RM1043.8-1- East of England Sub-National Secure Data Environment: MVP Build Partner

Tender description

Which phase the project is in Discovery Existing team Description and organigram of the existing team is set out in Appendix 3 SDE Delivery Team Information. Address where the work will be done Remote plus some in person meetings at: Health Innovation East, Unit C, Magog Court, Shelford Bottom, Cambridge, CB22 3AD Working arrangements The supplier team is expected to keep to the delivery team's core working hours (09:00-17:00), to maximise knowledge transfer and time available to work collaboratively across organisations. As a minimum we require the supplier to engage with fortnightly sprint cycles, with two stand-ups per week with the SDE programme management office (PMO) and technical teams. Work is expected to be conducted largely remotely, but the supplier team will need to be able to travel to the Health Innovation East office (in Cambridge) as some in person meetings are expected. Reasonable travel expenses (excluding air travel due to carbon impact) to support the working arrangements will be reimbursed, subject to prior approval. EOECPH and the Trusts shall not be liable for or pay any costs, expenses or losses, whatsoever which may be incurred by any Tenderer in the preparation of their Tender submission. Provide more information about your security requirements: No security clearance needed Latest start date 2024-01-08 Enter the expected contract length: 6 months Extension period: 3 months Write the term or acronym: LZ Write the term or acronym: DIP Write the term or acronym: PRE Write the term or acronym: SDE Write the term or acronym: RAP Explain the term or acronym: Landing Zone Explain the term or acronym: Data Integration Platform Explain the term or acronym: Project Research Environment Explain the term or acronym: Secure Data Environment - Consisting of LZ, DIP and many PREs Explain the term or acronym: Reproducible Analytical Pipelines Are you prepared to show your budget details?: No Confirm if you require a contracted out service or supply of resource Contracted out service: the off-payroll rules do not apply Summary of work To deliver a Sub-National Secure Data Environment for Research and Development (SNSDE for R&D) for the East of England. The ambition is to provide researchers and analysts with access to NHS health and social care data at a significant regional scale, maintain patient confidentiality, and ensure connectivity to local communities and NHS care teams. The SDE will be a cloud-native solution that provides users with advanced functionality from the outset. It will initially onboard datasets in support of cardiovascular research for the MVP - designed with the Five Safes principles firmly at its core. Our approach will promote interoperability, scalability, integration with provider systems. It will provide advanced yet user-friendly tooling to support of research and innovation. We are seeking a build partner to work with our SDE Technical Team to develop and set up an MVP Target Architecture (TA) by 31 March 2024 to support two initial use-cases. The selected partner will provide consultancy, platform build, operational documentation and training services to create an extensible MVP for the SDE. The platform will be created in partnership with the SDE team, identifying relevant training, with a long-term aim of the SDE team being self-sufficient for future support and development activities. Where the supplied staff will work East of England Who the organisation using the products or services is The host Contracting Authority is Cambridge University Hospitals NHS Foundation Trust. The East of England Collaborative Procurement Hub is working on behalf of the Contracting Authority. This is being procured for the East of England Integrated Care Systems as below: NHS CAMBRIDGESHIRE AND PETERBOROUGH (C&P) NHS NORFOLK AND WAVENEY (NWPC) NHS SUFFOLK AND NORTH EAST ESSEX (SNEE) NHS BEDFORDSHIRE, LUTON AND MILTON KEYNES (BLMK) NHS HERTFORDSHIRE AND WEST ESSEX (HWE) NHS MID AND SOUTH ESSEX (MSE) Why the work is being done NHS health and social care data has immense value beyond the direct care of patients. It accelerates the discovery of new treatments from industry and academia, and helps the NHS to plan better services. As part of the Governments Strategy - "Data saves lives: reshaping health and social care with data", NHSE committed to implementing secure data environments as the default way to access NHS health and social care data for research and analysis. The ambition is to provide researchers and analysts with access to NHS health and social care data at a significant regional scale, maintain patient confidentiality, and ensure connectivity to local communities and NHS care teams. NHS England is currently piloting a national secure data environment, and has provided funding for Sub-national secure data environments to be piloted by 31st March 2024. Our vision is to deliver a Sub-National Secure Data Environment for Research and Development (SNSDE for R&D) for the East of England that: 1. Accelerates research to improve the quality of life and reduce health inequalities for people living within our region, promoting the benefits to secure public advocacy and support. 2. Generates new opportunities for research by providing a simpler, quicker and streamlined research user journey while enhancing the quality and quantity of research – including integration with existing advanced, multimodal data assets, such as our world-leading repository of genomics data. 3. Exemplifies patient and public involvement and engagement in research by working with patients and the public in progressive ways to shape local research efforts, thereby enhancing public trust in how their data is used and protected. 4. Drives economic growth by contributing to the attractiveness of the East of England as a place where life science and tech companies want to locate and fund research. 5. Delivers a technical solution which takes measures to minimise its environmental footprint. The business problem you need to solve We are seeking a build partner to work with our SDE Technical Team to develop and stand up an MVP Target Architecture (TA) by 31 March 2024 to support two initial use-cases. The SDE will be a cloud-native solution that provides users with advanced functionality from the outset. It will initially onboard datasets in support of cardiovascular research for the MVP - designed with the Five Safes principles firmly at its core. Our approach will promote interoperability, scalability, integration with provider systems. It will provide advanced yet user-friendly tooling to support of research and innovation. While our initial MVP will focus on the technical delivery of functionality to support cardiovascular disease research, the TA is designed to be scalable to support other use cases beyond this initial development phase. The selected partner will provide consultancy, platform build, operational documentation and training services to create an extensible MVP for the SDE. The platform will be created in partnership with the SDE team, identifying relevant training, with a long-term aim of the SDE team being self-sufficient for future support and development activities. Deliverables MVP by 31 March 2024 • Secured, cloud research platform with minimal idle costs – conforming to the essential target architecture components as described in Section 3: Technical Requirements of the Supporting Document, 00_EoE-SNSDE_Build Ptnr_Procurement Spec_Final.docx • Infrastructure as code deployment and management scripts • Automated provisioning of Project Research Environments from metadata file • Coding documentation to be provided in editable & versioned form (e.g. GitBook, JsWiki, Confluence) Infrastructure deliverables will be subject to penetration testing and cloud security audit - to be conducted by an independent third party – with any arising issues / recommendations satisfactorily resolved. Documentation by 31 May 2024 • Technical platform documentation • Security & breach procedure documentation • Landing Zone and Data Integration Platform documentation • Project Research Environment documentation (user facing) • Airlock documentation (user and administrative) Knowledge transfer & handover by 30 June 2024 • Skill gap analysis and associated training plans for the SDE team (by end of April-24) • Final assurance that pen testing and security audit findings / recommendations effectively resolved. • Handover of the cloud platform needs to be able to de-coupled from the reseller to bring the platform under the control of the SDE technical team and the governance of Cambridge University Hospitals (CUH) as the lead accountable organisation. First user type: Personas and User Stories Enter more details about this user type: Descriptions of personas and user stories are included in the supporting documentation, 00_EoE-SNSDE_Build Ptnr_Procurement Spec_Final.docx, Appendix 1. Questions and Clarifications 1. Stage 1 Notification Date Due to internal factors, our stage 1 notification date has been amended to 09/11/23. Please see the revised timescales below: Deadline for suppliers to submit their stage 1 responses - 09:30 30/10/23 Evaluation of stage 1 - 30/10/23 - 09/11/23 Publication of stage 2 - 10/11/23 Deadline for suppliers to submit their stage 2 responses - 12 Noon 23/11/23 Supplier presentations - 07/12/23 Evaluation of stage 2 - 23/11/23 - 11/12/23 Standstill period starts - 12/12/23 When you plan to award the contract - 02/01/24 When you expect the contract to be signed - 09/01/24 When you expect the supplier to start - 10/01/24 Last Updated: 25 October 2023, 16:18 2. Will there be a clarification period to submit further questions once Stage 2 is released? Yes a further clarification period will be provided at stage 2. Dates will be provided to shortlisted bidders at stage 2. Last Updated: 25 October 2023, 14:50 3. Please could you share Appendix 5 Stage 2 Commercial Schedule? Unfortunately, the system does not allow further attachments to be issued at this stage. The commercial schedule will be released to shortlisted bidders at stage 2. We are requesting a breakdown of tasks, roles, daily rates and anticipated days against the deliverables detailed in 00_EoE-SNSDE_Build Ptnr_Procurement Spec_Final under section 4.4. Commercial submissions will be evaluated on the basis of the total contract value submitted. Last Updated: 25 October 2023, 14:46 4. Please could you provide an extension on the current deadline of 30/10/2023 at 09:30? Unfortunately, we unable to grant an extension due to the tight timescales of this project. Last Updated: 25 October 2023, 14:43 5. 00_EoE-SNSDE_Build Ptnr_Procurement Spec_Final mentions "A user forum intended for community support and live discussion" and also references this in the diagram below. Can you clarify the scope within this procurement, if any, of a user forum? Provision of a searchable, knowledge-base where SDE users and operators are able to post questions, answers and FAQ type advice (StackOverflow "like"). This needs to be contained within the platform due to data privacy with facility to purge entries should exposure occur. Ability to post privately within a PRE project team (data specific), would be beneficial, as well as SDE wide (with domain tags). Last Updated: 25 October 2023, 13:03 6. 00_EoE-SNSDE_Build Ptnr_Procurement Spec_Final mentions "Mature and flexible service desk tooling and configuration to support user onboarding, data access requests and approvals. Loosely coupled and able to support web-hooks and API calls for future extensibility" and notes "Service desk integration" in the diagram below. Can you clarify the scope within this procurement, if any, of service desk tooling and integration? Demonstrate a service desk workflow integration which results in an automation within the SDE, e.g. a workflow that creates a project and users, where not pre-existing, following relevant approvals. The full approval workflow is out-of-scope, but creation of a ticket and an agent action resulting in the automated creation of project, users and attachment to the project are in-scope. This would serve as a model for future integrations. Last Updated: 25 October 2023, 13:02 7. In nice to have skills and experience there is a reference to "Ability to provide collaborative tooling with appropriate safeguards." Does this refer to tooling capabilities and safeguards within the Analytic Zone and Provider Zone on the reference Technical Architecture? Or does this refer to other collaborative tooling? The provider zones are out of scope for the MVP, Analytic Zone = Project Research Environment. Both the Data Integration Platform and Project Research Environments will need to be able to access code and package repositories via a proxy which scans for vulnerabilities and approval mechanisms. Levels of automated approval may differ between DPI & PREs. Last Updated: 25 October 2023, 13:02 8. Can you clarify which tooling for the safeguards, the r&d environment or project delivery? Technical, rather than project based. For example proxied git/package repositories with security scanning and approval processes to allow external tools to flow while minimising risk. Last Updated: 25 October 2023, 13:01 9. "Ability to provide collaborative tooling ASing with appropriate safeguards" - is there a spelling mistake on this question - can you clarify? Apologies, the question should read "Ability to provide collaborative tooling with appropriate safeguards." Last Updated: 25 October 2023, 12:59 10. What are the number of projects expected on the MVP? This will help determine pricing of solution. Basing on 10 would be a fair estimate (combination of users and datasets). A solution where projects have minimal idle cost is desired. Last Updated: 25 October 2023, 12:58 11. The Technical Architecture mentions "Extract, Transform & Load (ETL) processes and Privacy Enhancing Technologies (PET)" and "deidentification" in relation to Source Data Platforms. For clarity, are we correct in thinking these capabilities are outside the scope of the procurement? Yes, providing a platform where we are able to orchestrate ETL work and implement PET is the requirement, not the implementation. Last Updated: 25 October 2023, 12:57 12. Please confirm what the two use cases are that are referenced in the documentation. Are they both cardiovascular? The use cases are cardiovascular, to demonstrate the functionality of the platform and are not intended to be a focus of the build partner. The procurement is for a platform to support analytics of a diverse nature. The solution will need to be extensible and not tailored to a specific use case. Last Updated: 25 October 2023, 12:54 13. For the Data Integration Platform, are you looking for Spark, GPU, and/or other big data capabilities? The platform should be extensible to support big-data, however for MVP the data volume will be limited. Last Updated: 25 October 2023, 12:51 14. Are there any expectations to integrate with a data catalog tool? Within the MVP only basic metadata functionality is expected due to the short timelines. Last Updated: 25 October 2023, 12:50 15. For the MVP, is it required to operate across multiple cloud providers? The solution should be designed with the intent to provide API functionality that will allow cross provider data transfer as part of the wider SN-SDE network. Last Updated: 25 October 2023, 12:49 16. We understand that the selected supplier will also be a cloud platform re-seller. Should the Stage 2 response propose a specific Cloud platform and data analytics product(s), or is this to be decided during the MVP delivery? Do you have a process in place to select the Cloud platform and data analytics product(s) to be selected? The supplier should base any application around a specific cloud platform and data analytics tooling, this is yours to determine. The submissions will be assessed in line with the evaluation criteria set out in the documentation provided. Last Updated: 25 October 2023, 12:47 17. Is there an existing platform or cloud provider in place that could be further developed to build this solution, or is this a fully greenfield platform? If the former, can you share details on the current tech stack and any limitations? This is a green field project. Last Updated: 25 October 2023, 12:42 18. Is any data architecture or engineering work in scope of this procurement to support the Cardiovascular use case, or is this limited to building the platform capabilities to support analytics of existing data sets? The procurement is for a platform to support analytics of a diverse nature. The solution will need to be extensible. The data for the cardiovascular use case is to demonstrate the functionality of the platform and is not intended to be a focus of the build partner. Last Updated: 25 October 2023, 12:41 19. Is any data migration, replication or onboarding of multiple Trusts into the environment in scope of this procurement? For the purpose of the MVP, data will be manually loaded from several Trusts to the Landing Zone. Some initial investigations of future automated solutions for this will occur in parallel. Negotiating access to data will not be a responsibility of the build partner. Last Updated: 25 October 2023, 12:40 20. Can you confirm that as per the documentation provided, the Buyer for the procurement is West Suffolk NHS Foundation Trust, however the lead accountable organisation for the programme is Cambridge University Hospitals (CUH)? This is a regional procurement across of the East of England Integrated Care Systems as set out below: NHS CAMBRIDGESHIRE AND PETERBOROUGH (C&P) NHS NORFOLK AND WAVENEY (NWPC) NHS SUFFOLK AND NORTH EAST ESSEX (SNEE) NHS BEDFORDSHIRE, LUTON AND MILTON KEYNES (BLMK) NHS HERTFORDSHIRE AND WEST ESSEX (HWE) NHS MID AND SOUTH ESSEX (MSE) This procurement is being supported by the East of England NHS Collaborative Procurement Hub (EOECPH), who are hosted by West Suffolk Trust, however West Suffolk are not the lead Contracting Authority/Buyer. The lead Contracting Authority is Cambridge University Hospitals NHS Foundation Trust. Last Updated: 25 October 2023, 12:38 21. What is the success criteria for the Pilot and what level of throughput are you expecting / how many users will be using the Pilot? The pilot will be for a modest number of end users (researchers), 3-5. A small number of anonymised data sets will be uploaded to the Landing Zone to be processed within the Data Integration Platform (requiring python, R, ETL pipeline solutions) by data managers (2-3) as well as pass through. Demonstration of provisioning a Project Research Environment with the relevant approved data being presented to users in a read only form for further investigation within using Python/R in notebook/analytic platform as well as functionality to support Office style tools via VDI. An airlock solution is required, along with functionality to support the safe ingress of code and packages. All egress from the system must be tightly controlled. A penetration test is required as well as a clear plan for ISO/IEC 27001 accreditation. Last Updated: 25 October 2023, 12:32 22. How long will be attributed to the Pilot phase considering the development of an MVP will only be starting in January? The functional delivery of the pilot is to be completed by March 31st 2024 as per the supporting documents. Last Updated: 25 October 2023, 12:30 23. Does the organisation have a preferred SDE product that they are considering or is that to be determined by the supplier? All applications will be assessed on ability to meet the criteria and functionality of the TA. Bidders are free to specify as seen fit. Last Updated: 25 October 2023, 12:29 24. Is there a preferred cloud vendor that the organisation is aligning to? No, submissions will be assessed on merit. Note expectation of skill gap analysis and training plans in section 2 questions. Last Updated: 25 October 2023, 12:28 25. Post 31st March, is there a plan to onboard further user groups? And do you have a prioritised list of use cases you will be looking at post MVP? Yes, the platform is expected to be an ongoing project, supported by a dedicated SDE team following appropriate training and handover. Further use cases and expansion of functionality are planned for 2024/2025. Last Updated: 25 October 2023, 12:26 26. Is there an incumbent supplier supporting this work? No. Last Updated: 25 October 2023, 12:25 27. What are you expecting to see in response to question 1 at stage one, i.e. do bidders confirm they will comply and are certified where relevant? We are expecting bidders to show how these standards are applicable to the project. Where appropriate provide verifiable examples of prior work, if not relevant show reasoning. Last Updated: 24 October 2023, 16:55 28. For questions 1, 2, and 3 in essential criteria at stage 1, are you expecting yes/no answers or answers in greater detail? Verifiable detail such as evidence of existing certifications, agreements, pools of resource to access etc. will be required to support your responses to the pass/fail questions. Last Updated: 24 October 2023, 16:52 29. To confirm, by 'authorised re-seller', do you mean authorised reseller of AWS and/or Azure? Yes this is correct, authorised re-seller of AWS and/or Azure. Last Updated: 24 October 2023, 16:50 30. For question 6 at stage 1, do the two examples need to be in the same 750 characters or does this question cover 1,500 characters? (Proven track record of working in partnership with customers to identify and deliver relevant training, to enable the customers team to be self-sufficient for future support and development activities. Please give a minimum of 2 examples to support your response). Question 6 is 750 characters for the complete question, including both examples (unlike Q4 & Q5 which allows 750 characters per example). Last Updated: 24 October 2023, 16:49 31. Are you able to share the budget for this project? We are not able to share the budget envelope for this project. Pricing proposals should be submitted by shortlisted bidders as part of their stage 2 responses. Last Updated: 24 October 2023, 16:39 32. Could you please clarify which of the two response sizes below is compliant for stage 1 of this opportunity? 1. 750 characters (including spaces and punctuation) per each of the listed essential and nice-to-have skills and experience (9750 characters in total). 2. 750 characters (including spaces and punctuation) per each of the two sections (listed essential and nice-to-have skills and experience) (1500 characters in total). The 750 character limit is per individual question. E.g. Essential Q1.1 should be answered in 750 characters, as should Q1.2 etc. Last Updated: 24 October 2023, 16:19 33. Is the buyer open to off-shoring or near-shoring platform support / management where this doesn’t contravene required security and platform standards? No, the support and management of the platform should be within the UK. This is an assurance component of the wider public perceptions of data movement and control. Last Updated: 24 October 2023, 16:15 34. Is the buyer looking specifically for a bespoke build, or open to exploring buy/rent options for an existing, configurable solution? Any tender that meets the requirements, whether a bespoke build or an existing configurable solution, will be considered on its merits. Last Updated: 24 October 2023, 16:14