BEACON MEDICAL SYSTEMS LIMITED

Pando - Clinical Messaging

Pando is a clinical messaging service that allows Health Care Professionals to securely share information, optimising clinical workflows and improving patient outcomes. Pando also provides insight to leaders within the hospital, helping them make decisions and target interventions.

Features

• NHS England DTAC approved secure messaging system.
• Integrated with NHS Mail for Single Sign On.
• Compatible with iOS, Android, and Web (Desktop).
• Seamless Interface meeting FHIR standard.
• Three Messaging Formats: 1:1, Team and Forums.
• Secure Image capture, editing, import and export to NHS email.
• Pando Ask Advice: for real-time advice and guidance.
• Secure File sharing: document viewing/sharing.
• Directory: access to active user directories.
• Premium: Securely accessible dashboard with management insights

Benefits

• Secure, efficient and accountable sharing of clinical information.
• Easy to see when messages are delivered and read.
• Improved staff satisfaction at work, with reduced workflow disruption.
• Reduced overtime/locum costs through better use of workforce.
• Improved patient services via improved flow and early escalation.
• £6.9 million average saving per NHS Trust over 5 years.
• Optimised patient referral via Ask Advice.
• Improves work life balance with mark as unavailable feature.
• Premium: Enhanced management understanding of how the MDT operates
• Premium: Management information provided to optimise patient pathways

£8 to £10 a user a month

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at philip@hellopando.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

363583651362190

Contact

Philip Mundy
+44 (0) 3300 970 165
philip@hellopando.com

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements:
  • Mobile devices operating on supported versions of Android or iOS.
  • Desktop device with modern supported web browser.

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Email or online ticketing, Pando's average time to first response is less than 10 minutes during office hours.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: Web chat
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.1 AA or EN 301 549
• Web chat accessibility testing: Web chat support is conducted via Intercom, please see https://www.intercom.com/changes/en/2335-communicate-with-everyone-through-an-accessible-messenger for accessibility details.
• Onsite support: Yes, at extra cost
• Support levels: *Support and Uptime Services*; Support 7 days per week 09:00-17:00 GMT, via In-app helpdesk, phone, email and website; ; Pando Self-Serve Help Centre, Automated FAQ support for all users, How-to articles for all users, Instructional how-to videos via YouTube, 24/7 user feedback.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Pando provides training materials to support the onboarding process and ensure users can use the functions of the application in an efficient, compliant, and accessible way.; ; We aim to meet the needs of users with a range of learning styles and preferences whilst taking into consideration accessibility standards.; ; A carousel-style tutorial presented in-app to new users provides an overview of Pando's main features.; ; The support portal on the Pando website is available 24x7x365 and contains on-demand knowledge articles which cover the following areas: getting started, features, security, implementation and troubleshooting.; ; We work in tandem with organisations to develop specific learning materials that incorporate local Standard Operating Procedures (SOPs), Information Governance guidelines and other guidance.; ; Workshops are encouraged for new teams to make the best use of Pando in the context of their job role. We encourage participants to learn from and motivate each other and can provide guides to facilitate this style of workshop.; ; Our face-to-face training can be performed either one to one or in a group setting. We encourage organisations to appoint Pando champions to lead the spread of knowledge through their teams/departments.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Data can be extracted at the end of the contract by Pando following a GDPR compliant process.
• End-of-contract process: Data extraction at the end of the contract is included. At contract end, users lose access to Pando Messenger.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service has been designed to be "Mobile First"; user-facing services are fully available from mobile devices.
• Service interface: Yes
• User support accessibility: WCAG 2.1 A
• Description of service interface: Pando uses CloudTrail/GuardDuty as a service to enable automatic governance, compliance, and auditing of hosted data. We log, continuously monitor, and retain account activity related to all actions across our infrastructure. This event history simplifies security analysis, resource change tracking, and troubleshooting. There is also a capability to detect unusual activity, to simplify operational analysis and troubleshooting. This service allows us to fulfil audit requests and enables full reporting of subject access requests or clinical safety incidents. The audit trail is immutable, and only available to authorised users with elevated privileges via a secure administrative Control Centre.
• Accessibility standards: WCAG 2.1 A
• Accessibility testing: Screen reader support: the Messenger is accessible via screen readers;; Keyboard navigation: every component of the Messenger can be accessed using a keyboard without requiring a mouse or trackpad;; Colour contrast: all text in the web Messenger uses colours with sufficient contrast to be clearly visible.
• API: Yes
• What users can and can't do using the API: Access to the Pando API is available as required through our Implementation services. Please contact us for more details and access to test environments.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: User profile details are customised as needed.; In App information fields such as ward lists for NHS trusts can be tailored to the organisation's needs.; Bespoke integrations available.; Features (e.g. task management, lists, ask advice) can be activated or deactivated as needed by the organisation, to avoid overlap with existing clinical systems.

Scaling

• Independence of resources: All component parts of the service are designed in a cloud-native manner. Elastic provisioning is used, enabling automatic scaling to handle increases and decreases in load.; ; Scalability of the service was proven during the COVID-19 pandemic, handling 5x normal traffic with no performance degradation.

Analytics

• Service usage metrics: Yes
• Metrics types: A wide range of operational use data can be provided, alongside detailed reports made available on request.; Data includes:; ; - Staff user numbers; ; - Message activity and type (per user/team/department); ; - Image activity (per user/team/department); ; - Task activity (per user/team/department); ; - User feedback (qualitative and NPS); ; - Identification of users struggling to onboard who require additional assistance.; ; A hospital dashboard is included in the premium version of our product, this includes additional information as set out in the Service Description and other supporting G Cloud 14 Framework Documents.
• Reporting types:
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Pando can export data in machine-readable formats which are based on open standards where applicable, including full historical message data via standards-based access to XMPP.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • JSON
  • XML (XMPP stanza documents)
• Data import formats: Other
• Other data import formats: JSON (via API)

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service is available for 99.9% of the time. The guaranteed SLA is 99.5%. Full details about the SLAs are detailed in the associated Terms and Conditions.
• Approach to resilience: All services are duplicated in multiple availability zones within AWS, and each set of instances is capable of handling our full service load. This is frequently tested during service upgrades, which operate using a zero-downtime "rolling upgrade" pattern which causes half the service instances to drop at a time, with the load taken comfortably by the other half.; ; All data is frequently backed up, and Point In Time Restores are periodically executed in test environments to ensure backup viability.; ; Further details can be made available on request.
• Outage reporting: In the event of significant disruption to the service, administrators will be alerted by email.; ; Detailed outage reporting is available on request via the Pando API and is also available on the service status of the Pando website. https://network.hellopando.com/service-information/

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Other user authentication: User registration: Users must have access to a whitelisted domain email address to register with Pando. On entering that email address, an activation code is sent to the email address which must be entered to gain access to the App. This activation code remains active for 24 hours. Additionally, the NHS.Net SSO service can be used instead of an activation code.; ; PIN login: Users must set a 4-digit PIN which must be entered to gain access to the App. This PIN cannot be removed, and the timeout cannot be altered by the user.
• Access restrictions in management interfaces and support channels: Regular users can create their own conversation groups but cannot edit access for other users.; All access points have enforced 2 factor authentication. Direct access to support the databases and infrastructure is limited to a restricted team who have been issued a named account and connect using two-factor authentication.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Description of management access authentication: As for standard user accounts, with additional vetting by Pando staff

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications: DSP Toolkit to Standards Exceeded

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: CyberEssentials Plus; DSP Toolkit to standards exceeded.
• Information security policies and processes: As an organisation aligned with ISO 27001 information security standards, we adhere to a comprehensive set of policies and processes to safeguard our information assets. Our information security policies cover areas such as data classification, access control, encryption, incident response, and compliance with legal and regulatory requirements.; Our reporting structure involves clear delineation of roles and responsibilities within the organisation, with designated information security officers overseeing the implementation and enforcement of security policies. We conduct regular audits and assessments to ensure compliance with ISO 27001 standards and identify areas for improvement.; ; To ensure policies are followed, we employ various measures, including ongoing training and awareness programs for staff, regular monitoring and review of security controls, and robust incident management procedures. ; ; Policies are agreed by the Information Security Advisory Group (ISAG) that meets monthly and are signed off at Board level. Policies and procedures are reviewed at least annually in advance of submission of the NHS DSP Toolkit which obtains an outcome of ‘standards exceeded’. Routine ‘spot checks’ are carried out to ensure that the staff adhere to policies and workstations are monitored to ensure compliance by Kolide monitoring software.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Our configuration and change management processes track service components from inception to sunset. Each component is documented in JIRA and version controlled throughout its lifecycle. Changes are carefully assessed for potential security implications through comprehensive risk analysis and impact assessments. Our procedures ensure that any alterations to configurations or services are carefully reviewed and validated to maintain the highest levels of security and reliability.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerabilities are assessed based on potential seriousness and ease of exploit - the latter including preconditions such as "must be a registered user".; ; Vulnerabilities that are serious and highly exploitable are fixed as soon as possible. For backend and desktop services, a new release and deploy can be performed very rapidly - within 30 minutes. For Pando's mobile apps, a new version can be submitted to the App stores within 3 hours, and in the meantime, features can be disabled remotely.; ; Vulnerabilities are found by automated tooling (including dependency analysis), continuous testing, and third-party reporting (including users).
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: All accesses are logged and sent to a searchable logging system. All access-control failures are treated as potential errors and are recorded by our fault reporting system; a surge in these would cause an alert which we would identify as a potential compromise attempt.; ; Potential compromises are tackled by examining historical data, such as access logs, to determine the extent of any breach, and by working to close off the vulnerability. Pando is designed such that data compromises are concentrated in the backend, which can be re-deployed rapidly.; ; Incident response is always our highest priority.
• Incident management type: Supplier-defined controls
• Incident management approach: Incidents are raised either automatically by our monitoring systems, by customers via our support team, or by staff. Incidents are actioned and escalated appropriately depending on severity.; ; If required to resolve incidents, engineering staff are on-call 24/7, and processes are in place to ensure specialists and senior management are available if needed.; ; Once incidents are resolved, post-incident reviews are carried out to ensure continual service improvement. We work collaboratively to understand the causes of the incident and gain insight into the effectiveness of our response. Remediation tasks and process improvements are prioritised accordingly.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  Pando can indirectly contribute to fighting climate change through various means. Firstly, by facilitating remote consultations between healthcare professionals and specialists, the app reduces the need for physical travel. This decrease in travel translates to lower carbon emissions from vehicles, thus mitigating the environmental impact associated with transportation.; Pando enables healthcare providers to exchange information and collaborate on treatment plans digitally which streamlines healthcare processes. This efficiency can lead to reduced paperwork and administrative tasks, ultimately minimising resource consumption and waste generation within healthcare facilities.; The widespread adoption of medical messaging apps can contribute to the digitisation of healthcare systems, encouraging the development of innovative technologies and solutions aimed at improving environmental sustainability. For instance, integrating renewable energy sources, implementing energy-efficient medical devices, and adopting sustainable healthcare practices can be facilitated through digital platforms like medical messaging apps.; By promoting remote healthcare delivery and digitising healthcare processes, medical messaging apps align with broader efforts to reduce the carbon footprint of the healthcare sector. While the individual impact of each app may seem modest, the cumulative effect of widespread adoption across healthcare systems can be significant in mitigating climate change.

  Covid-19 recovery

  Pando has played a crucial role in facilitating Covid-19 recovery efforts in several ways. Firstly, it enables healthcare professionals to efficiently communicate and coordinate patient care remotely, reducing the risk of virus transmission in healthcare settings. By minimising physical interactions, the app helps safeguard the health and safety of both patients and medical staff, contributing to the overall containment of the pandemic.; Pando facilitated real-time dissemination of vital information, updates, and guidelines related to Covid-19 management and prevention. Healthcare providers can share insights, best practices, and treatment protocols instantly, ensuring that frontline workers have access to the latest information to deliver effective care and response strategies.; The Pando service supports mental health by enabling mental health professionals to easily and securely collaborate in order to provide much-needed emotional support and coping strategies to individuals experiencing stress, anxiety, or isolation due to the pandemic.; Overall, the use of a secure messaging app during the Covid-19 recovery efforts enhances access to healthcare services, improves communication and collaboration among healthcare providers, enables timely dissemination of information and supports mental health and well-being initiatives. By leveraging technology to address the challenges posed by the pandemic, Pando contributed to a more effective and resilient response to Covid-19 response and has aided in the recovery process.

  Tackling economic inequality

  While Pando primarily facilitates communication among clinicians, it indirectly contributes to tackling economic inequality by optimising healthcare delivery and resource allocation.; Firstly, by enabling efficient communication and collaboration among healthcare professionals, the app helps streamline clinical workflows and decision-making processes. This efficiency translates to improved productivity and reduced administrative burdens for healthcare providers, allowing them to dedicate more time and attention to patient care. As a result, healthcare services become more accessible and responsive, regardless of geographical location or economic status.; Pando supports continuing medical education and knowledge-sharing initiatives among healthcare providers. Through peer-to-peer communication and information exchange, clinicians can stay updated on the latest medical advancements, treatment protocols, and evidence-based practices, enhancing the quality of care delivered across diverse healthcare settings. This democratisation of knowledge empowers healthcare professionals, irrespective of their economic background or institutional affiliations, to deliver high-quality healthcare services aligned with best practices and standards of care.; Additionally, the app can facilitate mentorship and professional networking opportunities for healthcare professionals, particularly those from economically disadvantaged backgrounds or underrepresented communities. By connecting clinicians with mentors, role models, and career development resources, the app promotes career advancement and upward mobility within the healthcare sector, ultimately fostering greater diversity and inclusivity in the healthcare workforce.

  Equal opportunity

  Pando promotes equal opportunity within the healthcare sector by democratising access to information, fostering collaboration, and empowering healthcare professionals regardless of their background or circumstances.; Firstly, the app provides a level playing field for healthcare professionals to communicate and exchange information in real-time, irrespective of their geographical location or institutional affiliation. This open communication channel allows clinicians from diverse backgrounds, specialties, and practice settings to connect, collaborate, and share insights, breaking down traditional barriers to information access and professional networking. As a result, healthcare professionals, regardless of their socioeconomic status or institutional resources, have equal access to knowledge, treatment protocols, and best practices, empowering them to deliver high-quality care and make informed clinical decisions.; Pando facilitates mentorship and knowledge-sharing initiatives within the healthcare community, enabling experienced clinicians to mentor and support aspiring healthcare professionals, particularly those from underrepresented or disadvantaged backgrounds. Through peer-to-peer collaboration and mentorship programs, individuals facing systemic barriers to career advancement can access guidance, support, and professional development opportunities, leveling the playing field and promoting equal opportunities for career growth and advancement within the healthcare sector.; The app's role in facilitating continuing medical education (CME) and professional development activities promotes lifelong learning and skill enhancement among healthcare professionals, regardless of their background or tenure in the field. ; Overall, Pando promotes equal opportunity within the healthcare sector by democratising access to information, fostering collaboration and mentorship, expanding access to healthcare services, and supporting professional development initiatives. By leveraging technology to overcome traditional barriers and disparities, the app empowers healthcare professionals of all backgrounds to thrive, contribute, and succeed in an inclusive and equitable healthcare environment.

  Wellbeing

  Pando contributes to the wellbeing of healthcare professionals by offering a supportive platform for peer interaction, knowledge sharing, and stress reduction.; Firstly, the app fosters a sense of community and belonging among healthcare professionals, allowing them to connect with colleagues, share experiences, and seek emotional support in a secure and confidential environment. This peer interaction helps combat feelings of isolation and burnout often experienced in high-stress healthcare settings, promoting mental and emotional wellbeing among users.; The app serves as a valuable resource for accessing timely medical information empowering healthcare professionals to make informed decisions and deliver quality patient care. By facilitating quick and efficient communication, the app reduces the time spent on administrative tasks and coordination efforts, enabling clinicians to focus more on patient interactions and clinical responsibilities, thus alleviating work-related stress and enhancing job satisfaction.; Pando supports work-life balance by offering flexible communication options, allowing healthcare professionals to stay connected with colleagues and address urgent matters without being tethered to their workplace. This flexibility enables clinicians to better manage their time, reduce overtime, and allocate more time to personal activities and self-care, promoting overall wellbeing and preventing burnout.; The app can facilitate peer support groups, wellness initiatives, and mindfulness activities within the healthcare community, encouraging users to prioritise self-care, stress management, and mental health awareness. The app can contribute to a culture of wellbeing and resilience among healthcare professionals, ultimately enhancing job satisfaction, productivity, and retention rates within the workforce.; Overall, Pando plays a vital role in supporting the wellbeing of healthcare professionals by fostering peer support networks, facilitating access to medical information, promoting work-life balance, and supporting self-care initiatives. By addressing the holistic needs of healthcare professionals, the app contributes to a healthier, happier, and more resilient workforce, ultimately benefiting both individuals and the broader healthcare system.

Pricing

• Price: £8 to £10 a user a month
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at philip@hellopando.com. Tell them what format you need. It will help if you say what assistive technology you use.