Management
RFP 32: Data Retention
0. DOCUMENT CONTROL
0.1 Summary
This paper requests proposals from Atos Healthcare to implement the Authority’s data retention requirements.
0.2 Key Personnel
Role Name/Position
Author S Harrison/Anthony Roberts Approved by H Coates
Authorised by Barbara Butcher
DISTRIBUTION
H Coates CMMS Barbara Butcher CMMS Pat Ryall JCP M Swithenbank JCP
M Prickett Atos Healthcare S Heys Atos Healthcare Commercial Team Atos Healthcare
1.0 BACKGROUND
1.1 The Data Protection Act details eight Data Protection Principals that must be followed on how Personal Data must be processed both on IT systems and on paper. Data processors need to make sure that all Personal data held on IT systems is:
fairly and lawfully processed; processed for limited purposes;
adequate, relevant and not excessive; accurate and up to date:
not kept for longer than is necessary; processed in line with an individual’s rights; secure
not transferred outside of the UK.
1.2 The Information Commissioner and Cabinet Office have issued direct advice regarding the security of sensitive information. In addition, following a cross Government review of the transfer of Personal Data via electronic media, this advise has been incorporated into subsequent DWP Security communications which outline specific security measures to which all Contractors to the DWP who deal with Personal Data must comply with to ensure the secure transfer of Customer data transferred between the Contractor, the DWP, other
Government Departments, and other suppliers.
1.4 Following the introduction of LiMA and MSRS, Atos Healthcare stores a significant amount of claimant data on behalf of the Authority. The Authority has not defined it’s data retention requirements for this data and this RFP outlines the Authority’s electronic data retention requirements.
2.0 SERVICE DESCRIPTION
2.1 Unless otherwise stated within this RFP, the current contracted terms and conditions will apply.
2.2 Atos Healthcare MUST implement the Authority’s data retention requirements detailed in appendix A.
2.3 Atos Healthcare MUST provide details how it will implement the Authority’s data retention requirements.
2.4 Atos Healthcare MUST confirm that the implementation of the Authority’s data retention requirements complies with security accreditation, and the data protection act.
2.5 Atos Healthcare MUST inform the Authority immediately should any difficulties or issues arise with the project.
3.0 Commercials
3.1 Atos Healthcare MUST propose any one time costs associated with introducing the Authority’s data retention requirements. .
3.2 Atos Healthcare MUST provide a pricing model which include:
A pricing sheet setting out all priced elements in relation to activity e.g. recruitment and training, IT costs, programme management etc...
Detailed input sheets by calendar month setting out:
The man day/resource/effort showing each category/grade of personnel linked to the resource profile.
Details of named individual where man day/resource is being applied.
Any infrastructure, hardware, middleware, software costs (if required), asset inventory for both development test and live running.
Any 3rd party supplier costs
If applicable a risk matrix which shall identify all risks and itemise each of them separately showing what each risk is, when it is likely to occur and the relevant re-numeration allocated to it;
a worksheet setting out the proposed milestone payment relating to the milestone plan.
3.3 Atos Healthcare MUST propose and agree a Milestone Plan and Achievement Criteria with the Authority in relation to payment of one time costs. Such
milestones should cover the successful completion of activities.
3.4 Atos Healthcare MUST note that Milestone payments must exclude any element of profit until the final Milestone is achieved.
3.5 Atos Healthcare MUST provide a Milestone completion report following the completion of each Milestone, the format of such a report to be agreed with the Authority. If the Contractor has met all relevant Achievement Criteria the Authority shall issue an Achievement Certificate to the Contractor. All
Achievement Criteria relating to all previous milestones must be met to issue an Achievement Certificate.
3.6 For the avoidance of doubt, the Authority shall be under no obligation to pay any Charges until Achievement Criteria have been met and an Achievement certificate has been issued.
3.7 Atos Healthcare MUST propose any fixed costs relating to this change.
4.0 RESPONSE
4.1 Atos Healthcare MUST provide a full response, including a detailed
breakdown of One Time, Fixed and Variable costs by 15th December, 4 pm, 4.3 All volumes and costs (if appropriate) MUST be provided in Contract years i.e.
Sept to Aug.
4.4 Measurement of the Response to this RFP shall be assessed against all requirements detailed within this RFP.
4.5 In summary the Response MUST detail:
Management Summary
detailed Proposals in the same structure as the RFP
commercial and operational assumptions. This must include details of who The Contractor consider ‘owns’ the assumption, criteria for review and/or where appropriate, proposals for managing changes
Issues Log
table clearly demonstrating where each Mandatory requirement is addressed Responder’s Details Details of Originator Signature: Name: Job Title:
Organisation: Medical Services Contract Management Team Date Submitted to CONTRACTOR:
Date for Response by Contractor 4pm Signature: Organisation / Dept: MSCMT
Appendix A: Authority Data Retention Requirements:
a) Purge all data (e.g. Client, Case, Referral, medical reports and other related child data) for any client for whom that latest ESA referral was closed 3.5 years ago;
b) Purge all Cases (IB or ESA) and related child data where there are two later Cases (IB or ESA) for that Client (ignoring any Cases with no Medical Output record), unless this Case contains the latest approved exam output (ignoring WFHRAs) and the output is held electronically (i.e. if it was done clerically then it can be purged because JCP will hold the paper report); in broad terms this will purge cases other than:
the last two cases on which electronic PCA/WCA medical reports exist
the case holding the latest electronic IB/ESA85
c) As a one-off exercise on completion of the IB migration process (as explicitly notified by Jobcentre Plus), purge all remaining IB cases and related child data (at this point we will thus be able to strip out all IB-specific reference data from MSRS).
In addition to the above, it is proposed that the following additional measures be considered in order to avoid retaining data on MSRS unnecessarily:
d) Purge all withdrawn and rejected referrals of any type 14 months after referral closed (but retaining any related MED3 if there is a later referral on the Case). e) Purge all WFHRA referrals (including all scheduling data, letters, medical
outputs etc.) 14 months after referral closed.
f) Purge all pre-Release 2 referrals immediately (as these are all closed and none have medical reports on the system)
g) Purge all filework and exam ‘case data’ 14 months after referral closed (since it’s only required to support requests for rework, which we always receive within 12 months)
Note that Dr Ed McDermott has confirmed that this data is not required to support the reconsideration process. Under reconsiderations, the previous exam report is considered and a new ESA85A is created containing advice. Where necessary the client can be re-examined in which case a new ESA85 would be produced.
