PENPOLE CONSULTING LTD

Hybrid Mail

NHS organisations send huge volumes of costly physical mail with mail needing to be printed, folded, inserted in an envelope and franked - then taken to Royal Mail. Our proven Hybrid Mail solution provides a single fully integrated Portal from which all patient communications can be managed, sent and audited.

Features

• Solution already proven and live within thirty NHS providers
• Any host or mail application will work with Hybrid Mail
• Letter templates are standardised and NHS compliant
• Securely hosted within our client’s network
• Single easy to use application for all patient communications
• Plug-in for Microsoft desktop applications (e.g. Word)
• Interfaces with any EPR or Portals (PKB, NHSApp etc.), DocMan
• Easy to use real-time and comprehensive Reporting
• GDPR and NHS Compliant (DPIA/DTAC/CSCR/HL etc.)
• Proven ROI with little, to no, up-front capital spending required

Benefits

• Quicker deployments achieved by leveraging previous lessons learned
• An average 42 pence per letter saving versus in-house printing
• Proven reductions in both DNAs and Waiting Lists
• Improved patient safety due to removal of local printing errors
• Unique suite of proven IG documentation will aid use
• Unique suite of proven letter templates will improve Patient communications
• Comprehensive Reporting ensures all letters are sent and are auditable
• Read receipts and RTSs inform alternative communication attempts
• Maximises clinics and clinicians' capacity and efficiency
• Administrative resource and infrastructure can be reallocated and reallocated

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at psopportunities@penpole.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

471375633350532

Contact

Alex Franklin
07872598605
psopportunities@penpole.co.uk

About your service

• Service categories:

  Applications

  Content workflow and management

  • Document

  Enterprise portals and digital workspaces

  • Multi-Audience Portals
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Hybrid cloud
• Service constraints: Compatible with any Windows application that can print.
• System requirements:
  • Windows Operating System
  • Office 365

User support

• Email or online ticketing support: Yes
• Support response times: Between 15 mins and 1 hour, depending on severity. ; ; Days of support are Monday thru Friday excl. English National Holidays, 08:30 - 18:00 GMT.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Issues are classified under Severity Levels 1-3:; ; Severity 1. Problems which may be described as catastrophic which (based upon the Funasset’s reasonable opinion at the time of the request using its knowledge and experience and reasonable skill and care) do or are likely to materially and negatively impact on the Customer’s ability to meet its cut off time to Mailing Items delivered into Royal Mail (e.g. where the Solution is down or the Solution is operating slowly or the Customer has no or limited critical application production capability) will, in general, be allocated to this severity level.; ; Severity 2 Any failure which is not a Severity 1 failure and is a failure of a major function in normal operation which is unusable and (based upon the Funasset’s reasonable opinion at the time of the request using its knowledge and experience and reasonable skill and care) there is an awkward work around or any other function is unworkable and there is no known work around.; ; Severity 3 Any major or minor function failure of the Solution that is not a Severity 1 or Severity 2, which is unworkable, and there is an effective workaround.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We put together a bespoke implementation plan with the customer to work through the initial setup and configuration required. ; ; In addition, downloadable and up-to-date Quick Reference Guides are accessible from our webpage. ; ; Knowledge Base: an extensive library of answers to frequently asked questions is also available. ; ; On-site and remote training, standard and premium support models. Extensive client onboarding and super user training are also features within our service model.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: We have a sixty-day retention period for client-held data, meaning a letter and communications archive. ; ; Beyond the sixty days, customer data will be deleted. We can provide customers with the last sixty days of letters/communications sent via the portal before the contract ends, but this isn't likley to have any practical value to them.
• End-of-contract process: When the contract ends, the system is turned off sixty days after the contract end date. There is no additional cost to this. Due to the nature of this product and service, no data export or migration is typically required.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems: Windows
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The service interface is a web browser that can be accessed from any Windows PC. It can be viewed on mobile device but is optimised for desktop. There is also a print client that can be used within microsoft word.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We are committed to ensuring the Hybrid Mail web portal is accessible, inclusive, and usable for all users. We continuously improve the service in line with Web Content Accessibility Guidelines (WCAG) 2.2 AA and universal design best practices.; ; The portal is designed to be easy to see, navigate, and interact with using a mouse, keyboard, or touch interface. We provide text and visual alternatives for audio content, text alternatives for visual elements, and support for assistive technologies including JAWS, NVDA, Dragon NaturallySpeaking, and VoiceOver. The service also supports native accessibility features on mobile devices and tablets.; ; To support blind and low-vision users, the interface uses minimal imagery, predominantly text-based layouts, clear fixed structures, and meaningful link text. Pages are semantically structured using HTML headings to ensure compatibility with screen readers and to aid navigation.; ; The portal is tested using automated accessibility tools, including Siteimprove, and we actively work with users who have accessibility needs to improve usability. We support current and previous versions of major browsers (Edge, Chrome, Safari, Firefox) and assistive technologies.; ; Users can adjust text size and display settings using standard browser controls. Feedback is welcomed to help us continually enhance accessibility for all users.
• API: Yes
• What users can and can't do using the API: An API is used for the delivery of documents into the hybrid mail solution. Often from the client's PAS / EPR system.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: The service is hosted within VmWare enviroment that allows automatic assigning of required resources as it's called for. The system flexes to mange the load with the option of adding additional server side resources as needed.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics of overall use are frequently produced and can be further broken down to the department/service level, and then further down to the individual user level as required.
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Funasset Limited

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Regular weekly/monthly usage reports of the service are produced which a client can keep copies of.; ; Data is deleted at the end of the contract term.; ; Online access is available for another 60 days after contract end, so clients can pull information they like from the system while there is still data to view.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats:
  • CSV
  • Other
• Other data import formats: PDF

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The HybridMail service is delivered in line with robust, measurable service levels covering system availability, print and mail operations, customer support, and performance management. The HybridMail end-user web client, servers, website, and supporting network infrastructure are each provided with 99.98% availability over any 12-month period, excluding agreed scheduled maintenance. Unplanned downtime will not exceed 8.7 hours annually.; ; Print and mail services are operated to defined operational standards. 100% of mail items received by the agreed cut-off time are processed and passed to downstream postal providers within agreed timelines. Postal hand-off accuracy, billing accuracy, and customer support availability are maintained at 100%, while printing accuracy is maintained at 99%. Returned mail is scanned into the system within 24 hours, and management information is delivered by the fifth working day of each month with 98% accuracy.; ; Complaints are acknowledged within 24 hours, with mitigating actions advised within 48 hours, achieving 98% compliance. Printing and finishing equipment availability is maintained at 99%, with international mail collection and postal provider delivery accuracy at 99.5%.; ; Service levels and KPIs are reviewed monthly. Where service levels are not met, a jointly agreed rectification plan is implemented, with service credits or rebates considered if performance issues recur.
• Approach to resilience: Available on request.
• Outage reporting: Email alerts. And direct communications with the customer.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Penpole restricts access to management interfaces and support channels using role-based access control and the principle of least privilege. Administrative access is limited to authorised personnel with defined responsibilities and is protected by strong authentication, including multi-factor authentication where supported. Access to support systems is restricted to approved users and monitored through audit logging. Privileged activities are logged, reviewed, and subject to regular access reviews. Secure channels are used for remote administration and support, with session timeouts and segregation of duties enforced to reduce the risk of unauthorised access or misuse.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISO 27001 but need to add in security processes and policies
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We operate a formal configuration and change management process aligned to CSA CCM v4.0. All Hybrid Mail components, including infrastructure, applications, integrations, and configurations, are uniquely identified, version-controlled, and tracked throughout their lifecycle using a central configuration management system. Changes are raised through a controlled workflow, assessed for operational and security impact, and reviewed against confidentiality, integrity, and availability requirements. Security assessments include vulnerability, dependency, and access control analysis prior to approval. Changes are tested in segregated environments, authorised by designated approvers, and implemented with audit logging, rollback procedures, and post-implementation review to ensure continued compliance and service integrity.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Our vulnerability management process aligned to CSA CCM v4.0 to protect the Hybrid Mail service. Potential threats are identified through continuous vulnerability scanning, configuration reviews, penetration testing, and risk assessments covering infrastructure, applications, and third-party components. Threat intelligence is sourced from NCSC advisories, vendor security bulletins, CVE/NVD feeds, CSA guidance, and NHSE alerts. Vulnerabilities are risk-rated using CVSS and business impact. Critical and high-risk vulnerabilities are prioritised and remediated through patching or mitigation, with critical patches deployed within defined SLA timescales, following testing in controlled environments. All actions are logged, tracked, and reviewed to ensure ongoing security and resilience.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: We operate protective monitoring aligned to CSA CCM v4.0 to safeguard the Hybrid Mail service. Security events are continuously monitored using centralised logging, alerting, and correlation across infrastructure, applications, and network components. Potential compromises are identified through anomaly detection, access monitoring, integrity checks, and alerting on suspicious or unauthorised activity. When a potential compromise is detected, incidents are triaged, contained, and investigated in line with our incident response procedures, including isolation of affected components and evidence preservation. High-severity incidents are responded to immediately, with defined escalation, customer notification, and remediation actions to restore services securely and promptly.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Penpole operates a formal incident management process to ensure timely, consistent resolution of service issues. Pre-defined procedures exist for common events, including service outages, security incidents, data issues, and performance degradation, with clear roles and escalation paths. Users can report incidents via the Hybrid Mail service desk by telephone or email during supported hours, or through agreed out-of-hours arrangements. Incidents are logged, prioritised, and tracked to resolution. Customers receive regular status updates during incidents and are provided with post-incident reports detailing root cause, impact, corrective actions, and any preventative measures implemented.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: Wednesday 21 June 2023
• What the ISO/IEC 27001 doesn’t cover: Nothing. The Development, production and sales of document management software, printing solutions and custom software are all in scope.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: BSI
• ISO 9001 accreditation date: Saturday 7 February 2026
• What the ISO 9001 doesn’t cover: Nothing. The Development, production and sales of document management software, printing solutions and custom software are all in scope.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 0836389d-1f91-4157-8906-941b37c618da
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at psopportunities@penpole.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.