STREETS HEAVER COMPUTER SYSTEMS LIMITED

Compucare hospital management system

Compucare is a comprehensive, modular hospital administration platform delivering Patient Electronic Patient Record (EPR), inpatient, outpatient, billing, invoicing, bed management and contract management functionality; centralising data across units for accurate patient ledger credit control, treatment, medication and discharge tracking and out-of-the-box integrations with existing Patient Administration Systems and other EPRs.

Features

• Compucare EPR offers real-time patient information, with full patient timeline
• Searchable electronic clinical record with diagram upload and annotation
• Export standardised eDischarge PRSB data to GP IT systems
• Inpatient and outpatient appointment scheduling and waiting list management
• Integrates with Laserband patient identification wristbands production
• Automated patient invoicing, charge tracking and bill estimator tooling
• Consultant fee management owed to/by providers, consortiums and pools
• Electronic Data Interchange (EDI) for secure eInvoicing via Healthcode
• EPR and Patient Administration Systems integrations (Cerner, Lorenzo, EPIC, Allscripts)
• Trust Finance, eFinancial, Oracle, Integra Associates, Unit4 Agresso finance integrations

Benefits

• Electronic prescriptions prevent invalid drug medication combinations for patient safety
• Real-time bed management monitoring for ward occupancy and utilisation reporting
• Customisable billing rules for efficient insurer and purchaser contract management
• Streamlined patient ledger for full credit/debt control and tracking
• SMS service to improve patient user experience, reducing missed appointments
• PXP integration for secure card processing for easier payments
• Powerful, scheduled, automated business intelligence reporting reducing administration
• Improved 24/7 patient communication portal for booking appointments, submitting forms
• Centralise all patient information within single, fully-integrated system reducing silos
• Simplified clinician view to speed up and improve patient consultation

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at marketing@streets-heaver.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

965913802729624

Contact

Stuart Hymers
01522 872000
marketing@streets-heaver.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  Financial

  • Financial and Accounting Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Users require an Entra ID
• System requirements:
  • Windows PC running Windows 10 or Higher
  • 4GB of RAM

User support

• Email or online ticketing support: Yes
• Support response times: We respond to tickets, depending on their severity, normal priority = 8 hours, High = 4hours, Urgent = 0.5 hours, Mon-Fri (08:00 - 18:00)
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: Priority 1 - Urgent (Infrastructure) calls will be responded to within a target time of 0.5 Working Hours and Streets Heaver will use its best endeavours to restore functionality within 5 Working Hours. ; Priority 1 – Urgent (Software) calls will be responded to within a target time of 0.5 Working Hours and Streets Heaver will use its best endeavours to restore functionality within 5-10 Working Hours.; Priority 2 – High calls will be responded to within a target time of 4 Working Hours and Streets Heaver will use its best endeavours to provide a solution or workaround within 10 - 20 Working Hours. ; Priority 3 - Normal calls will be responded to within a target time of 8 Working Hours and Streets Heaver will use its best endeavours to provide a solution or workaround within 20 - 30 Working Hours.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide: A structured onboarding process via a dedicated implementation team, Training materials including videos, documentation, and live walkthroughs, A support portal with how-to guides and FAQs, Assisted setup of Azure SSO, networking, and VPNs, UAT environments and guided testing before go-live
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Onboarding and offboarding documentation is provided via the Streets Heaver Knowledgebase in accessible digital formats (PDF, web articles). These are structured and searchable. Upon termination, users can request full data export via Streets Heaver's commercial team. Data is provided in commonly used formats (SQL backups, and raw file for unstructured blob data) via secure file transfer methods.
• End-of-contract process: Clients are formally offboarded by Streets Heaver.; Access to services is revoked.; All client data is prepared for export and returned securely on request.; Data is retained for a defined period then permanently deleted in line with data retention policies.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Different apps have mobile implementations, based on individual ; requirements. The system scales for use on a responsive mobile device
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Compucare on Azure provides:; A web-based user interface (UI) for clinicians, administrators, and support staff to access Compucare functionality via browser.; An administration console (CAS) for configuration, SSO management, and user provisioning.; A REST-based API (SHM API) supporting integration with third-party systems (e.g., PAS, messaging services).; A web-based Report Generator hosted in Azure for designing and running operational and clinical reports.; All interfaces are accessible via supported browsers and protected with Azure AD authentication.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: While formal testing with end users of assistive technologies has not been completed across all modules, internal QA processes include compatibility checks using: Screen Reader, Windows Magnifier and High Contrast Mode, Keyboard navigation scenarios
• API: Yes
• What users can and can't do using the API: Using the SHM API, users can:; ; Send and receive HL7 messages for interfacing with PAS and other systems.; Push and pull clinical and administrative data into/from Compucare.; Automate workflows involving referrals, bookings, and messaging.; ; Limitations:; The API does not support direct database writes.; Role-based access controls restrict certain functions to authorised integrations.; Real-time data access is subject to network and VPN configuration.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users can customise the service via: Workflow configurations and clinical templates, Role-based user permissions, API integrations with external systems (e.g., PAS, billing, labs), Report Generator for custom reporting, Branding of the UI and login experience

Scaling

• Independence of resources: Compucare on Azure ensures tenant isolation and consistent performance through:; ; Dedicated SQL resources per client, with enforced CPU and disk limits via Azure SQL pools to prevent overuse.; ; Multi-tenant services with built-in autoscaling, ensuring shared components scale automatically based on demand. Single tenant based resources are resourced independently.; ; Real-time monitoring and alerts via Azure Monitor and Application Insights, allowing proactive response to any performance risks.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics include: Data access/write audit logs, Database storage consumption, Report usage and user access logs
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: All data at rest is encrypted using AES-256 encryption.; ; Transparent Data Encryption (TDE) is enabled on all Azure SQL databases.; ; Azure Storage encryption is also enforced for Blob and File storage.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Data can be exported via: Secure file transfer of SQL databases, Report extracts via the Report Generator, API-based data access where applicable, Direct SQL access where granted to a SQL replica
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • JSON (via api)
  • SQL (.bak)
  • *.* (blob files)
• Data import formats: Other
• Other data import formats:
  • SHM API
  • JSON (via api)

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection between networks: Data in transit is encrypted using TLS 1.2+.; ; IP whitelisting and VPN tunnels (IPSec) are used for secure communication between client sites and Azure.; ; Role-based access control (RBAC) and conditional access are enforced via Azure AD.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Internal data is protected via Azure-native security controls, including: Network security groups (NSGs), Azure Firewall, Private endpoints, Segmented VNETs per client, Data flows are monitored via Azure Defender and Sentinel. SQL Data encrypted at rest.

Availability and resilience

• Guaranteed availability: 99.50%
• Approach to resilience: We uses multiple regions in Azure, as well as business critical service levels to make sure we have no single point of failure.
• Outage reporting: The platform targets 99.9% availability, leveraging Azure SLA-backed services.; ; Global Redundancy is built into web, API, and database tiers using failover groups and autoscaling.; ; Critical services are monitored 24/7 with proactive alerting and support.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Other
• Other user authentication: User authentication is handled via Azure Active Directory (Entra ID) using Single Sign-On (SSO). This includes support for Multi-Factor Authentication (MFA) and conditional access policies.
• Access restrictions in management interfaces and support channels: Access to management interfaces (e.g. Admin Console) is role-based and requires Azure AD authentication.; ; Support access is governed via strict internal RBAC policies and audit trails.; ; Only authorised Streets Heaver personnel can access client environments, with access granted temporarily and logged.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Other
• Description of management access authentication: Management access is authenticated via Azure AD accounts with enforced MFA and just-in-time access where applicable. Admin roles are limited and logged through Azure activity logs and audit trails.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials Plus, NHS DSP Toolkit, ISO 9001, B-Corp
• Information security policies and processes: Streets Heaver follows a risk-based security governance framework, including: Defined roles and responsibilities, Regular risk assessments, Secure development lifecycle (SDLC) practices, Policy reviews and internal audits, Alignment with ISO security standards. Policies include: Data classification and handling, Role-based access control (RBAC), Patch and vulnerability management, Incident response, Secure coding and deployment, Annual training and awareness
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Configuration and change management are governed by: Change Advisory Board (CAB) approvals, Agile workflows in Azure DevOps, Version-controlled infrastructure as code (IaC), Testing and rollback planning for all production changes
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Monthly internal vulnerability scans, Use of Microsoft Defender for Cloud for real-time threat detection, Regular patching and remediation based on CVSS scores, PEN testing policy to have at very least annual external penetration testing by CREST/CHECK-accredited partners - more frequent based on volume of changes.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Azure Sentinel for SIEM, Activity logging via Azure Monitor and Log Analytics, Alerts on unauthorised access attempts or anomalies, Regular reviews of audit logs and access reports
• Incident management type: Supplier-defined controls
• Incident management approach: Formal incident response policy based on NCSC and NHS DSP guidance, Tiered severity classification, 24/7 monitoring for high-priority incidents, Root cause analysis (RCA) and lessons learned documentation, Client notification procedures in line with data protection law
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • Health and Social Care Network (HSCN)
  • Other
• Other public sector networks:
  • Direct HSCN connection for clients with existing HSCN infrastructure
  • Typically for e-RS and NHS PAS integrations

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: Wednesday 5 June 2024
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: BSI
• ISO 9001 accreditation date: Saturday 1 June 2024
• What the ISO 9001 doesn’t cover: N/A
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: E5c77322-4bec-4a67-a182-30e97129a9d5
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 383e8da8-990e-4918-8aac-9c00a9d91473
• Other security certifications: Yes
• Any other security certifications: NHS DSPT

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Volunteering opportunities for staff

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Working conditions which promote an inclusive working environment and promote retention and progression

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Creation of outreach activities to create a pipeline of employees for the future contract delivery

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at marketing@streets-heaver.com. Tell them what format you need. It will help if you say what assistive technology you use.