MAGENTUS SOFTWARE LIMITED

econsent

Creation/management of digital patient consent to treatment forms. Service provides 2-way integration with EPR to combine selected patient demographic details with procedure risks, benefits and alternatives from library of over 2,000 procedures/treatments. These can be modified and produce a form tailored to the specific patient's needs. Two-stage consent is supported.

Features

• Fully browser based interface - device agnostic
• Cloud hosted
• Two way integration with EPR
• Patient and user context launch
• Database of over 2,000 procedures and treatments
• Secure remote patient access to consent information
• Digital signature capture
• Complete searchable audit log of system events
• Built in reporting suite
• Scheduled data exports for business analytics

Benefits

• Access via any browser with no need for client software
• Full integration with EPR provides 100% accurate patient details
• Save time with pre-population of risks, benefits and alternatives
• Dynamically change content to provide customised patient output
• Provides patient portal access and supports remote signing
• Use event log to track every consent workflow event
• Access consent form PDF from EPR or eConsent
• Realtime reporting of consents by speciality, procedure and user

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at uk-sales@magentus.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

630242772932312

Contact

Paula Hadley
07512 303299
uk-sales@magentus.com

About your service

• Service categories:

  Applications

  Content workflow and management

  • Capture
  • Document

  Content services

  • Enterprise Content Management Applications
  • Content Sharing and Collaboration Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: EConsent serves as an extension to the Trust EPR or PAS and can be launched in patient and user context from these systems. The system uses HL7 or FHIR integration to access patient demographic details and post back a PDF copy of the completed consent.
• Cloud deployment model: Private cloud
• Service constraints: The solution is offered as a fully hosted and managed solution within a private cloud\hosting provider. As a known solution offering there are no limitations\constraints to be aware of at this time.
• System requirements:
  • System offered as a fully hosted and managed solution
  • Hosted within private cloud/hosting provider

User support

• Email or online ticketing support: Yes
• Support response times: The standard support model for eConsent is 8am to 6pm Monday to Friday; 24hr support is available subject to further agreement. Tickets can be logged with severity levels 1 (highest) to 4 (lower).
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: EN 301 549
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: • eConsent is provided to our customers with a contracted level of support to meet their high availability and performance requirements. ; ; • This is provided under an annual support and maintenance fee, itself aligned to the volume of consents per annum required by the customer.; ; • In addition, the solution is provided in a Cloud hosted environment, again with an annual fee aligned to the volume of consents per annum required by the customer.; ; • All Magentus customers are provided with a Client Account Manager, while support for technical or cloud issues are provided by our experts to strict Service Levels under the terms of our customer contracts using our industry standard support desk processes.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Online training is provided via the Magentus Academy website which includes online training modules. These can also be integrated into SCORM compliant e-learning system. The website is accessible through a help button on the eConsent toolbar or direct URL link.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Any data requiring to be retained or exported for future use or reference will be exported from the system and supplied to the required end point in a secure manner in line with the client\new provider requirements.
• End-of-contract process: Any data requiring to be retained or exported for future use or reference will be exported from the system and supplied to the required end point in a secure manner in line with the client\new provider requirements.
• Documentation accessibility standard: EN 301 549

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Screens are dynamically re-ordered and re-sized down to a minimum workable width of 320 CSS Pixels to support lower resolutions on mobile devices. Content remains the same.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The eConsent user interface is fully browser based and can be launched either in a normal browser window or inline with the EPR application where the launching application supports this functionality.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: EConsent releases are routinely assessed for accessibility using web accessibility tools.
• API: No
• Customisation available: Yes
• Description of customisation: At a system level, administrative users have full control over procedure content and are able to customise default risks, risk categories, benefits, alternatives and links to additional content (either URLs or version controlled patient information leaflets). Users and specialities can be defined and minimum grade levels set for procedures to prevent the selection of inappropriate procedures. In addition, administrators can control access rights and set up document workflows to link separate consent and medical forms. All such customisation is accessible only to users with appropriate administrative rights. ; Individual users can set up personalised lists of frequently accessed procedures and set up a saved signature to "autosign" when an appropriate input device is not available. Users can also have a personalised contact number assigned which will be inserted into any consent forms they generate so that the patient can contact the appropriate office directly if required.

Scaling

• Independence of resources: Cloud hosted system resources are scalable based on current demand.

Analytics

• Service usage metrics: Yes
• Metrics types: Users can access a number of reports relating to consents generated (filterable by speciality, type and user), consent confirmation status etc. for a selected date range. The report information is a real time report on their live system data.
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Data extraction for business analysis purposes is included as part of system support and data is delivered in CSV format to an agreed secure endpoint.
• Data export formats: CSV
• Data import formats: Other
• Other data import formats:
  • Patient demographic data is imported with an initial PMI load.
  • And updated via HL7/FHIR imessaging.

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Magentus manages availability by an agreed uptime % of 99.9%, measured by running synthetic scripts on a reference workstation housed in the client's environment. The service is liable for service credits where the availability service level is not achieved, which increased on a sliding scale to recognise that as the system down time increases then the service liability becomes more significant and Magentus lose 1 % of the Support Charge as follows: Availability Service Credit 99.9% 0% 99 – 99.89 2.5% 98 – 98.89 5% 97 – 97.89 7.5% 96 – 96.89 10% 95 – 95.89 12.5% 94 – 94.89 15% 93 – 93.89 17.5% Less than 93% 20% The availability calculation will exclude permitted downtime (up to two hours per month) and shall be deemed available when the software is available on the reference workstation.
• Approach to resilience: The solution will be deployed on a IaaS platform, with any local failures being recovered from automatic with minimal loss of service. The solution is also replicated to another data centre to ensure restoration of service in the event data centre loss\failure.
• Outage reporting: The service is monitored 24/7 for performance and availability points, all alerts are reported to support team to resolve, with this being via a callout process outside of business hours.

Identity and authentication

• User authentication needed: Yes
• User authentication: Other
• Other user authentication: Clinicians - The system will be integrated with active directory, clinicians will therefore login with their AD credentials to create a new consent request.; ; Patients accessing their individual consent data via e-mailed link require confirmation of DOB plus optional password for login.
• Access restrictions in management interfaces and support channels: Users will be entered into a active directory group which will give them the appropriate permissions within the service, this could either restrict access of give them higher permissions.
• Access restriction testing frequency: At least once a year
• Management access authentication: Dedicated link (for example VPN)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials +
• Information security policies and processes: Magentus follows the policies laid down under ISO 27001, Cyber Essentials +, with security monitoring tools of the solution rapid7 and CrowdStrike reporting within a tiered process to SecOps and being looked at and resolved within their status.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: The service will be monitored for performance and security points, using tools to report issue back to Magentus. Any points requiring a change to the service will be done via a request for change process which is a documented procedure. ; ; Should any change requirements need a change to the code and therefore a new release of the software a release process will be followed which includes security check points SAST and DAST with OWASP as part of this. ; ; General alerts for technicalities used within the solution are checked, track presented for risk assignment and resolution by the Magentus SecOps team.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: CrowdStrike is used. These are monitored by Magentus 24/7 via the Sec Ops team. These tools include ratings for criticality, based on things like CVSS scores, and triage is performed by the Sec Ops team. A documented process will be followed to confirm the alert, record and report, determine categorisation, notify key stakeholders, resolve, and patch. Patches will be completed within an agreed request for change process as required, or within an agreed maintained window dependent on categorisation and approval for change.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Monitoring tools used on our solutions are refreshed with new potential compromises with alerts being created for our security teams as they are identified as possible risks. All risks/incidents are managed immediately at the time they are identified.
• Incident management type: Supplier-defined controls
• Incident management approach: Magentus Service complies with BS ISO/IEC 20000-1:2018. Predefined common events such as changes are controlled using our CAB process. ; Magentus provide a Service Model document describing how users can raise tickets for incidents. Incident reporting takes the form of periodical Service Review meetings as per contract.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Bsi
• ISO/IEC 27001 accreditation date: Sunday 21 April 2024
• What the ISO/IEC 27001 doesn’t cover: Not applicable - all delivery of software and services is covered by our ISO 27001 certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Bsi
• ISO 9001 accreditation date: Tuesday 6 February 2024
• What the ISO 9001 doesn’t cover: Not Applicable - all delivery of software and services is covered by our ISO 9001 certification.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: Fedd0141-a128-442c-b2b3-50b94fc8b361
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at uk-sales@magentus.com. Tell them what format you need. It will help if you say what assistive technology you use.