including compatibility with screenreaders and browser accessibility tools.
• API: Yes
• What users can and can't do using the API: Primary care system API integrations are available. A Theseus Data API Module is also available for integrating Theseus with business intelligence systems (e.g. Microsoft Power BI).
• API documentation: Yes
• API documentation formats:
  • PDF
  • Other
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: A Flexible Form Builder Module is available that can be used for configuration of data capture interfaces. The Theseus Administration Area enables authorised administrators to configure settings and options in accord with the organisation's requirements.

Scaling

• Independence of resources: We use reliable and reputable suppliers. Environments are actively monitored and resources allocated to ensure service standards are maintained.

Analytics

• Service usage metrics: Yes
• Metrics types: A comprehensive range of service usage metrics can be provided by the product. For example, total number of service users, follow-ups completed, follow-ups outstanding, etc.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: Less than once a year
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Data may be extracted from Theseus in CSV format from: standard and bespoke reports, standard and bespoke dashboards, form extracts and system data extracts. Data may be exported as a CSV export of all form data submitted.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: The in service availability has been, and is planned to be, better than 99.9%. We operate a transparent SLA. In all cases the times indicated are targets and we will make best endeavours to meet or exceed these targets.
• Approach to resilience: Information, including Business Continuity Plan, available on request.
• Outage reporting: System maintenance and upgrades are performed outside of business hours. Customers are informed of any planned service outage in advance via email. In the event of unplanned outage, customers can receive a report on the cause of the outage and its remediation.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Username or password
• Access restrictions in management interfaces and support channels: The product features secure account management features that enable configuration of user permissions throughout the system to restrict access to management interfaces (and data) by role.; ; In line with our Information Security Management System, all support channel users must be pre-registered as authorised contacts in order to raise support tickets.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate an ISO 27001:2022 Information Security Management System supported by a comprehensive range of policies, procedures and processes, subject to ongoing review. Top level policies include (among others): Information Security Policy, Software Management Policy, Threat and Vulnerability Management Policy, Cloud Services Policy, Clinical Safety Policy.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We maintain detailed change logs for all our components and services.; ; Significant change must be assessed through compilation of a testing plan with clear acceptance criteria and security impact assessment. Clinical safety is also considered.; ; The individual responsible for testing must be identified and briefed regarding the testing they will need to undertake.; ; The asset owner obtains approval for the change, taking into account any technical considerations, the costs of the exercise, the potential benefits and security impact.; ; Once the change request is approved by the Team Manager, approval is recorded and logged.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: All new software is risk assessed in line with our Software Management Policy. Security patches are applied within 14 days of the update being made available by a vendor. To identify potential threats the NVD and CVE databases are regularly reviewed. Public-facing applications are subject to third-party penetration tests.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use a multilayer approach including firewalls and endpoint protection.
• Incident management type: Supplier-defined controls
• Incident management approach: We have an Information Security Incident Policy that defines our response.; All staff will be made aware through their contract of employment, training and by their team manager of what is considered to be an incident.; Information security weaknesses, events and incidents will be reported immediately by staff to the ISM as soon they are seen or experienced.; The ISM will be responsible for closing out the incident. This includes reports to external authorities.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: Thursday 22 February 2024
• What the ISO/IEC 27001 doesn’t cover: Scope is as stated on certificate.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: BSI
• ISO 9001 accreditation date: Wednesday 29 June 2016
• What the ISO 9001 doesn’t cover: Scope is as stated on certificate.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 81f661eb-616a-4519-99d1-377a712bebc4
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 5f796401-1ad0-4a18-a855-da8cf03c6bca
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at neil.lovell@cyber-media.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.