C2-Ai CRAB Clinical Informatics

C2-Ai RiskTriage

C2-Ai RiskTriage risk stratification supports the improvement of the hospitals management of patient treatment list (PTL) using an Intelligent System AI that will provide predicative and operational decision support for clinicians and managers. The implementation of C2-Ai RiskTriage risk stratification tool be for elective patients waiting for surgery or procedure.

Features

• Interactive live database for PTL management
• Standardise approach for prioritisation and validation of elective PTL
• Support clinical equitability (including social determinants of health)
• Reduce administration time by reducing manual processes, rework and cancellations
• Reduce average RTT waiting time through effective prioritisation
• Strategic capacity planning based on paients greatest need and risk
• Reduce potential complaints or litigation from patients due to delays
• Risk adjusted surgical deaths and complications at specialty level

Benefits

• PTL – quality assurance system, Lower patient harm and mortality
• ~ 125 bed-days saved per 1,000 patients
• Up to 8% reduction in emergency admissions from PTL
• More detailed view of clinical risk for each patient
• Optimisation of sites to and routing across trusts/regions
• Support to identify which patient to optimise prior to operation

£100,000.00 a licence a year

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at c.bale@c2-ai.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

562603393510868

Contact

Claire Bale
02081446967
c.bale@c2-ai.com

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Yes, but can also be used as a standalone service. This is the most common approach for rapid implementation as no integration is required
• Cloud deployment model: Private cloud
• Service constraints: None
• System requirements: Templated excel data format is required for consistent data quality.

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: As soon as possible, working week Monday - Friday
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Onsite support
• Support levels: Standard support for all clients/ contracts provided as part of service. ; Clinical support provided by client account manager.; IM&T technical support engineer.; ; Additional tailored support can be negotiated on a case by case basis.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Onboarding pack. ; User guides - PDF format ; User guides - video format; Online video training
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
  • Other
• Other documentation formats:
  • Powerpoint
  • Excel
  • Word
• End-of-contract data extraction: C2-Ai decommission the databases and provide data destruction certificate.
• End-of-contract process: C2-Ai decommission the databases and provide data destruction certificate if deemed appropriate.; The offboarding plan for this Call-Off Contract is:; Destruction of data on live systems; For analysis, data is kept on controlled live systems for a period defined in the data processing agreement. Once it is deemed that data should be removed from live systems, the data is deleted using standard file deletion policies. This prevents its continued use in the organisation. Following deletion, a certificate is issued and stored in the supplier-side asset register.; System decommissioning; When a system is decommissioned, either due to the end of a job or because the server or drive is being depreciated, then the drives will all be cleared using a routine such as Kill Disc. The routine will be run for the recommended number of times to provide reasonable confidence that all data have been removed and cannot be re-accessed. A certificate will be issued and stored in the supplier-side asset register. If a data drive is not to be reused, it will then also be destroyed physically before disposal, and a photograph of the drive stored with the media destruction certificate in the supplier-side asset register.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Automated Weekly Monthly data loads need to be configured at the beginning of the rollout. ; CRAB Analytical Reports available on demand, or as per users requirements.; PTL database available for manipulation at will.
• Accessibility standards: None or don’t know
• Description of accessibility: Web based
• Accessibility testing: DCB 0129 certified, ; Multiple publications of software algorithm validation
• API: No
• Customisation available: Yes
• Description of customisation: Report Outputs can be customised, if approved by buyers Top Management/ Executive team. ; Approval required from C2-Ai account manager.

Scaling

• Independence of resources: User accounts limited per contract.

Analytics

• Service usage metrics: Yes
• Metrics types: CRAB metrics (guide provided); PTL metrics (guide provided)
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Other
• Other data at rest protection approach: All systems use AES 256 end to end, BitLocker encryption is used on Windows 10 Pro clients. Server data is encrypted with BitLocker or VeraCrypt encryption. File and database backups are encrypted using server certificates. Key coded encrypted USB devices available if required.
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Data hosted in C2-Ai systems are deleted. All C2-Ai reports that have been shared through out the duration of contract are kept by the user for their records.
• Data export formats: Other
• Other data export formats:
  • Excel
  • Powerpoint
  • PDF
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • IPsec or TLS VPN gateway
• Data protection within supplier network: Other
• Other protection within supplier network: VPN; Duo Security Code

Availability and resilience

• Guaranteed availability: Limited outage
• Approach to resilience: All systems use AES 256 end to end, BitLocker encryption is used on Windows 10 Pro clients. Server data is encrypted with BitLocker or VeraCrypt encryption. File and database backups are encrypted using server certificates. Key coded encrypted USB devices available if required.; Secondary data back up site.
• Outage reporting: IM&T provider L2S2 report outages to C2-Ai.; Email Alerts

Identity and authentication

• User authentication needed: Yes
• User authentication: 2-factor authentication
• Access restrictions in management interfaces and support channels: User accounts are agreed by the client on purchase of C2-Ai systems. User accounts can be permissioned at various levels to restrict access to some/all sensitive areas of C2-Ai reporting. Accounts can be amended/added to at any time at express written request from the client
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: July 2021 BSI ISO 27001:2013 visit and inspection.
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • ISO 27001
  • NHS Digital DSPT Standards Met

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISO 27001,; ISO 13485 ,; ISO 9001,; ICO registered ,; NHS Digital Data Security and Protection Toolkit ‘Standards Met’ certified. Cyber Essentials certified

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: ISO 27001; ISO 13485; ISO 9001
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerability scans to the website as per schedule including NCSC web checker. Full penetration test scoped for completion by July 2022 (L2S2 ISO 27001:2013 audit). All networking components have the default passwords changed on immediate use. This is as per ISO 27001:2013 standard and Cyber Essentials managed by an outsourced IT provider.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Trend Micro Network Security implemented across servers and networks.; L2S2 implements secure configuration, build steps and ongoing patching ; applied. All clients utilise Windows 10 Security and updates, with daily ; antivirus scanning enabled. Servers are protected with scheduled updates, Trend Micro Deep Security set to scan daily. EAL4 firewalls for hosting centre used and Total & Basic Security Suites applied, automatic antivirus updates, pattern learning and security tools utilised on firewalls. Trend Micro Network Security used on environments.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Conforms with ICO policy.; 'C2-Ai Incident Management Policy' details predefined process and how to report incidents. Incident reports available through company shared space, in MS.word form.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • NHS Network (N3)
  • Health and Social Care Network (HSCN)

Social Value

• Social Value:

  Social Value

  Covid-19 recovery

  Covid-19 recovery

  Support to reduce the elective surgical waiting list backlog, significantly impacted by COVID-19. ; C2-Ai’s RiskTriage Prioritisation System automatically delivers the detailed clinical risk needed to prioritise complex waiting lists.; Manual prioritisation is time-consuming but still leaves thousands if not tens of thousands of patients in the same priority category. Up to 15% of patients may be in the ‘wrong’ category and there is no mechanism to prioritise them across patients in the different specialties and potentially in different sites.; The right patient, the right place, the right time.

Pricing

• Price: £100,000.00 a licence a year
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: £50k trial of full PTL service

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at c.bale@c2-ai.com. Tell them what format you need. It will help if you say what assistive technology you use.