Common Assurance Process for GP Systems Requirements V1 (GPSoC Replacement Procurement Pre-requisites)

Interface

Mechanism

Programme

GPSoC

Document Record ID Key

SubProg/Project Prog. Director Owner Author

GPSoC Kemi Adenubi Claire Malone Claire Malone

XXXX Status Version Version Date Draft 0.7 01/03/13

Common Assurance Process GP Systems Interface Mechanism Requirements V1 (GPSoC Replacement Framework Procurement Prerequisites)

Crown Copyright 2013

Common Assurance Process for GP Systems Interface Mechanism Requirements V1 (GPSoC Replacement Procurement Pre-requisites)

NPFIT-FNT-XX

01/03/13 Draft 0.7

Amendment History:
Version 0.1 0.2 0.3 0.4 0.5 0.6 0.7 Date 04/02/13 05/02/13 11/02/13 14/02/13 25/02/13 28/02/13 01/03/13 Amendment History First Draft Second Draft after comment from MR (GPSoC) & DS (Tech Office) Third Draft after feedback from SL (NICA) Fourth Draft after feedback from SL (NICA) CAP Ops Board Comments Final version for approval Minor editing changes

Forecast Changes:
Anticipated Change When

Reviewers: This document must be reviewed by the following

Name Tech Architect Information Governance Functional Assurance Non Functional Test Team Clinical Safety Service Introduction and Deployment Assurance Team CAP Operations Team GPSoC Team Education, Training & Development [ETD] email Richard.trusson@nhs.net igteam@nhs.net Simon.Lee3@nhs.net tag.nfa@nhs.net stuartharrison@nhs.net dst@nhs.net Anne.dyson@nhs.net clairemalone@nhs.net Carole.sheard@nhs.net Title / Responsibility Date

Approvals: This document must be approved by the following:

Name CAP Operations Board Programme Owner e-Signature Title / Responsibility Date

Distribution: Public facing document Document Status: This is a controlled document. Whilst this document may be printed, the electronic version maintained in FileCM is

Crown Copyright 2013

Page 2 of 11

Common Assurance Process for GP Systems Interface Mechanism Requirements V1 (GPSoC Replacement Procurement Pre-requisites)

NPFIT-FNT-XX

01/03/13 Draft 0.7

the controlled copy. Any printed copies of the document are not controlled. Glossary of Terms: List any new terms created in this document. Mail the NPO Quality Manager to have these included in the master glossary above [1].
Term CAP HSCIC RFO V&P Principal System Subsidiary System Definition Common Assurance Process Health and Social Care Information Centre Ready for Operations Volume and Performance means the collection of clinical system modules provided by a single supplier as an integrated clinical system. means the provision of subsidiary system modules either by a third party supplier or by a principal clinical system as part of their Principal System.

Crown Copyright 2013

Page 3 of 11

Common Assurance Process for GP Systems Interface Mechanism Requirements V1 (GPSoC Replacement Procurement Pre-requisites)

NPFIT-FNT-XX

01/03/13 Draft 0.7

Contents 1. Overview .............................................................................................................5 1.1 Document Purpose ........................................................................................5 1.2 Background and Project Purpose ..................................................................5 2. Delivery Approach ...............................................................................................6 3. Relevant HSCIC Requirements ...........................................................................7 4. Assurance Approach for GP Systems Interface Mechanism Requirements V1 ..7 Preparation ..............................................................................................................7 GPSoC Replacement Procurement and Interface Mechanism Assurance ..............7 Design and System Test Information .......................................................................8 Witness Testing .......................................................................................................8 5. Development Milestone Achievement Certificate (DevMAC) ...............................8 6. Notes ...................................................................................................................9 7. Management .....................................................................................................10 Roles and Responsibilities.....................................................................................10 8. RACI Matrix .......................................................................................................10 9. Engagement ......................................................................................................10 10. Assurance Risks and Issues .............................................................................10

Crown Copyright 2013

Page 4 of 11

Common Assurance Process for GP Systems Interface Mechanism Requirements V1 (GPSoC Replacement Procurement Pre-requisites)

NPFIT-FNT-XX

01/03/13 Draft 0.7

1. Overview
1.1 Document Purpose
The purpose of this document is to detail the assurance approach for GP Systems Interface Mechanism Requirements V1 for Principal and Subsidiary Systems under the GPSoC Replacement Framework Agreement. The document is a public facing document that provides information as to how HSCIC will assure Suppliers compliance with the GP Systems Interface Mechanism Requirements V1 in readiness for entry onto the GPSoC Replacement Framework Agreement. This document will also enable key HSCIC stakeholders to gain a view of the specific assurance approach to be used to address this defined set of requirements. This document will inform the GPSoC Replacement Programmes detailed planning approach and needs to be sanctioned by the CAP Operations Board in conjunction with relevant Programme-specific governance arrangements. This document will be the only document that will detail the assurance approach for GP Systems Interface Mechanism Requirements V1 only and does not cover specific integrations between Principle and Subsidiary Systems.

1.2 Background and Project Purpose

The GPSoC Replacement Programme have informed the market that entry onto the GPSoC Replacement Framework Agreement is only permitted if a number of criteria are met, one being that the supplier system is compliant with the GP Systems Interface Mechanism Requirements V1. This compliance requirement applies to: 1. Principal System Suppliers who have been successfully shortlisted following the completion of the Pre Qualification Questionnaire (PQQ) phase and Invited to Participate in Dialogue (ITPD), where their Principal System exists at the time of the GPSoC Replacement Procurement Process 2. Subsidiary System Suppliers who have been successfully shortlisted following the completion of the Pre Qualification Questionnaire (PQQ) phase and Invited to Participate in Dialogue (ITPD) where there is a functional requirement to provide an Interface Mechanism as part of the provision of a subsidiary module AND where their Subsidiary System exists at the time of the GPSoC Replacement Procurement Process See Section 2, delivery approach for more detail. The OJEU notice will be published in Q4 FY12/13 formally commencing the procurement phase of the GPSoC Replacement Project with the aspiration to award

Crown Copyright 2013

Page 5 of 11

Common Assurance Process for GP Systems Interface Mechanism Requirements V1 (GPSoC Replacement Procurement Pre-requisites)

NPFIT-FNT-XX

01/03/13 Draft 0.7

contracts to successful suppliers by the end of 2013, allowing them to offer services under the GPSoC Replacement Framework Agreement. This document has been published to allow suppliers and the HSCIC the opportunity to familiarise themselves with the new assurance processes and prepare to undertake this piece of work. HSCIC have a defined and approved assurance approach tailored for use when assuring Suppliers against the GP Systems Interface Mechanism Requirements V1 as part of the GPSoC Replacement Procurement Process Suppliers wanting to gain compliance with the GP Systems Interface Mechanism Requirements v1.0 prior to the GPSoC Replacement Framework understand the assurance process as set out by HSCIC HSCIC can appropriately resource the assurance process and conduct preassurance activities to ensure that the process is met Suppliers can plan how they will achieve compliance and successfully meet the minimum eligibility criteria required during the Procurement Process to permit entry onto the GPSoC Replacement Framework Agreement.

2. Delivery Approach
The scope of this assurance approach is limited to Suppliers who are bidding for entry onto the GPSoC Replacement Framework and are required to comply with the GP Systems Interface Mechanism Requirements v1.0 This assurance approach sets out the process to be conducted during the GPSoC Replacement Procurement Process ONLY. GPSoC Supplier Systems have existing Interface Mechanisms in place which have not been assured by HSCIC as the provision of such was not a requirement under the current GPSoC Framework Agreement. HSCIC have a defined and approved set of Interface Mechanism Requirements. Compliance with these requirements form part of the minimum eligibility criteria for the GPSoC Replacement Framework Agreement. Should current GPSoC Suppliers wish to enter onto the GPSoC Replacement Framework Agreement and provide a Principal Clinical System they must successfully complete the assurance process defined within this document (and achieve compliance as awarded by HSCIC. In order to meet the GP Systems Interface Mechanism Requirements v1.0 it is recognised that the Supplier may need to further develop their existing Interface Mechanism. Existing 3rd party suppliers who interface with GP Clinical Systems which also have an Interface Mechanism in place must also meet HSCIC requirements and

Crown Copyright 2013

Page 6 of 11

Common Assurance Process for GP Systems Interface Mechanism Requirements V1 (GPSoC Replacement Procurement Pre-requisites)

NPFIT-FNT-XX

01/03/13 Draft 0.7

demonstrate that they do so by following this assurance approach allowing HSCIC to award compliance. As per the providers of Principal Suppliers, the Suppliers who wish to provide Subsidiary module functionality to interface with Principal Systems under the GPSoC Replacement Framework Agreement must also meet the GP Systems Interface Mechanism Requirements v1.0 and demonstrate that they do so by following this assurance approach allowing HSCIC to award compliance.

3. Relevant HSCIC Requirements

Relevant HSCIC Requirements are embedded below: XXX This assurance approach DOES NOT COVER integration between specific Principal Systems and Subsidiary Module Systems. That assurance piece is out of scope and will be conducted separately. This assurance approach ends at Development Milestone Achievement Certificate (DevMAC) and intentionally de-scopes a live pilot and a Full Rollout Certificate. The assurance approach also excludes any assurance of the Principal Clinical System or of the Subsidiary System Module.

4. Assurance Approach for GP Mechanism Requirements V1

Preparation

Systems

Interface

HSCIC will engage with the market to discuss the GP Systems Interface Mechanism Requirements V1 so that Suppliers delivering to the requirements are clear on what is required from a technical and assurance perspective. This assurance approach will also be discussed.

GPSoC Replacement Procurement and Interface Mechanism Assurance

Suppliers who are successful at the PQQ stage of the GPSoC Replacement Procurement Process will be Invited to Participate in Dialogue (ITPD) which is the next stage of the Procurement Process. , Suppliers will be asked to provide specific evidence to support their bid for the GPSoC Replacement Framework as part of the Dialogue phase of the Procurement Process. Suppliers will need to provide evidence of how they will satisfy assurance processes by submitting the relevant and requested information to HSCIC via their submissions. The evidence submitted will be formally included in the GPSoC

Crown Copyright 2013

Page 7 of 11

Common Assurance Process for GP Systems Interface Mechanism Requirements V1 (GPSoC Replacement Procurement Pre-requisites)

NPFIT-FNT-XX

01/03/13 Draft 0.7

Replacement Framework Agreement between the HSCIC and the Supplier. HSCIC will request that, as part of the first submission following the commencement of the Dialogue Phase, the Supplier submits the information as set out below.

Design and System Test Information

Deliverable Requirements Traceability Matrix Technical Architecture Functional Specification Non-Functional Specification Test Report Description Required Supplier to complete the Requirements Traceability Matrix provided by HSCIC as part of the requirements document Required 1 document covering the Interface Mechanism Design deliverables is acceptable Required 1 document covering the Interface Mechanism Design deliverables is acceptable Required 1 document covering the Interface Mechanism Design deliverables is acceptable Required This document should provide HSCIC with test evidence demonstrating that the Design meets the Interface Mechanism requirements Required - Document to provide HSCIC with a statement and evidence, from testing or assessment processes, that identifies that the Interface Mechanism does not impact on the performance of the GPSoC Clinical System. Required Document to detail identified hazards and their mitigations

Volume and Performance Test Report

Clinical Safety Closure Report

HSCIC will notify the Supplier via email when the above deliverables have been approved. This email will be embedded in the DevMAC when issued to the Supplier. See Section 4.5 for information relating to the DevMAC.

Witness Testing
After reviewing the information above, HSCIC may choose to witness test in the Supplier Test Environment or in the live environment by visiting a GP practice. The scope of the testing will be agreed between the two parties

5. Development (DevMAC)

Milestone

Achievement

Certificate

A Development Milestone Achievement Certificate (DevMAC) shall be issued by HSCIC once all the assurance deliverables and activities have been approved for GP

Crown Copyright 2013

Page 8 of 11

Common Assurance Process for GP Systems Interface Mechanism Requirements V1 (GPSoC Replacement Procurement Pre-requisites)

NPFIT-FNT-XX

01/03/13 Draft 0.7

System Interface Mechanism Requirements V1. The scope of the assurance ends at award of the DevMAC as stated in Section 3. For those Suppliers who have an existing DevMAC, HSCIC will update it to reflect compliance with the GP System Interface Mechanism Requirements V1. HSCIC will create a DevMAC for Suppliers who do not have an existing DevMAC to update. The DevMAC will detail whether the Supplier meets the GP System Interface Mechanism Requirements V1 as a Principal or Subsidiary Supplier. HSCIC will issue the DevMAC to the Supplier via email. This certificate will state that the Supplier meets the GP System Interface Mechanism Requirements V1. For the avoidance of doubt, there will be no Milestone Payment attached to this DevMAC. However, ongoing Support & Maintenance Charges (to be agreed as part of the dialogue in commercial meetings) in respect of the Interface Mechanism may be charged from the Effective Date of the GPSoC Replacement Framework Agreement. Award of the DevMAC demonstrates that the Supplier meets the GP Systems Interface Mechanism Requirements V1 in readiness for the GPSoC Replacement Contract and permits End to End Integration Assurance to commence with other suppliers. . Integrations between a specific Principle Supplier and a specific Subsidiary Supplier will be assured separately.

6. Notes
There is no scope phase for this release because: 1. This assurance piece will be conducted alongside the GPSoC Replacement Procurement 2. GPSoC Replacement do not require any other Scope deliverables that normally come under the scope phase in the Common Assurance Process 3. Assurance is constrained to the Interface Mechanism ONLY 4. Invitation to Participate in Dialogue constitutes scope stage which permits the Supplier to submit the required deliverables. A scope ATP will not be awarded

Crown Copyright 2013

Page 9 of 11

Common Assurance Process for GP Systems Interface Mechanism Requirements V1 (GPSoC Replacement Procurement Pre-requisites)

NPFIT-FNT-XX

01/03/13 Draft 0.7

7. Management
The following governance model has been designed to fit this assurance approach and the scope of the GP System Interface Mechanism Requirements V1

Roles and Responsibilities

Title SRO Programme Director Programme Head Project Manager Technical Architect NICA Assurance Lead Functional NICA Assurance Lead Non Functional Clinical Safety Name Tim Kelsey Kemi Adenubi Martin Warden TBC Danny Solomon Simon Lee David Pool Frazer Brindley/Mike Anderson

8. RACI Matrix
The embedded RACI matrix names the stakeholders within HSCIC who will review deliverables and approve certificates throughout the process.

RACI_GPSoC Assurance Approach_GP Systems Interface Mechanism Requirements.xlsx

9. Engagement
Suppliers are encouraged to contact the GPSoC mailbox if they require further information about this process: cfh.GPSoC-R@nhs.net

10. Assurance Risks and Issues

Risk/Issue ID CAP1 Description Number of suppliers who will want to comply with these requirements is currently unknown Number of HSCIC assurance resource unknown as the number of suppliers is unknown (CAP1) Mitigation/Proposed Solution Supplier Engagement days to be held to draw out this information See CAP1

CAP2

Crown Copyright 2013

Page 10 of 11

Common Assurance Process for GP Systems Interface Mechanism Requirements V1 (GPSoC Replacement Procurement Pre-requisites)

NPFIT-FNT-XX

01/03/13 Draft 0.7

Crown Copyright 2013

Page 11 of 11