FOI 25-561 EPRF Supplier Contract

Freedom of Information Request

Reference
FOI 25-561 EPRF Supplier Contract
Request Date
02 Dec 2025
Response Date
22 Dec 2025
Information Requested

SECTION A – Contract & Commercial Information (Priority 1) 

For your current ePCR solution, please provide the following: 

A1. Supplier & Contract Details 

  •         Name of the current supplier.
  •         Contract reference number (where applicable).
  •         Contract start date, initial end date, and all extension options available.
  •         Whether any extensions have already been exercised, and the updated end date.
  •         Total contract value, including any exercised extensions.
  •         Annual contract value or recurring annual charges.
  •         Pricing model used (e.g., per-user licence, per-device licence, per-incident, enterprise licence).
  •         Volume metrics underpinning the contract (e.g., number of operational staff, number of devices, number ofePCRsubmissions per year). 

  

A2. Scope of Services Included in the Contract 

Please confirm whether the contract includes the following, and if so, provide details: 

Software & Support 

  •         1st/2nd/3rd line support model, including operating hours and SLAs
  •         Hosting, cloud infrastructure oron-premisecomponents included 
  •         Application updates & release management
  •         Uptime requirements / contractual service levels

Hardware & Device Support (if applicable) 

  •         Supply, warranty, or lifecycle management for tablets or mobile devices
  •         Mobile Device Management (MDM) solution included
  •         Whether rugged cases, vehicle docking, or peripheral hardware is included

Vehicle Installation & Equipment Support 

  •         Installation/fitting ofePCR-related hardware in vehicles
  •         Ongoing maintenance of any vehicle-mounted equipment
  •         Whether installation was carried out directly by the supplier or subcontracted

Mobile Network & Connectivity 

  •         Mobile network providers used forePCRoperation (e.g., EE, O2, Vodafone, multi-SIM, roaming SIMs) 
  •         Whether mobile network services are included in the contract orprocuredseparately 
  •         Any bandwidth management, APN, or private network arrangements

Mobile Data Usage 

  •         Approximate monthly or annual mobile data usage attributable to theePCR(e.g., GB per device or total Trust usage, if held) 

 

 

  

SECTION B – Contractual Documentation (Priority 2) 

For your current ePCR solution, please provide: 

  •         A copy of the signed contract, including all schedules,appendicesand specifications 
  •         Copies of any contract variations or change control notices (CCNs) relating to:

o   functional scope 

o   licensing or cost changes 

o   hardware refreshes 

o   service level changes 

  •         Any documented cost-of-change assumptions used during the procurement or contract negotiation phase.

  

SECTION C – Procurement Process & Evaluation (Priority 3) 

For the procurement that led to your current ePCR system, please provide: 

C1. Procurement Route 

  •         Procurement route used (Open, Restricted, Framework, Direct Award, Further Competition).
  •         If a framework was used, please confirm the framework name,lotand call-off reference. 

C2. Tender Documentation 

  •         Full technical specification and requirements used during tendering.
  •         Any annexes, security or hosting requirements, functional requirements, user stories, or evaluation guidance.
  •         Any pre-market engagement documents (PIN, soft-market testing materials) where held.

C3. Evaluation Outcomes 

  •         List of all bidders.
  •         Full evaluation criteria and weighting breakdown.
  •         Scoring summary for all bidders, including:

o   Technical score 

o   Commercial score 

o   Overall score 

  •         Evaluator comments or narrative assessment notes.

  

SECTION D – Technical Architecture, Interoperability & Security (Priority 4) 

D1. Monitor/Defibrillator Integration (Interoperability) 

  •         Current defibrillator/monitor vendor(s) used operationally.
  •         Integration method with theePCR(e.g., Bluetooth, cable, serial feed, cloud-mediated, proprietary integration). 
  •         Whether vital-signs data is transferred device-to-device, via a mobile app, or through a cloud API.
  •         Any known limitations (e.g., iOS Bluetooth restrictions, Android compatibility issues).

D2. Endpoint Security, MDM & Compliance 

Please confirm the following for ePCR-related mobile devices (tablets, ruggedised devices, etc.): 

  •         Whether Microsoft Advanced Threat Protection / Defender for Endpoint is used.
  •         If not, please confirm the alternative endpoint protection solution.
  •         MDM or mobile security platform used (e.g., Intune,AirWatch, MobileIron, Samsung Knox).
  •         Minimum OS version requirements and patch/update policies.
  •         Update window requirements (e.g., iOS must be updated within X weeks of release).

D3. Hosting & System Architecture 

  •         Hosting model (SaaS, cloud, private cloud,on-premise).
  •         Cloud provider (if applicable).
  •         Any documented disaster recovery or failover arrangements.

  

SECTION E – Training, Adoption & Deployment (Priority 5) 

For your current ePCR system: 

  •         Structure of training provided to staff (classroom, online, LMS/SCORM modules).
  •         Duration of training for frontline clinicians.
  •         Any refresher or ongoing training requirements.
  •         Copies of training materials, user guides, quick referenceguidesor onboarding packs (redacted if necessary). 
  •         Whether training was provided by the supplier, Trust staff, or a blended model.

  

SECTION F – Organisational & Operational Information (Priority 6) 

(For context only) 

  •         Total number of clinical staff (FTE or headcount).
  •         Total number of tablets or mobile devices used forePCRacross the Trust. 

  

SECTION G – Collaborative Procurement (Priority 7) 

  •         Any shared purchasing arrangements, consortia, or joint procurements the Trustparticipatesin relating to ePCR. 
  •         Details of any call-offs or shared contracts awarded through these arrangements.
Response

Section A, B & C 

The Scottish Ambulance Service have applied section 25 of the Freedom of Information Scotland Act 2002, this information is considered as already reasonably accessible, The information you have requested about the Service’s electronic patient care record (ePCR/ePR) supplier, contract dates and extensions, and related contractual particulars is already published and can be accessed at the links below - FOI 24-379 EPRF Contract Information. 

The Scottish Ambulance Service’s contract notices and register entries are available on our buyer profile on the PCS portal:  

We hold the contract documentation; however, we are withholding it under section 33(1)(b) (commercial interests) because disclosure of detailed contractual terms, pricing schedules and supplier‑confidential annexes would, or would be likely to, prejudice substantially the commercial interests of the Scottish Ambulance Service and the supplier. Where relevant, we would also need to redact third‑party personal data under section 38(1)(b). In applying section 33, we have considered the public interest and judged that, on balance, maintaining the exemption outweighs disclosure in this case; key contract particulars are already accessible via published notices (see PCS link above)  

SECTION D – Technical Architecture, Interoperability & Security (Priority 4) 

Under section 25(1) of FOISA (information otherwise accessible), SAS is not required to provide information that is reasonably obtainable by you otherwise than under FOISA. Where relevant material has already been published, we have provided links below. For matters where SAS does not have published sources, we explain this and set out exemptions that would apply to any request for sensitive internal detail. 

SAS’s contracts schedule confirms Ortus Technology is the supplier for ALS monitor/defibrillators (contract from 01/04/2019 to 31/03/2026, with three optional one‑year extensions; c.600 units).  - FOI 24-387 System Contracts 

SAS’s defibrillator replacement Full Business Case (public version) confirms an interface between the ALS monitor/defibrillator and the electronic patient record (ePR/ePCR), with telemetry transmitted via the device SIM or in‑vehicle communications hub to Coronary Care Units (CCUs) and into the ePR/ePCR. The Equality Impact Assessment also references integration and data flow to CCUs/partners. - defibrillator-replacement-fbc-v0-05-public-version.pdf 

We are withholding the information requested in D2 and D3 under section 30(c) of the Freedom of Information (Scotland) Act 2002 (FOISA). Disclosure would, or would be likely to, prejudice substantially the effective conduct of public affairs, by materially increasing the cyber and operational risk to the Scottish Ambulance Service (SAS) and the systems that support patient care.  Releasing these control-level specifics would expose defensive patterns and residual risks that attackers could exploit. 

SECTION E – Training, Adoption & Deployment (Priority 5) 

Most ePCR training and guidance is delivered online via the training portal TURAS – NHS Education for Scotland learning portal.  Staff can log on to Turas to complete assigned training modules which typically include e-learning packages, knowledge checks and summaries and occasionally short virtual/face-to-face sessions arranged locally for roll-outs or significant system changes. 

The training is self-paces and module-based, so duration varies by role, module and update cycle.  It is for this reason we have applied section 17 of the Freedom of Information Scotland Act 2002 as information not held for a single consolidated figure for ‘duration’ of training.  

There is training for new staff (onboarding) and refresher training for existing staff.  Refresher training frequency can change depending on system updates, new features or policy changes.  Update modules and guidance are assigned through Turas when required. 

Once the Turas training has been completed, staff have access to an online test site where they can practice putting their training into practice. 

 

SECTION F – Organisational & Operational Information (Priority 6) 

Current staffing figures are reported in the annual accounts report on the Scottish Ambulance Service website - SCOTTISH AMBULANCE SERVICE 

There is also information on the Scottish Ambulance Service website detailing the ICT aspect of suppliers and usage of tablets and mobile phones on the Scottish Ambulance Service website - Information and Communications Technology Frequently Asked Questions 

 

SECTION G – Collaborative Procurement (Priority 7) 

The Scottish Ambulance Service does not have any shared purchasing arrangements in relation to ePCR.  There is also no information held on call-offs or shared contracts through these arrangements. 

In This Section