CLERIC COMPUTER SERVICES LIMITED

Electronic Patient Record (Ambulance)

Digital record of care given to the patient, including key information about the episode of care (demographics, primary and secondary assessments, observations, treatments, clinical impressions, notes and clinicians), onward referral or conveyance.
Online and offline fully synchronised working, replacing handwritten paper notes.
Integrated with multiple NHS systems, reducing duplication

Features

• Accurate data collection, real time links to external data sources
• Increased input speed inc optimised data capture of case elements
• Secure data capture and storage of patient information
• Unlimited case length data onto the case record
• Real time synchronisation to hospitals, EOC, clinicians, other stakeholders
• Post-event synchronisation to external stakeholders, GP, Coroner, Patients
• AED data imported into observation or treatment data
• Supports defined standards eg NEWS2, PEWS, Sepsis etc
• Clinician to clinician video consultation
• Proven resilient and highly scalable performant platform architecture

Benefits

• Web based solution ease of deployment and seamless system updates
• Multi-user role based access, Trust configurable (unlimited number of roles/groups)
• Full offline working where ambulance staff don’t have comms coverage
• Integrated with multiple systems, reducing duplication of recording information
• Multi (and open) API support
• Dedicated test and training systems
• Agile approach to system developments and enhancements
• Flexible and cost effective system license model options
• Trusted, proven used extensively and at scale by NHS Services

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at admin@cleric.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

660057992177522

Contact

Liz Worthy
01260 270433
admin@cleric.co.uk

About the service

• Service categories:
  • Applications
    • Production and operations
      • Service industry and public sector operations
        • Healthcare
        • Education
      • Other operations
        • Other operations
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: The system is highly resilient and designed to operate 24 hours per day/365 days per year with high system availability.; System updates are planned in with customers.
• System requirements:
  • Systems are based on a defined number of licences.
  • Licence numbers can be adjusted by agreement.

User support

• Email or online ticketing support: Yes
• Support response times: Support is available via a dedicated Service Desk which operates Monday to Friday 09:00am - 17:00pm.; Out of hours (24 hours) cover is included within the annual cost.; 1. Emergency - (P1) System Unusable - 1 hour response. Fixed within 4 hours.; 2. Urgent - Important features not working etc -2 hour response. Fixed within 6 hours.; 3. Limited Impact - Inconvenience rather than restriction - 8 hour response. Fixed within 48 hours.; 4. Non urgent - Minor fault/no inconvenience - 24 hour response. Fixed and deployed in 3 months.; Emergency 24/7/365 support
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes
• Support levels: Support is available via a dedicated Service Desk which operates Monday to Friday 09:00am - 17:00pm.; Out of hours (24 hours) cover is included within the annual contract.; Priority 1 - 1 hour response, 4 hour fix; Priority 2 - 2 hour response, 6 hour fix; Priority 3 - 4 hour response, 35 hour fix; Priority 4 - 7 hour response, fix within 3 months or next release; All costs are included in the annual license charge.; A nominated technical manage is assigned to each contract
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Included within the one off annual license costs, customers are fully supported throughout the implementation process by an experienced team including a dedicated project manager, development, support and technical professionals. Training can be provided on site at our own training offices, at the customers own premises or via online sessions as agreed with the customer. Assistance can be provided with localized training guides. Full onsite support is included during system go live(s)
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: Data which has been cloud hosted can be returned to the user by means of CSV files. Customers may request alternative file types. Customer system administrators (authorised) can also extract data using the inbuilt data management tools. Full auditing is in place.
• End-of-contract process: Data is returned to the customer on request; there is no additional cost for this. All other data held is destroyed and disposed of securely.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The solution includes:; 1. ePCR web based application front line Clinicians); Our fully web based solution is device agnostic, works on a wide range of devices including iOS, Android and Windows. The solution includes a full 'offline' working mode, should the user drift in/out of coverage. When back in coverage, all changes are fully synchronised back to the central resilient database.; 2. ePCR web based online portal used by System Administrators, Trust Managers and Audit Teams; 3. ePCR web based online 'access' portal for 3rd party record access and patient access where required.; All functions work of standard web browsers.
• Service interface: Yes
• Description of service interface: The system is provided as a secure, web-based service accessed via a standard internet browser. Users authenticate through a controlled login and are presented with role-based interfaces aligned to their operational responsibilities. The service enables real-time access to booking, journey, and vehicle data, along with tools for planning, management, and reporting. No local software installation is required. All data exchanged between the user and the system is encrypted in transit. The service is hosted and managed by the software provider and is available 24/7, subject to planned maintenance windows.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Implemented at the customer level, with support given and tailored to individual circumstances
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: As a leading supplier of emergency and non-emergency systems, the system connects to external agencies via NHS agreed protocols such as FHIR, ITK, XML TIE, HL7. Our ePCR solution integrates with a wide range of NHS Systems including:; ; • Post Incident Event Messaging ; • Direct appointment booking with GP systems (System One, TPP, EMIS and Adastra); • GP Connect / Care Connect, GP appointment booking, referrals to UTC via BaRS; • NHS number lookup via National Spine (via full service check name) and MINI broker services; • NCRS (in development), SCR/CP-IS, Patient Flags (RA, CP-IS); • Electronic messaging to Social Care teams (Safeguarding); • NHS Mail (and messaging via SMS); • Hospital PAS Systems; • Graphnet, Better Urgent Care Records, Medical Interoperability Gateway (MIG); • GNCR (Cerner) - Shared Care Record (NEAS), OneLondon (Cerner) - Shared Care Record ; • EPS DoS - DoS - must be used to find EPS pharmacies; • Docman Connect - Secure document transfer ; • XMLTIE - Interface to HIE / TIE via static file - pushes data to hospitals and shared care records ; • BetterCare - Shared Care Records ; • Zoll Monitor - Reading patient vital signs
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The system includes multiple configuration options to to meet the varying needs of our customer base. We work in partnership with each customer / organisation to ensure that the solution configuration meets their operational requirements. The solution is fully configurable.

Scaling

• Independence of resources: Designed and scaled to exceed the contracted number of users and predicted growth in activity levels, including during times of increased ‘unplanned’ activity. System design and scaling is based on over 35 years experience, across both Ambulance customers and private providers services to provide a baseline required specification. All systems are load tested beyond expected maximum load levels, testing includes a range of system interface simulators. Virtual separation of resources ensures customer systems operate at their optimal level

Analytics

• Service usage metrics: Yes
• Metrics types: Monthly service usage and performance reports are reviewed with customers as part of the standard contract monitoring process. ; Metrics include:; 1) Service availability (up time); 2) Adherence to the agreed service levels for reported incidents; 3) Review of any in progress incidents (tickets); 4) Updates on any outstanding service requests, including change and development requests; 5) Review of completed incident and service requests; 6) Updates on monthly preventative maintenance activities; 7) Future planed maintenance activities
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Customer system administrators (authorised) can extract data using the inbuilt data management tools. ; Multiple formats are available.; Full auditing is in place.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: The system has been designed to provide and preserve functionality at all times. A major strength of our solution is in the system having a proven track record as a stable, reliable and responsive platform with up-time consistently achieving 99.99% 24x7x365.; ; Real time 'proactive' monitoring and automated threshold alerting ensures that our staff are aware of any potential issues before they arise. System wide capacity, performance and availability is monitored.; ; Support is available via a dedicated Service Desk which operates Monday to Friday 09:00am - 17:00pm. Priority 1 - 1 hour response, 4 hour fix Priority 2 - 2 hour response, 6 hour fix Priority 3 - 4 hour response, 35 hour fix Priority 4 - 7 hour response, fix within 3 months or next release
• Approach to resilience: The configuration and implementation of the new functionally rich and resilient system is in line with best practice in the UK. ; ; Key Features:; ; • Resilient solution, incorporating multiple ‘synchronised’ copies of the database.; • Automated failover (local site), Interfaces and Clients follow the active DB.; • Web based application; • Dedicated Reporting and Archive nodes; • Multiple system configuration options for system recovery; ; The system architecture comprises a series of physical and virtualised nodes, load balanced locally and across sites, ensuring high availability in the event of node failure and maintenance activities. This ensures the solution continues to operate in the event of a physical server node and also provides capacity scaling. In the event of a multiple failure event or significant infrastructure failure, the secondary site will take over.
• Outage reporting: Real time 'proactive' monitoring and automated threshold alerting ensures that our staff are aware of any potential issues before they arise. System wide capacity, performance and availability is monitored.; ; Multiple dashboards exist to highlight system health / aid in investigation -; ; 1) Database metrics; *SQL server CPU, memory and disk usage; *5-minute snapshot or system health; *Includes system index performance, stored procedures, transactions, error logs (including availability group errors); ; 2) Transaction Health - Incoming and outgoing; *Includes average time per transaction, average queue length, average processing times; ; 3) Device Transactions - Inbound and outbound; *Includes average time per transaction, average queue length, device activity; ; 4) Server Health - Breakdown by Internal/external servers and Client connectivity; ; 5) Interface Server Health; *Includes Total servers, servers online and key events; ; All dashboards are designed to show daily / weekly / monthly totals, refreshed every 15 minutes.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to application management interfaces and support channels is restricted using role-based access control. Administrative access is limited to authorised personnel only and follows the principle of least privilege. All access requires authenticated user accounts with strong passwords and multi-factor authentication where supported. Access is logged and monitored, and permissions are reviewed regularly. Support access is controlled through defined roles and approval processes, with access removed promptly when no longer required.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users receive audit information on a regular basis
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: Between 6 months and 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Data Security and Protection Toolkit.
• Information security policies and processes: Information Governance Policy available on request. Reported to Board Level.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All changes to both the underpinning infrastructure (hosted platform) and system software are tracked through our centralised service desk.; In line with our ISO9001 (quality) and ISO27001 (Information Security) standards, all changes are reviewed and risk assessed at our regular Change Management Board (chaired by the Technical Director).; Risks assessed include potential downtime to implement the change, any security considerations that may negatively impact the platform/users, and impact on existing modules and user workflows.; Each customer solution is tracked via our internal software version control process. This includes infrastructure software and application patch levels.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We are registered with the National Cyber Security Centre (NCSC) to receive alerts of any identified threats. All threats are assessed internally and patches applied where necessary within 48 hours of advice.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Network level monitoring to identify and disable potential breaches. Immediate email notification. Escalation process in place. Immediate response through 24/7 staff support rota.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: All Incidents and Service Requests are tracked through our centralised service desk which is underpinned by ISO9001/ISO27001 processes. We are working towards ISO27035/2023 Users can report issues via phone call (dedicated first and second line) or via email. Incidents are tagged as data, configuration, security, infrastructure of software bugs. Where bugs are identified, they are investigated, rectified followed by independent code review and functional testing. Where requested, RCA's are provided. Monthly contract reporting includes all reported incidents, adherence to SLA and their current status.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 1%
• Between £250,000 and £500,000: 2%
• Between £500,001 and £1,000,000: 2.5%
• Between £1,000,001 and £2,500,000: 3.0%
• Between £2,500,001 and £5,000,000: 3.5%
• Over £5,000,001: 4.0%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Isoqar
• ISO/IEC 27001 accreditation date: Tuesday 1 April 2025
• What the ISO/IEC 27001 doesn’t cover: Where the organisation provides software or advisory support only, and does not manage the hosting environment, operating system, access control, or security configuration, those systems fall outside the scope of Clerics 27001 ISMS. Responsibility for information security in those environments remains with the customer or their appointed supplier.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: Isoqar
• ISO 9001 accreditation date: Monday 10 February 2025
• What the ISO 9001 doesn’t cover: Customer-managed systems, infrastructure, or environments where the organisation has no administrative access or security responsibility are not within scope.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 08a8ef9e-3007-47cf-9c4c-73574463d74d
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 797b032b-81d8-4ddb-849b-0935418529e5
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at admin@cleric.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.