J C APPLICATIONS DEVELOPMENT LIMITED

JCAD LACHS Claims Management Software

JCAD LACHS is an off the shelf claims management software solution for the improved management and reporting of insurance claims data, policy and asset management. Data can be collected via an online web form and there are a number or reporting tools available including data retrieval via API.

Features

• Effective management of insurance claims
• Address look-up, search & find function
• Operational dashboards
• API to enable enhanced reporting in BI tools
• 200 client configurable custom fields
• Realtime notifications and triggers
• Full 0365 email integration and document bundling
• GDPR claim anonymisation
• Claims litigation workflows
• Drag and drop

Benefits

• Faster claims processing through paperless office
• Improved accuracy and consistency of data
• Powerful & flexible reporting
• Maintain access to historic data
• Reduce claims and premiums
• Quick implementation
• Improved analysis of patterns and trends
• Great training and consultancy services
• Annual reviews with Account Manager
• Take advantage of additional modules

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jcad@jcad.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

351409243517211

Contact

Phil Walden
01730 771957
jcad@jcad.co.uk

About your service

• Service categories:

  Applications

  Enterprise resource management

  Financial

  • Financial and Accounting Applications
  • Treasury and Risk Management Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: None
• System requirements:
  • Edge
  • Chrome
  • Firefox
  • Safari
  • Access to email services

User support

• Email or online ticketing support: Yes
• Support response times: Our support desk runs 9 - 5.30 Monday through Friday. We guarantee immediate acknowledgement and fix within 4 hours. If this is not possible we keep the client informed and there is a defined escalation process that is followed for serious issues that can not be resolved within 24 hours.; We also have a specific SLA that details support times for hosted products.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 A
• Web chat accessibility testing: Web chat is a feature of our CRM system, Hubspot. Anyone using our website is able to ask a question. This feature is monitored by JCAD (through an alerts facility) to ensure timely responses are provided.
• Onsite support: Yes, at extra cost
• Support levels: SLA for response times is based upon severity level.; ; Low - Within 24 hours; Medium - Within 24 hours; High - Within 8 hours; Critical/Significant customer impact - Within 4 Hours; ; Costs for the support detailed above are included within our maintenance fee.; ; Each client will have access to an Implementation Consultant and an Account Manager as well as the dedicated support desk. Should the issue lie with our hosting partners then JCAD will work with them to resolve.
• Support available to third parties: No
• AI chatbot: No

Onboarding and offboarding

• Getting started: Due to the nature of the system being "off the shelf" we adopt a standard approach to implementation which means that it can be achieved quickly and with a low resource from the client.; ; The basic approach is as follows.; ; 1. Pre-implementation meeting (remote or onsite) with assigned JCAD consultant to discuss data migration and to agree timeframes and responsibilities.; 2. Data migration takes place and JCAD make available the prototype database. The database is cleansed and validated during this process of migration.; 3. Client undertakes UAT on the back of some basic training and with reference to online resources; 4. Amendments are incorporated into the definitive database production; 5. Further training provided (remote or onsite); 6. System goes LIVE; 7. Once the main system goes LIVE we then move on to optional modules such as online claim forms, Claims Portal integration, asset registers, automated data uploads etc.; 8. During implementation liaison with in-house IT is limited to O356 integration and security features such as SSO, IP whitelisting; ; We would normally expect an implementation to GO LIVE within 8 - 16 weeks.; ; Online documentation is provided as part of the system and includes instructional training videos.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats:
  • Online help
  • Video
• End-of-contract data extraction: JCAD will provide raw claims data in .csv or .xls format. If additional records such as documents, emails and actions are also required a charge will be made for the associated professional services.
• End-of-contract process: Once the contract is terminated, all access to the cloud service will be denied. If requested within 90 days of termination JCAD will provide a data export (at no charge) of claims data in .csv, html or Excel format. This process will be agreed with the relevant operations staff at JCAD and he client.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Via tutorials and through conversation with Implementation team.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The application can be accessed from smart phone or desktop but the user interface changes appropriately dependant upon screen size.
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: The API allows the user/organisation to retrieve data over a secure connection for reporting purposes with applications such as Power BI or Microsoft Excel. The API is used soley for the retrieval of data for use in external systems.
• API documentation: Yes
• API documentation formats:
  • PDF
  • Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Although the system is off the shelf with a standard interface and standard fields there are 200 custom fields that can be included and then reported upon.; ; There are also an online claim forms that are configurable.

Scaling

• Independence of resources: We operate in the MS Azure environment - Segregated customer instances have ringfenced resources to ensure that one customer doesn't take up a disproportionate amount of a single resource.

Analytics

• Service usage metrics: Yes
• Metrics types: Usage metrics such as who logged in, when they logged in and what they accessed are available as a report. There is also in system views that illustrate similar information.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: If necessary then data can be easily exported from the system into Excel via custom reporting or using data exports from the Find module with user configurable data views. This takes the fields & data within that view and exports directly to Excel. Graphs within the interactive dashboard can be output to images. Exports can be performed from claims, claimants, payments, diary, as well as from property, motor and content assets.; ; The API can also be used to extract data in to the relevant BI tool available at client site.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Pdf
  • Word
  • Excel
• Data import formats:
  • CSV
  • Other
• Other data import formats: Excel

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The Azure infrastructure has 100% network uptime availability. We aim to provided 99.99% application availability outside schedule maintenance windows.
• Approach to resilience: JCAD use the MS Azure environment within UK South. Production and backup data are stored in separate data centres in the UK. Further information is available on request.
• Outage reporting: Email alerts in the event of an outage

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Other user authentication: IP restrictions can be applied to restrict access to the application from specific IP ranges. MFA is accomplished through the use of SSO integration.
• Access restrictions in management interfaces and support channels: Access control to management interfaces are provided within the application. Access is restricted to designated support staff at a level required for them to perform their role. An escalation process in place whereby senior staff can also interface if needed.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Description of management access authentication: Access is restricted to designated support staff at a level required for them to perform their role. A escalation process in place whereby senior staff can also interface if needed.

Audit information for users

• Access to user activity audit information: You control when users can access audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We have an information security policy which is applied by our consultants when working with client data. The same policy is used in relation to our own data. Our Head of Operations and MD are responsible for each of these respectively. Any breaches or issues will be reported to one of them. As an ISO27001 certified organisation we take security very seriously and much of this is to ensure that processes and best practice are understood and followed.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We are certified ISO27001:2022 which incorporates and audits elements such as these. All our services are monitored through threshold capacity monitoring on CPU, RAM, HDD and server availability monitoring with live SMS and email notification to support staff. Any server changes go through a change control and risk assessment process and are logged.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We are certified ISO27001:2022 which incorporates and audits elements such as these. Our infrastructure has a SIEM solution providing a centralised threat detection, investigation, response, and proactive hunting across on‑premises and cloud environments. This provides vulnerability scanning to highlight any potential vulnerabilities and has virus and threat protection in place. Patches are deployed within a short period of time to address any vulnerabilities. Potential threat information is obtained from best practice review and industry focus based literature.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We are certified ISO27001:2022 which incorporates and audits elements such as these. Our infrastructure has a SIEM solution providing a centralised threat detection, investigation, response, and proactive hunting across on‑premises and cloud environments. This provides protective monitoring to highlight any potential compromises, incidents or vulnerabilities. Potential compromises can be highlighted by industry focus literature, client feedback, penetration testing. Any potential compromise will be reviewed for mitigation requirements and based up the level of risk addressed within a short period.
• Incident management type: Supplier-defined controls
• Incident management approach: Incidents are recorded and assessed for root cause, resolution actions and resolution effectiveness. Common events are handled by our support team and incident tracking systems. Users can report incidents to our support team by phone or email during support hours.; As part of ISO27001:2022 our incident reporting policies and procedures are recorded and actioned routinely should they occur.; JCAD have a Information & Security Policy that includes details of our incident management approach.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: The free trial option provides access to a basic system with demo data so that the key functions are able to tested in the real world. This is available upon request
• Link to free trial: Available as part of a due diligence process

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Alcumus ISOQAR
• ISO/IEC 27001 accreditation date: Monday 25 March 2024
• What the ISO/IEC 27001 doesn’t cover: No exclusions
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Alcumus ISOQAR
• ISO 9001 accreditation date: Wednesday 19 June 2024
• What the ISO 9001 doesn’t cover: No exclusions
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: C28d184b-bf3a-43e5-946b-7b03535adbb4
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: A6b7e45d-050d-4492-b017-86522a298d83
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jcad@jcad.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.