ASHTONS HOSPITAL PHARMACY SERVICES LIMITED

Ashtons SimplyRx

Software to help GP surgeries re-issue their prescriptions more efficiently, helping to streamline the tasks involved and improve patient safety.

Features

  • Re-issue prescriptions
  • Re-authorise prescriptions
  • Medical record access
  • Prioritisation of re-issues
  • Intuitive user interface
  • Real time reporting
  • Remote access 24/7

Benefits

  • Improved patient safety
  • Time saving
  • Cost saving

Pricing

£2.80 a user a year

  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at moarif@ashtons.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

2 2 7 3 1 4 3 8 3 7 9 0 6 4 5

Contact

ASHTONS HOSPITAL PHARMACY SERVICES LIMITED Mo Arif
Telephone: 07875407085
Email: moarif@ashtons.com

Service scope

Software add-on or extension
No
Cloud deployment model
Public cloud
Service constraints
Can only be use where SystmOne, EMIS or Vision are used for primary care records.
System requirements
  • Modern browser
  • Internet connection

User support

Email or online ticketing support
Email or online ticketing
Support response times
With 8 working hours.
User can manage status and priority of support tickets
No
Phone support
No
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
Support is included in the cost.
Support available to third parties
No

Onboarding and offboarding

Getting started
We will provide onsite training, online training and user documentation.
Service documentation
Yes
Documentation formats
PDF
End-of-contract data extraction
By arrangement with our support desk.
End-of-contract process
If there is a renewal in place, the renewal will occur automatically. If not, access will cease and we'll arrange for the client to have their data returned to them.

Using the service

Web browser interface
Yes
Supported browsers
  • Microsoft Edge
  • Firefox
  • Chrome
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
No differences.
Service interface
No
User support accessibility
WCAG 2.1 AA or EN 301 549
API
No
Customisation available
No

Scaling

Independence of resources
Our resilient infrastructure is designed to cope with even the biggest peaks in demand through auto-scaling technology.

Analytics

Service usage metrics
Yes
Metrics types
Real time dashboards and reports.
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Staff screening not performed
Government security clearance
None

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
No
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least every 6 months
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Encryption of all physical media
Data sanitisation process
Yes
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
A third-party destruction service

Data importing and exporting

Data export approach
By arrangement with our support desk.
Data export formats
CSV
Data import formats
Other
Other data import formats
No data to upload

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
99.99% availability
Approach to resilience
Available on request.
Outage reporting
Public dashboard.

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Username or password
Access restrictions in management interfaces and support channels
Not applicable.
Access restriction testing frequency
At least once a year
Management access authentication
  • 2-factor authentication
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
No
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Cyber essentials plus
Yes
Other security certifications
Yes
Any other security certifications
NHS Data Security and Protection Toolkit

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
Other
Other security governance standards
Cyber Essentials Plus
NHS Data Security and Protection Toolkit
Information security policies and processes
At Ashtons, the below security policies are in place:

1. MFA & MDM (Multi-factor Authentication & Mobile Device Management)
2. Acceptable Use Policy
3. Clean Desk Policy
4. Data Breach Response Policy
5. Disaster Recovery Plan Policy
6. Personnel Security Policy
7. Data Backup Policy
8. User Identification, Authentication, and Authorisation Policy
9. Incident Response Policy
10. Risk Assessment Standards and Procedures
11. Remote Access Policy
12. Secure Systems Management Policy
13. Monitoring and Logging Policy
14. Change Management Policy
15. Cyber Essentials PLUS accreditation

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
1. Map critical organisational services to stakeholders and related services
2. Identify assets related to the critical services
3. Evaluate change requests and approvals
4. Model configuration changes in a test environment
5. Deploy changes in the production environment
6. Determine the success or failure of changes
7. Close out completed changes

Changes are assessed for security impact throughout the change control process, during the test lifecycle
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
1. Ashtons undergo monthly vulnerability scans by a third-party supplier. Any vulnerabilities found are remediated immediately
2. Patches are deployed to our services 14 days from their initial release – this is to ensure there are no system issues originating from the initial release of a security patch, for instance
3. The Head of IT & Data Security is a member of the CIIS and reviews the NCSC website regularly. We also have third party suppliers who work with us on vulnerability management
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
1. Ashtons utilise security information and event management (SIEM) solutions which work by collecting log and event data generated by our organisations applications, security devices and host systems and bringing it together into a single centralized platform. SIEM gathers data from antivirus events, firewall logs and other locations; it sorts this data into categories, for example: malware activity and failed and successful logins
2. Incidents are responded to instantly with a 24/7/365 support system in place
Incident management type
Supplier-defined controls
Incident management approach
1. Ashtons have rigorous disaster recovery plans in place with pre-defined RTO and RPOs. There is also a company-wide business continuity plan which includes emergency contacts. There is also pre-defined processes in place for data breaches and Ashtons have their own Data Protection Officer (DPO)
2. Users report incidents to the Head of IT & Data Security via email or phone with 24 hour support available
3. Ashtons have a versioned incident management form that includes, details of the incident along with corrective and preventative actions

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks
Yes
Connected networks
Health and Social Care Network (HSCN)

Social Value

Fighting climate change

Fighting climate change

We are committed to ESG and are working with Sustainable Advantage to implement an action plan, which will cover the 5 social value themes of PPN 06/20.
Covid-19 recovery

Covid-19 recovery

We are committed to ESG and are working with Sustainable Advantage to implement an action plan, which will cover the 5 social value themes of PPN 06/20.
Tackling economic inequality

Tackling economic inequality

We are committed to ESG and are working with Sustainable Advantage to implement an action plan, which will cover the 5 social value themes of PPN 06/20.
Equal opportunity

Equal opportunity

We are committed to ESG and are working with Sustainable Advantage to implement an action plan, which will cover the 5 social value themes of PPN 06/20.
Wellbeing

Wellbeing

We are committed to ESG and are working with Sustainable Advantage to implement an action plan, which will cover the 5 social value themes of PPN 06/20.

Pricing

Price
£2.80 a user a year
Discount for educational organisations
No
Free trial available
Yes
Description of free trial
This is be the full software package for use on a trial basis for a limited period of time. Usually the trial is for 1 month.

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at moarif@ashtons.com. Tell them what format you need. It will help if you say what assistive technology you use.