THALAMOS LIMITED

Thalamos eMHA Platform

Thalamos' eMHA Platform provides an end-to-end digital Mental Health Act care pathway. It supports digitised MHA documentation, workflows, reporting and 3rd party integrations.
Deploying the Thalamos platform provides demonstrable care & clinical safety improvements, administrative & clinical efficiency savings and delivers a more patient centric approach to the MHA.

Features

• Digital MHA Forms for all MHA Sections
• Roles Based Access Control plus Administrative and Analytics roles
• Pre-programmed workflow support tools & notifications
• Patient MHA status and associated workflow, notifications and alerts
• Advance Choice Documents and care planning
• EPR and ePMA Integrations & Local customisation
• Advanced Dashboarding and Reporting across teams, organisation and regions
• Error reduction support
• Secure encrypted transfer and storage of MHA Forms and data
• Statutory Approvals automatically checked with DHSC

Benefits

• Swifter access to care for individuals in crisis
• Swifter access to treatment for patients
• Patients discharged 1 to 2 days sooner
• Documented significant reduction in Unlawful Detentions
• Documented >97% reduction in rectifiable errors
• Documented clinical time saving of >1 nursing shift /week
• Seamless multi-agency working in community settings
• Improved information governance compliance
• Delivers population data to inform system wide decision making
• Complete MHA pathway visibility for individuals across services

£50,000 a licence

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at arden@thalamos.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

619279851294912

Contact

Arden Tomison
0203 886 0385
arden@thalamos.co.uk

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Thalamos is a cloud-based web application hosted on the public internet meaning an internet connection is required to access and use the platform. An internet connection may be achieved via cellular network, local wi-fi or a cable internet connection. ; ; Thalamos commits to >99.9% up time. ; ; Support for Users is available across any device, via phone, in app chat or email.
• System requirements:
  • Internet Access
  • Web browser

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Acknowledgement: ; ; Monday - Friday 06:00 - 22:00 - 2 hours response time ; ; Monday - Friday 22:00 - 06:00 - by 8am the following morning ; ; Saturday - Sunday - 6 hour response time ; ; Diagnosis: ; ; Monday - Friday - 8 Hours ; ; Saturday - Sunday - 24 Hours
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: No
• Onsite support: Onsite support
• Support levels: Support levels Thalamos provide three tiers of support: ; ; 1. Comprehensive help centre including "how to" videos and articles on specific features and functionality. ; ; 2. Online training. Bespoke training provided for individual specialisms. Regular top-up training also provided. ; ; 3. On-site training and support may be provided on request. ; ; All support and training is provided at no additional charge. It will be delivered by your dedicated Thalamos Account Manager and senior members of the Thalamos Team.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: The Thalamos onboarding process is a standardised 12 week process designed to engage all stakeholders, define local policy guidance and deliver local training. ; ; On-site and or online training is provided to each specialism. All new users receive a comprehensive "welcome pack" including bespoke local policy guidance, how to guides and training videos. ; ; A comprehensive help-centre is also available for new and existing customers to help with familiarisation. ; ; Web based top-up training sessions are held regularly and open to all. Typically these are attended by those who were not able to join initial training sessions or who have joined the Trust at some point after Thalamos go-live. ; ; Further training sessions are offered to all customers in advance of any significant new feature deployment.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
• End-of-contract data extraction: Thalamos is not designed as a core record solution. It is a supplementary module to the core record system and all PDF form data should be written back to the core record used by the organisation. Data dan be exported from the system by the organisation in other formats Thalamos will retain all data entered into its service for the duration of the contract with the organisation using the service. If the contractual relationship runs for more than 20 years then Thalamos retains the data for 20 years since the last event of care. ; ; At the end of a contract users should ensure that they have downloaded all data held within Thalamos. This may be downloaded simply and from within the application in PDF format and in CSV All identifiable data will be deleted 28 days after the close of the contract.
• End-of-contract process: At the end of a contract the Thalamos Team will support clients and users to safely bring the contract to a conclusion. This will include ensuring all special category data has been downloaded onto local record systems and ensuring that all user accounts are closed. ; ; All data held within the Thalamos platform will be deleted after a period of 30 days. At this point accounts will no-longer be accessible or usable by customers. ; ; An invoice/credit note is issued within 30 days to cover any under/over usage following the end of the contract.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: There is no difference in functionality between desktop, tablet or mobile.
• Service interface: No
• User support accessibility: WCAG 2.1 AA or EN 301 549
• API: Yes
• What users can and can't do using the API: All system operations which are available in the UI are available over API. There are also be some additional 'API only' operations such as bulk administration of users/teams/organisations available to API partners - these are all documented in the same way.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: NHS Trusts and Local Authorities using Thalamos may request for specific local information, such as Hospital Wards and Departments, and/or features to be added to the platform. Single Sign On can be configured using Azure AD / ADFS / OAuth2 / SAML protocols connecting to a Trust or Local Authority identity solution.; ; This customisation is generally undertaken during the onboarding phase. Further customisation is available on request. ; ; All customisation is undertaken by the Thalamos Team though it may be requested by client project leads.

Scaling

• Independence of resources: Thalamos eMHA is redundantly deployed on Amazon Web Services public cloud in its ‘Elastic Container Service’ offering. ; ; Scale up happens automatically based on usage. As the number of users increases, the service will automatically scale up to add the requisite number of app services required to manage the load.. ; ; This is monitored to ensure there is consistent capacity in the solution.

Analytics

• Service usage metrics: Yes
• Metrics types: Bespoke reporting frameworks are agreed through the onboarding process. ; ; Reports are developed around the care quality improvements clients are seeking to achieve through the use the Thalamos Platform. ; ; Individual client dashboards are created to provide near real time visibility.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Users may export special category data from Thalamos by downloading documents in PDF format. Users may request a CSV of meta-data visible to Thalamos and connected to their account directly. This will be shared within 72 hours of formal request. Thalamos does not routinely have access to any identifiable patient data unless instructed by the client.
• Data export formats:
  • CSV
  • ODF
• Data import formats: Other

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Thalamos eMHA uses Amazon Web Services and we guarantee availability 99.9% of the time.
• Approach to resilience: Thalamos uses a load balancer to manage any failure without downtime. The application is always redundantly deployed across at least two different data centres within Amazon Web Services . A real time alert system is in place to notify us of any outages or system failures. ; ; Further information available on request.
• Outage reporting: - Service outages will be reported via an email alert and a warning message. ; ; - Public service availability page including system status and issue reporting; ; - Full outage logs will be shared on-demand.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Username or password
  • Other
• Other user authentication: Users General Medical Council number and statutory approvals are automatically checked with Department of Health and Social Care
• Access restrictions in management interfaces and support channels: Thalamos software does not contain management interfaces or "super-users". Individual users or organisations do not have direct access to APIs or similar. ; ; Procedural changes or customisation may be requested by organisational leaders. Authentication and verification is conducted manually by Thalamos management.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications:
  • Cyber Essentials Plus
  • NHS Data Security and Protection Toolkit
  • Crest approved penetration test

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: Cyber Essentials Plus; NHS Digital Data Security and Protection Toolkit
• Information security policies and processes: NHS Digital Data Security and Protection Toolkit - Reference 8KG88 ; ; Security policy is shared with each employee on joining, and after each update. Employees undergo training in GDPR and Information Security. ; ; Contracted, external Data Protection Officer appointed to review all data protection policies. ; ; Contracted, external Clinical Safety Officer appointed to review all security policies associated with clinical safety. ; ; All potential security concerns are reported to CTO and CEO. ; ; A security incident log is maintained and reviewed regularly.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All feature changes and bug fixes are tracked via project management software. ; ; - Git-Hub code repository delivers full audit trail for code changes, down to individual technician level. ; ; - Full pre-deployment code review, testing and approval by all functions in Thalamos (QA, client team, senior management, development, clinical safety).
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Application dependencies are continually assessed against known vulnerabilities. ; ; - Identified vulnerabilities will be prioritised and addressed immediately in accordance with their severity and impact on the product. ; ; - Reports may be shared with clients on request. ; ; - Information is derived from OWASP TOP 10 web application security risks and an annual assessment of the product is undertaken against this.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: - Amazon Web Services ‘Web Application Firewall’ sits in front of all services. ; ; - Real time alerts of web application and database ; ; - Senior management included in alerting process. ; ; - Compromises are identified via Amazon Web Services ‘Guard Duty’ which monitors traffic at the network layer inside our Virtual Private Cloud. ; ; - Identified compromises are immediately addressed and deployed by full time development team. ; ; - Target fix time for any priority 1 compromise is 6 hours.
• Incident management type: Supplier-defined controls
• Incident management approach: Integrated incident reporting and management software deployed to manage all inbound incidents. Process of escalation in place to bring in senior management and technical leadership where required ; ; - Users may report incidents via phone, email or in-application chat feature. The channels are monitored 20 hours / day. ; ; - Incident reports are feedback to users via a semi-public knowledge centre accessible from within the application.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Equal opportunity

  Fighting climate change

  Supports work from home practices: Digitising MHA pathways allows flexible working practices. MHA admins can access, scrutinise and request amends while working from home. This reduces energy consumption by eliminating the need to travel to and from work. ; ; Reduces use of Trust/Organisation buildings: Flexible work from home practices also reduces the need to use Trust/Organisation building as offices for Admin functions and support. This reduces need to heat and power buildings, reducing energy and fuel consumption. ; ; Sustainable models of care: Reduces or eradicates need to travel to deliver and amend forms: AMHP teams reported having to travel at least 90 mins to manually amend paper forms. Trusts reported an error rate of 25% across all sites and LA. This means for Trust AMHP teams alone, based on 600 admissions in 2022, Thalamos saved 225 hours of car journey’s which is 2.84 Metric Tons of CO2. ; ; Reduces or eradicates the need to use paper and stationary: Moving to a digital pathway reduces the need for printing paper copies of forms for scanning and sending, or for stationary for completing and filing these forms. Based on a Thalamos estimate of 5 forms per admission, and 2 sheets of paper per form, Thalamos could save DHC 34kg of CO2eq per year.

  Equal opportunity

  Thalamos is a “For Profit For Purpose” organisation. Written into our Articles of Association is our Social Value statement. This means that our social values have legal equity to our commercial responsibilities.; ; Thalamos’ core purpose is to provide improved patient outcomes in the assessment and treatment of mental illness. We achieve this by creating software which makes access to and receipt of care under the MHA demonstrably swifter, simpler and safer for the individual patients and their communities. To ensure that Thalamos’ products deliver a net benefit for patients we have developed a bespoke “Responsible Innovation by-design” approach. Thalamos consider Information Governance, Clinical Safety & Lived Experience at the outset of a new feature design, to enable updates to the product development process and designs as required. Lived experience is an integral part of all feature review processes, through our Lived Experience Consultant, Steve Gilbert (OBE). ; ; Thalamos’ responsible hiring policy commits the team to run fair and transparent recruitment processes which expressly consider equal opportunities and diversity. Our advertising and interview practices seek to mitigate unconscious bias throughout the recruitment process. Thalamos is committed via our Equality & Diversity Policy to publish annually our gender pay gap. An annual diversity, inclusion and wellbeing audit is conducted. A comprehensive induction training programme is provided to Thalamos employees helping them swiftly assimilate to the highly sensitive nature of our work, including a focus on Lived Experience led role plays.

Pricing

• Price: £50,000 a licence
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at arden@thalamos.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.