Choosing and managing software and IT suppliers as an adult social care provider

Contents

1. Introduction
2. Choosing a software supplier
3. Choosing an IT services supplier
4. Internal IT managers or managed services providers
5. Choosing a managed services provider
6. What to ask potential suppliers about
7. Managing suppliers and contracts
8. What your contract must include
9. Keeping track of your suppliers
10. Changing suppliers

Print this page

Introduction

As your adult social care organisation moves into digital ways of working, you may need to buy software for:

• care records and planning
• medication management
• staff management
• quality and audit 
• eLearning and training

Depending on the size and skills of your organisation, you may also need an IT supplier to set up and manage your software and devices. 

This guidance will help you to understand your needs and set up and manage contracts with suppliers. 

Choosing a software supplier

Care software and technology can help to save time, reduce paperwork and improve the care you offer. It can also help you to collect better data, so you can provide better evidence to inspectors, commissioners and regulators.

Follow our guide to getting digital social care records  for information on selecting and buying software for recording care information. 

This includes a list of digital social care records solutions that have been assessed by NHS England to meet core requirements - the assured solutions list.

Choosing an IT services supplier

If you do not have an IT department, you may also need to buy external IT services. These services can help you set up and maintain hardware and software and provide tech support to staff. 

Managed services providers (MSPs) are companies that look after your computer systems on a day-to-day basis. 

At a minimum, MSPs should:

• monitor your network, servers and computers for issues - this includes critical services like backups and security systems
• provide maintenance so that your computer systems run better for longer 
• support your team when they have IT problems

Some MSPs will provide additional services, such as helping you to connect to the internet or providing strategic advice. 

Internal IT managers or managed services providers

If you are a larger organisation with lots of people relying on IT, you may need an internal IT manager. This person can learn about your business and needs in depth, and potentially respond quicker to challenges. 

If you do not have the skills or capacity to manage IT internally, you'll need external IT support. Even with an internal IT manager, you may still need extra support. An MSP could bring additional capacity and a broader range of skills and knowledge. 

Choosing a managed services provider

Choose an MSP that understands your needs as a social care provider. They should understand the importance of keeping information safe and ideally have experience in supporting clients through governance processes.

A good MSP should be:

• personable and able to speak to your staff in non-technical language 
• consistent yet adaptable to your business needs (they can adapt their offer to your requirements) 
• constantly improving their services (for example, through training their staff or building new services to help their clients) 

Ask for references from other social care organisations with similar needs to you. 

Some IT businesses offer managed IT services as a 'bolt-on' to their service or product, but it's not their core business. Be aware that these kinds of services may tie you into using a particular product or service. 

What to ask potential suppliers about

Before agreeing a contract with a new MSP, find out about the following.

Their service level agreements (SLAs)

An SLA is a commitment made by the MSP of the service they will offer you. It will include their response times for fixing problems. 

Nearly all MSPs will offer a 'response' SLA. This means the time they will respond to your requests will vary and you may need to pay more for a quicker response. 

Fewer will offer a 'fix' SLA, because it's hard to predict what will break and how long it will take to fix it. 

Ask MSPs what types of service levels they offer. Consider what technology you rely on and may need fixing right away, and what could wait a few hours or days.

Ask MSPs how they measure the performance of their service levels and how they report that information back to you. Check what happens if the MSP fails to meet the agreed service. 

What is and is not included 

Clarify what the service does and does not include. Ask what else may be required later to avoid surprise costs. 

Some MSPs differentiate between 'managed IT services' and 'managed IT support'. For managed IT support, you would expect them to:

• check backups are running 
• help staff with local issues on their computers
• install security patches and updates

For managed IT services, you might expect support with setting up services like Microsoft Office 365 and Google Workspace.

MSPs may not be able to help with issues with third-party software, such as your medication management system. Ask if they can support you with this, or whether you should expect to ask the third-party supplier for support instead. 

MSP service hours and support charges

Ask your MSP what hours they work. Check what happens if you report a serious issue out of hours, or close to the end of the working day or week.

Some MSPs include support hours in their costs and others do not. They may charge extra for:

• out of hours support
• support beyond the first 15 minutes of a support ticket
• on-site support
• adding new users
• additional support hours beyond your monthly allowance (check whether unused time will rollover into the following month) 

Find out which of these terms apply to work out whether the MSP is affordable for your needs. 

What their contract terms are

You should expect a contract of at least one year, but some contracts may be 2 to 3 years. Be wary of contracts that are longer than this. If the supplier asks for a longer contract, ask about break clauses (opportunities to end the contract early) to protect both parties. 

Ask the MSP what will happen at the end of the contract term. Will the contract automatically renew for another long contract period or will it continue month by month?

Ask what happens if the MSP does not live up to your expectations. Will they offer money back? How much notice will you need to give to end the contract? For reference, a fair notice period is usually between one and 3 months.

What their onboarding process is

Ask the MSP about their process for taking on new clients. 

Some onboarding jobs will include: 

• removing access from your old MSP into your systems
• installing tools to allow the new MSP to provide technical support
• writing up initial documentation on your systems
• password changes
• health and safety assessments
• establishing contact with your other IT-related suppliers

The MSP may have identified a package of work that needs doing before they can support you. This might be updating settings or installing extra security measures.

Check how they plan to communicate with your team during the onboarding process. Do they have documentation to explain what's going to happen? 

If they have client testimonials

Ask for reference clients and contact other social care providers who use their services. 

You could ask the reference clients: 

• what the MSP consistently does well 
• what the MSP could do to improve
• if they've had any issues with the MSP and how they overcome them
• if they've had any success stories or 'big wins'

How they keep data secure

Your MSP will need full access to your systems, so you must trust that they are keeping their own systems safe and secure.

You could ask them:

• whether they have a cyber security accreditation like Cyber Essentials, IASME or ISO27001
• how they provide security awareness training to their people
• how they track their people accessing your computer system
• how they keep the passwords to your systems secure

Ask the MSP how they'll track which of their support people have been accessing your systems. They should be able to tell you who, when and why your systems have been accessed.

Read advice on cyber essentials from the National Cyber Security Centre - the minimum standard of cyber security recommended by the government for organisations of all sizes.

Your MSP will also have access to highly sensitive and confidential information. Ask them to sign a non-disclosure agreement (NDA) to provide you with protection in case they share confidential information without your permission. 

What insurance they have 

If your MSP causes you a serious issue, there may be grounds for compensation or a refund. Ask your MSP what insurance they have in place, to what financial limit, and request a copy for your records.

Managing suppliers and contracts

You need a written contract in place for your IT suppliers because they are 'data processors' under the UK General Data Protection Regulations (GDPR). This means they can hold, create or amend data on your behalf. 

Every time you employ a new supplier who will process data, you need to put a new contract in place. If your existing supplier employs another data processor, they will need to have your permission and put another contract in place. 

Under UK GDPR, both you and your data processors are responsible for complying with the law. This means that they can be given fines or have to pay compensation to data subjects (which may be your staff or service users) if they do not process data safely. 

Find out more about protecting your data on the Better Security, Better Care website.

What your contract must include

Visit the Information Commissioner's Office (ICO) website for more guidance on what contracts must include under UK GDPR.

Keeping track of your suppliers

It's important to keep track of who your suppliers are, so that you can plan for contract renewal or changes when your contract is up. You might find it helpful to record and store the following details for each contract:

• supplier name and contact details
• type of product and/or service they provide
• where the contract is stored
• start and end dates of the contract

Changing suppliers

If for any reason you are not happy with your current supplier, you will need to cancel your contract. Consider the following steps when you do.

Give notice 

Look at your contract to understand:

• how to give notice - if you need to write a formal letter or is an email enough
• who to give notice to - if you need to contact a specific person
• when to give notice - if there is a notice period for the contract

Consider the transition period

You will need to decide when the old supplier stops working for you and the new MSP starts. You may need to pay both MSPs for a short period of overlap, called a transition period. Transition periods are useful for the new MSP to work alongside the old MSP and learn about your business and systems.

Ask further questions to understand what the transition looks like. For example:

• how long will it last for and at what point will the new MSP take responsibility from your old supplier?
• how will the data be transferred across? 

Ask about documentation

Most MSPs will create documents about your computer systems, with details such as:

• usernames and passwords for systems
• lists of equipment and software
• network information 
• how, where and when your systems are backed up
• third party phone numbers and contracts 

When changing suppliers, ask about getting access to these documents. At a minimum, your MSP should provide you with usernames and passwords to your systems. 

Communicate the change internally

You will need to tell your team: 

• when to stop contacting your old MSP
• how to contact the new MSP
• what to expect when they contact the new MSP

Ask your new MSP about their onboarding process to find out these details. 

Remove access

Make sure your old supplier's access to your systems is removed and passwords changed (your new MSP will normally do this).

Updates to this page

Sign up for emails or print this page

Contents