S.T.C.S. LTD

Bespoke software development of Patient Screening and Management Systems

Bespoke software development, implementation and support for NHS Patient Management Systems and Screening Programme Administration Systems. 30 years experience within Local/Central Government, Higher Education and NHS. Full Agile development service incorporating Business Analysis, System Design, Software Development, Testing. Cloud/local network hosting, supporting transition from disparate legacy systems with data migration.

Features

• Development of bespoke Patient Screening / Management systems
• Whole software development lifecycle service
• Expertise in iterative Agile development methodologies
• Collaborative approach, working with clients to define requirements
• User centred design process
• Software development following Government Design Principles
• Integration with in-house and external systems
• Cloud-based or on-premise hosting
• Continuous support following go-live
• UK based development team

Benefits

• Methodology and tech stack aligned to customer requirements
• Bespoke solutions to solve specific user needs
• Expertise across C#.NET, PHP, React, Angular, NodeJS, SQL Server, MySQL
• Flexibility to amend requirements during development
• Client involvement throughout development ensures desired outcomes are achieved
• Robust systems produced through continuous testing

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at digm@stcs.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

338978764494957

Contact

Stephen Connolly
0191 490 3232
digm@stcs.co.uk

About the service

• Service categories:
  • Applications
    • Production and operations
      • Service industry and public sector operations
        • Healthcare
        • Other
      • Other operations
        • Other operations
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: None
• System requirements: No service requirements/dependent on the contract

User support

• Email or online ticketing support: Yes
• Support response times: Standard support times are 8-6 Mon to Fri (excluding bank holidays) ; P1 initial response time = 2 hours ; P2 initial response time = 2 hours ; P3 initial response time = 4 hours
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: STCS has defined three levels of priority. ; ; P1 - System is not operational or is operational but with critical functionality not available or not working correctly and there is no workaround to the problem. ; ; P2 - System is operational and critical functionality is unavailable or not working correctly but there is a workaround to the problem. ; ; P3 - System is operational and there are faults but the critical functionality is working correctly. ; ; Support costs will be discussed as part of the procurement process and tailored to customer and system requirements
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Tailored to customers requirements, can include full training, system documentation and walkthroughs
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats:
  • Word
  • Excel
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: Customers will have full access to their data, the exact process for data extraction will be tailored to the customers requirements.
• End-of-contract process: If the customer chooses to move to a new supplier for system support, any handover of knowledge would be charged at an agreed rate.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Customers can specify development of an API to allow transfer of data and integration with other systems/products
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Our bespoke systems are developed as per the customers detailed requirements

Scaling

• Independence of resources: The independence of resources depends on the hosting solution selected by the customer, i.e. cloud provider or internal network. We will work with the customer to ensure a suitable level of resources are commissioned based on the specific requirements of the system.

Analytics

• Service usage metrics: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: Any data export request can be tailored to the customers requirements
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Availability depends on the hosting solution selected by the customer, i.e. cloud provider or internal network. The systems we develop are designed to have 100% availability and only require downtime for releases.
• Approach to resilience: Hosting will be commissioned based on the customers specific requirements for system resilience
• Outage reporting: Email alerts

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Use Role-Based Access Control (RBAC) to manage access based on roles.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Description of management access authentication: Role Based Access

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: Cyber Essentials Plus
• Information security policies and processes: We have an STCS Information Security policy which all staff are required to comply with and we also have an Information Security policy for each system we develop / support. Our nominated Information Security Officer conducts onboarding and yearly review with all staff.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Software changes are assessed to DCB0129 standard which is assessed by our CSO provider Safehand.
• Vulnerability management type: Undisclosed
• Vulnerability management approach: Our risk management strategy covers human, network and asset vunerabilities and details the tools used to monitor activity, detect threats and protect systems and data. We are signed up to security alert services and these are actioned by our Infrastructure Manager. Scans and patching are carried out on a weekly basis in additional to any ad-hoc urgent updates.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Weekly scans of our own network plus we expect cloud providers and hosts to carry out their own independent monitoring and notify us of any compromises requiring our investigation and action. We advise all clients to ensure that their cloud provider / internal network configuration utilises the highest level of monitoring and protection.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Processes are defined and communicated to customers. Users report incidents and concerns via either our dedicated email inbox or phone line. Incidents are documented and reported via email to nominated customer contact. Incident log is reviewed monthly by Clinical Safety Officer and Sponsor to see if any updates to the Hazard log or changes to the system are required.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 9eceb2c4-50d5-40ad-94ca-9661aec19699
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 702418c9-ae78-4e74-8d7c-c79ec70d152d
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at digm@stcs.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.