Provision of a Replacement for PHE's Poisons Information Database (UKPID) Web Portal

Tender description

Summary of the work Public Health England (PHE) requires a replacement database for information held in current NPIS UKPID database. The current system is outdated and no longer meets user needs for web based accessibility therefore a new database and migration of current / historical data is needed. Expected Contract Length 10 months (8 months deveopment 2 months refining and updating the new database with PHE & NPIS) Latest start date Friday 1 March 2019 Budget Range £50,000 limit (most economically advantageous tender) including up-to £20K for scoping/discovery phase. Why the Work is Being Done NPIS use a database system to log enquiries and record patient information (UKPID). The current UKPID system is outdated and no longer meets user needs for accessibility and data retrieval. The current system is not suitable for web based accessibility and there are also problems with data retrieval, reporting and linking call enquiries from BT Cloud. A new database is therefore required. Problem to Be Solved Web based application capable of dealing with several concurrent users and high volume of enquires. Suitable code design supporting modularity and flexibility for future development. Seamless migration and transfer of UKPID data. Patient Identifiable Information; system to comply with DHSC level 5 security standards. Supplier will need to conduct initial scoping phase, consulting closely with all end users throughout, including staff at NPIS and PHE, to ensure user requirements are fully assessed and issues addressed. Supplier will need to present progress at the alpha and beta stages and secure approval to further develop, test and install a UKPID data system. Who Are the Users Employees of the National Poisons Information Service (NPIS) including Specialists in poisons information (SPI’s), clinical consultant toxicologists and public health specialists need to access, view and record enquiries to NPIS on a secure database via a web portal. Users will record patient / case and poisoning details obtained at the time of the enquiry, clinical advice given, sources of information used and subsequent follow up calls. The information recorded is used for clinical follow up, governance purposes (including audit purposes), statistical analysis, research and surveillance. Existing Team Supplier will be working with various PHE offices and the NPIS team Current Phase Live Skills & Experience • Have experience designing web based applications for multiple concurrent users capable of handling 50,000 enquiries per year. • Have experience ensuring systems can maintain continuous network connectivity/ operability 24/7. • • Identifying the existing functionality of the current system. • Engaging with stakeholders to identify new functional requirements • Data Migration, especially from legacy systems, in this case, an OpenInsite Linear Hash NoSQL database\ application (Basic +, TCL) • Experience of designing software, in a modular style, with clear well documented code; with a view to facilitate error detection, reuse and future development. • Identifying IT infrastructure requirements from engagement with IT staff. • Delivering scoping/discovery phase in a timely and economical way • Delivering a system with a high level of security which complies with General Data Protection Requirements and is capable for passing Penetration testing. • Able to deliver cost effective solutions, on time and to a good standard • Any experience of integrating web based applications with telephony systems would be useful. • Any experience of working with agencies with the government and\or medical\ health sector. Nice to Haves • Experience of working for a Government department. Work Location NPIS are located in four offices (Cardiff, Birmingham, Edinburgh, and Newcastle) and PHE are located in Chilton near Didcot. It is expected that the developer will work remotely with travel to NPIS / PHE offices as required. This is most likely to be Cardiff or Chilton, and via remote access (skype for business). Working Arrangments Supplier will need to travel to NPIS/PHE offices (most likely Cardiff or Chilton) to consult with end users. Supplier can work remotely and provide regular updates via Skype. Security Clearance Suppliers will be in contact with Patient Identifiable Data so SC clearance may be needed for suppliers staff. Additional T&Cs Digital Outcomes and Specialists 3 call-off contract No. of Suppliers to Evaluate 3 Proposal Criteria • Estimated time frames for the work (discovery and delivery) • Approach and methodology • Technical solution • Staff engagement plan for discovery and implementation phase • Ensuring that new versions of the database and web portal will have a suitable lifespan before more updates or rewrites are needed. Cultural Fit Criteria • Be transparent and collaborative when making decisions • Be able to adapt their solutions without question Payment Approach Capped time and materials Evaluation Weighting Technical competence 40% Cultural fit 20% Price 40% Questions from Suppliers 1. What are your expectation for the hosting of the new system? Provided by the winning bidder, internally by PHE or something else? Web site and database will be hosted within the Department of Health and Social Care. 2. Will PHE accept that the developers be based offshore? As there will be Patient Identifiable Information held in the live database PHE would prefer that the developers were UK based as if there were any issues when the database went into operation the same developers that constructed the database could address the problem. 3. Is there an incumbent supplier? Yes, but they do not seem to be on the DOS framework. 4. Do you have recorded session for QA that was held today. We couldn't join the call. Or, we ask all questions here? The text from Q&A session will be published here on Monday and any questions you have may be submitted through this portal. 5. Will the requirement for SC clearance be required if the development work does not touch 'live' data? SC clearance may become an issue if there is a problem once the database goes live. A developer who is not cleared will not be able to directly assist in the rectification of a problem in their work, even if it is a change to the original specification supplied by PHE . 6. Will minutes be provided from the Q&A session? Yes, they will be published here on Monday. 7. The Opportunity states a budget of £50,000 including up-to £20K for scoping/discovery phase. Please clarify if this means the total budget is £70K for both phases, or if this is a ~£30K/£20K split totalling £50K. The total budget for the two parts, discovery and implementation are £50K. 8. Q&A Session Q1Is the budget £50K Yes 9. Q&A Session Q2Will the web page be on the internet? No, the platform will sit on a secure network that is acceptable to DHSC & Government standards 10. Q&A Session Q3Will home users and work users be on a secure network? Yes 11. Q&A Session Q4Will the various users of the system require the same level of access? No there will be varying levels required, but there will need to be the facility for users to shift the access for individual records or sub sets of records between users. 12. &A Session Q5 How many access levels are there currently? Two, all users will have individual passwords and the data they can amend will be managed by the password. 13. Q&A Session Q6Is there to be integration with Toxbase? The system is for UKPID and we are looking to only work with that at the moment.There are several databases and we are looking to harmonise them. This is solely for UKPID and NPIS use only. 14. Q&A Session Q7What sort of range of reporting and statistics will be required? We intend to be looking at numbers (of incidents) and trends and Hopefully we will be able to flag up substances that we may want to follow up in more detail. Epidemiology and clinical feature are the main things we want to follow. We will need a feature to allow the cross referencing of information in certain fields to see if there are any common factors between incidents. 15. Q&A Session Q8Integration with telephones. What sort of integration are you envisaging? Logging and voice recording of enquiries. 16. Q&A Session Q9What sort of system is the for telephones? BT Cloud? There is a bespoke system, but we will be using BT Cloud. All information will be held for 3 years. 17. Q&A Session Q10 What data will need to be migrated? All the current data held on the existing system 18. Q&A Session Q12 What structure is the data held in the current database? The data is currently held on Open Insite database. 19. Q&A Session Q13What type of team structure do you require for the project We would look to the supplier to put forward the team that they think is suitable.One supplier suggested the skills required would include Project manager, business analyst, solution architect, developers, testers and deployment staff.These skills/tasks would be split across four or five people. 20. Q&A Session Q14 What is PHE's current plan for the procurement of this project. The response was we are looking to have an option to terminate the contract between the discovery and implementation phases if the construction/deployment costs are above our projected budget. 21. It is understood that the system will be hosted in an existing secure, private network: can we therefore assume that this mitigates much of the security provisions required by an application which holds identifiable patient information, including, but not limited to; authentication & authorisation, encryption in transit and at rest, content disarm & reconstruction, DDOS protection, password complexity and blacklists; and an API Gateway to provide rate limiting, HTTP header transformation, validation & filtering, and JSON schema (payload) validation? The system will be hosted in an existing secure private network within PHE, but that does not in any way mitigate any of security provisions that such a system requires. We will provide standard components such as identity management, firewalls etc, but they are still required to build a system that is coded to good coding and security standards and will resist common attack mechanisms. 22. Can you provide any further information or diagrams giving detailed information about integrating a new application into the existing secure hosting environment? Not at this stage, no. 23. With regards the data migration: is there an active team for the existing system who we can liaise with to facilitate the extraction of the data from the OpenInsight database? Is there a Data Connector available to connect the existing database with SQL Server? We have no visibility of the current database or experience with that database, perhaps the system owner can assist? 24. What are your expectation for the hosting of the new system? Provided by the winning bidder, internally by PHE or something else? It would be hosted by PHE. 25. Does PHE currently utilise SharePoint either on-premise or online for delivery of portals and would they consider a SharePoint based solution for the portal aspects of this requirement? There are no issues with SharePoint, but we would need to see the detail of the proposal to comment further. 26. We would wish to use the MYSQL database management system as part of our installation. Is this an issue? There are currently no issues with MYSQL but we would need to see the detail of the proposal to comment further. 27. Is there a timetable?The answer has been split across two responses due to size. 4.1Select technical solution that best fits user needs in budget 3/20194.2Progress to development (alpha/ beta stage) 3/20194.3Convene a PHE/ NPIS working group meeting with external specialist supplier [kick off meeting] within 2 weeks of contract being awarded. [Month 2] 3/20197/20194.7Testing and refine the developing UKPID in consultation with user group [Month 6-10] 9/20194.8Implementation and further testing [Month 8-11] 28. Time table question (see previous question)Response part 2 11/20194.9Ensure and revisions, bugs or modifications identified during the testing phase are addressed [Month 10-11] 11/20194.10Finalise development and move to implementation [Month 10-11] 11/2019 4.11Transfer old records from historical database NPIS (records from 2006; 650,000 entries) [Month 10-11] 12/2019 4.12Finalise implementation and close project [Month 11]4.4 UKPIDdevelopment [8 months] 3/2019 4.5 Convene regular PHE/ NPIS working group meetings with external specialist supplier [Monthly] 3/20194.6Develop UKPID for testing by all users [Month 2 – 6] 29. Second Attempt at publishing first half of timetable response. 4.1 Select technical solution that best fits user needs in budget03/20194.2 Progress to development (alpha/ beta stage) 4.3 Convene a PHE/ NPIS working group meeting with external specialist supplier [kick off meeting] within 2 weeks of contract being awarded. [Month 2]4.4 UKPID development [8 months] 4.5 Convene regular PHE/ NPIS working group meetings with external specialist supplier [Monthly]4.6 Develop UKPID for testing by all users [Month 2 – 6] 30. Second part of full timetable response original two part response hade some dates missing 07/20194.7 Testing and refine the developing UKPID in consultation with user group [Month 6-10] 09/20194.8 Implementation and further testing [Month 8-11] 11/20194.9 Ensure and revisions, bugs or modifications identified during the testing phase are addressed [Month 10-11]4.10Finalise development and move to implementation [Month 10-11]4.11Transfer old records from historical database NPIS (records from 2006; 650,000 entries) [Month 10-11]12/2019 4.12 Finalise implementation and close project [Month 11]