Medical Records Management System

Wales and West Utilities (WWU) are tendering for a medical records management system for use by our Occupational Health team.

Secure records management is required because:

• WWU has a duty to manage special category data under UK GDPR Arts 6&9
• Occupational Health is a data controller and data processor under UK GDPR
• Medical records must be stored and retained in a confidential system Art 9(2)(h) by a professional with a legal or ethical duty of professional secrecy Art 9(3)
• Under common law, a health professional must obtain consent before a medical report is released to management. The records must be stored securely in the interim
• Health professionals have an ethical duty to protect confidentiality.

Data protection is of paramount importance and all data is considered sensitive, so it's important that you can demonstrate your ability to meet the following requirements -

• Your solution must be a SAAS solution,
• It must be hosted on a UK based server,
• Data must be backed up and encrypted while at rest and in transit,
• Multi Factor Authentication (MFA) sign on,
• You must be ISO27001 accredited,
• Adequate controls must be in place to monitor and prevent records editing,
• You must be registered with the ICO,
• Appropriate password controls must be in place which include forced password changes and an acceptable level of complexity,