Skip to main content

Help us improve the Digital Marketplace - send your feedback

  1. Digital Marketplace
  2. Lot 2: Cloud software
  3. SPS UK&I Patient Record Digitisation

SPS UK&I Patient Record Digitisation

Providing both digitation/conversion and hosting of patient health records. It includes preparation, scanning, capture and highly automated extraction from structured documents, e-mails and other files types. Allowing clinicians to have rapid access to patient data in a single digital view, via flexible user interfaces designed specifically for the Trust’s workflow.


  • Point of entry capture or back file conversion
  • High volume scanning and indexing including multi-page documents and forms
  • Handling of highly sensitive original documents
  • Highly automated, secure extraction from structured documents, emails etc.
  • Suitable for hand-print and bar codes
  • E-delivery via secure line or SFTP
  • Optional processes including rejection handling
  • Highly secure, ISO certified (27001, 14001, 9001) Digital Transformation Centres
  • Staff security vetted to BPSS and SC Government clearance
  • Fully managed service, transport, archiving, disaster recovery, reporting


  • Reduced costs through automation
  • Reduced retrieval costs
  • Fast return on investment (typically less than 12 months)
  • Faster processing and faster responses – increased agility
  • Consistent application of business rules, increased accuracy, reduced risk
  • Provides information in a consistent and accessible electronic format
  • Enables workflow automation
  • Enables content analytics through enhanced insight
  • Enhanced compliance via a full audit trail


£0.04 a unit

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Tell them what format you need. It will help if you say what assistive technology you use.


G-Cloud 13

Service ID

2 1 8 4 7 2 0 5 5 2 6 5 8 8 4


Telephone: 07748114237

Service scope

Software add-on or extension
Cloud deployment model
Private cloud
Service constraints
At this time, there are no foreseen service constraints that buyers should know about.
System requirements
Users have anti-virus Softare installed on their devices

User support

Email or online ticketing support
Email or online ticketing
Support response times
Response time agreed with client
User can manage status and priority of support tickets
Phone support
Web chat support
Onsite support
Support levels
We have a Service Centre (Help Desk) included as part of our service. The normal operating hours of our Service Centre are 8am to 6pm but clients have the ability to submit a query/ticket between 7am and 8am via our online Service Centre Plus online system. Anything received between 7am and 8am will be picked up by the Help Desk staff at 8am. Should this not be sufficient, we are happy to look at bespoke options for specific clients. Our support engineers are on hand to assist users with a range of queries and tickets are raised for all queries which are monitored to resolution. Other than our Service Centre Plus online system, support queries can also be sent in by email, phone or fax.
Support available to third parties

Onboarding and offboarding

Getting started
All chosen Users of the Service will be provided with their own login/Service Access Credentials. SPS adopts the train-the-trainer approach to product training. User guides will also be provided.
Service documentation
End-of-contract data extraction
A specific Data extraction plan will be planned and agreed with the customer. Depending on the agreed data extraction plan, will depend on the method of data extraction. All data extraction methods are secure and inline with ISO27001 procedures.
End-of-contract process
Exit fee's will be discussed and agreed with the client on each contractual basis before contract signature. Depending on the clients requirements regarding Contract exit and termination, will depend on what happens at the end of the contract

Using the service

Web browser interface
Application to install
Designed for use on mobile devices
Service interface
User support accessibility
None or don’t know
Customisation available
Description of customisation
All customisations of all SPS Services will be explored and agreed with the buyer prior to contract. Client themselves are unable to make ad-hoc customisation with SPS' Solutions.


Independence of resources
SPS has invested heavily into all its services to ensure the system capacities are built and designed to manage and operate whilst large volumes of users are accessing and using the system.


Service usage metrics
Metrics types
We provide full Management Information reporting. We record detailed information to provide comprehensive qualitative and quantitative MI reporting. Reports are typically periodic and are emailed directly to authorised requesting users.
Reporting types
Regular reports


Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2019
Government security clearance
Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations
Datacentre security standards
Managed by a third party
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
Other data at rest protection approach
Customer authored Data is encrypted at rest for all cloud services. When hard disks are taken out of service they are demagnetised and destroyed on site. Our sites are accredited annually to ISO27001.
Data sanitisation process
Data sanitisation type
Explicit overwriting of storage before reallocation
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Data can be exported by clients to us in various ways including SFTP or physical media
Data export formats
  • CSV
  • ODF
  • Other
Other data export formats
  • SFTP
  • Physical media
Data import formats
  • CSV
  • ODF
  • Other
Other data import formats
  • PDF
  • XML

Data-in-transit protection

Data protection between buyer and supplier networks
Other protection between networks
This will depend on the agreed transfer method. It can be encrypted or secured in another fashion which will be agreed with the client
Data protection within supplier network
Other protection within supplier network
Supplier-Defined process audited and certified to ITHC standard.

Availability and resilience

Guaranteed availability
SPS meets target service levels set at between 99.6% and 100%. We can provide details of SLA and service level credits are agreed with clients on a case by case basis
Approach to resilience
Available on request
Outage reporting
Email alerts from the SPS Support Team.

Identity and authentication

User authentication needed
Access restrictions in management interfaces and support channels
Not applicable to this service as no client users access the service
Access restriction testing frequency
At least once a year
Management access authentication
Description of management access authentication
Please describe how you authenticate management access to your service.

Audit information for users

Access to user activity audit information
No audit information available
Access to supplier activity audit information
Users receive audit information on a regular basis
How long supplier audit data is stored for
How long system logs are stored for

Standards and certifications

ISO/IEC 27001 certification
Who accredited the ISO/IEC 27001
ISO/IEC 27001 accreditation date
What the ISO/IEC 27001 doesn’t cover
Information Security relating to hardware, Software, LAN and WAN management, documentation including paper based and digital Customer communications for client facing information, client owned and supplied information and internal processing facilities relating to the provision of central mail rooms including customer locations, document processing centres and head office activities.
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Who accredited the PCI DSS certification
Security Standards Council
PCI DSS accreditation date
What the PCI DSS doesn’t cover
The PCI-DSS certification covers our inbound document processing operations, such as document scanning, data capture, confidential document processing. All other outbound/printing or digital communication solutions are not PCI DSS certified.
Cyber essentials
Cyber essentials plus
Other security certifications

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
ISO/IEC 27001
Information security policies and processes
SPS policies and processes are in line with ISO 27001 accreditation. SPS security policies include;
- Information Security Policy
- Data Protection Policy
- Encryption policy
- Password Policy
- Physical Security policy
- Incident Management and improvement process

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
SPS’ approach to Solution configuration and Risk management is built on recognised principles of change management and is again closely aligned with the principles of PRINCE2. SPS’ risk assessment and change management process ensures that there are regular reviews of any potential risks during the development pipeline of the solution and at the very least a one-time review of risks associated with any changes made to the solution throughout its lifetime. From this review, necessary preventive and / or contingency actions will be identified and passed to detailed work planning, including an update of the solution pipeline.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
The compliance team within SPS are responsible for the internal auditing of all processes and procedures. This includes undertaking with our information security manager information security risk assessments and risk treatment plans, looking at all critical assets and processes, alongside a Business Impact Assessment and BC Risk Assessment a Business, looking at critical business systems and processes. This is all then followed up by internal and external audits covering all parts of the certificated standards to ensure that SPS is working to their own internal processes and controls and we are able to maintain 9001, 14001, 27001 certifications.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
The respective asset owners are responsible for arranging for the controls to be implemented effectively; this would typically include defining the controls in policies and/or procedures, so that they can become part of everyday business practice. Asset owners are responsible also for the management of any risks which are not specifically addressed in the Risk Assessment. The SPS Risk Assessment and Risk Treatment plan document is structured by using the Asset List to identify the threats to each asset. Each threat and consequent risk is quantified. We further analyse this information for all significant risks and their respective controls.
Incident management type
Supplier-defined controls
Incident management approach
SPS' procedure provides guidance on the handling of security incidents, breaches or suspected incidents and breaches.This policy applies to all SPS systems and sites and to all SPS staff, temps, contractors and third parties working on behalf of SPS. Once the incident has been identified and contained, efforts can then be focused on finding an appropriate solution. The fundamental features of any solution should be investigation, action and follow-up/record-keeping; the order in which they are implemented depends upon the nature of the incident.
The Services Director, assisted by the Compliance manager, will initiate the appropriate investigation.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks

Social Value

Fighting climate change

Fighting climate change

Through SPS’ Engage framework we have looked to drive improvements to sustainable working in recent years – factoring environmental considerations into business decisions. In 2019, we consolidated two of our largest SPS locations together into one combined operations centre, significantly cutting down on waste, emissions and power usage. This redevelopment culminated in a £2 million investment into our newly formed Digital Transformation Centre (DTC), with a focus on sustainability and security. Motivated by reducing our reliance on traditional energy sources, we installed a solar panel array on the roof of the new facility.

Since their installation in August 2019, our DTC has generated 71,600kwh of renewable electricity to date, equating to a 59.2 tonne reduction in greenhouse gas emissions. 100% of this power is delivered to the DTC, meaning the site is maintained by 100% renewable energy, with an additional power surplus. SPS is also actively returning any excess power produced to the National Grid.

The ‘reduce, re-use, recycle’ principle is also actively promoted at our DTC. Whilst all legal requirements surrounding waste are adhered to, including the Green Government Commitment, preventing the production of waste in the first place is paramount. Our unique on-site shredding capability works alongside with our waste contractor ensuring a 100% paper recycling rate. At present 80% of all waste from our DTC is recycled. All SPS sites maintain waste transfer records, meaning we can analyse our figures and identify areas for improvement.


£0.04 a unit
Discount for educational organisations
Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Tell them what format you need. It will help if you say what assistive technology you use.