Recently active items

To ensure the security and resilience of the EIDO Consent Suite, we conduct annual penetration tests using a CREST-certified third-party provider. This independent assessment helps identify vulnerabilities and confirm that our systems are robust against cyber threats. Our current testing partner is Predatech. Please note: we typically provide a summary report only. The full penetration test report is confidential and not shared externally.  LinksAccess summary reports and related documentation: EIDO Penetration Test Reports on SharePoint. Learn more about our testing partner and their services: predatech.co.uk. 

The Data Security and Protection Toolkit (DSPT) is an online self-assessment tool used by organisations to measure their performance against the National Data Guardian’s 10 data security standards. Any organisation that accesses NHS patient data or systems must use the DSPT to demonstrate good data security practices and responsible handling of personal information.  LinksView our organisation’s DSPT status and submission: EIDO’s DSP Toolkit certificate. Learn more about the toolkit and its requirements: DSP Toolkit homepage. 

The Information Commissioner’s Office (ICO) is the UK regulator for data protection and information rights. It is sponsored by the Department for Science, Innovation and Technology. Under the Data Protection (Charges and Information) Regulations 2018, organisations—including sole traders—that use personal information must pay a data protection fee, unless exempt. Both EIDO Systems and EIDO Healthcare are registered with the ICO. Our Data Protection Officer is Aisling Hemmings of Merrion Consultants.  LinksGovernment information about the ICO and its role: ICO overview. Learn more about data protection and your responsibilities: ICO official website. Check the registration status of any organisation: Search the ICO register. Access our certification records and supporting materials on SharePoint: EIDO’s ICO registration documents. 

Cyber Essentials is a Government-backed certification scheme that helps protect your organisation and your customers from cyber threats. It sets out the minimum standard of cyber security recommended by the National Cyber Security Centre (NCSC). There are two levels of certification:Cyber Essentials Cyber Essentials Plus Both EIDO Systems and EIDO Healthcare are certified at both levels. Our outsourced development partner in South Africa, IO, is also certified for both.  LinksCyber Essentials Documentation on SharePoint Cyber Essentials Overview – NCSC

The Digital Technology Assessment Criteria (DTAC) is a national standard used by NHS and social care organisations to assess digital health technologies. It ensures that suppliers meet minimum baseline requirements across five key areas:Clinical safety Data protection Technical security Interoperability Usability and accessibility DTAC gives staff, patients and citizens confidence that the digital tools they use are safe, secure and effective. We originally completed a DTAC with NHSX, but that certificate is now outdated and not renewed. Feedback from NHS Trusts indicates that many now carry out their own DTAC assessments and request supporting documentation directly from suppliers.  LinksAll supporting documentation and the completed DTAC form on SharePoint: EIDO DTAC Documentation NHS DTAC Overview

We take clinical safety seriously. The EIDO Consent Suite is supported by a full DCB0129 clinical safety case and a regularly maintained hazard log. These documents are designed to meet national standards and ensure safe use of health IT systems in clinical environments. Our Clinical Safety Officer is Natalie Hall, a specialist from Safehand. As part of your implementation, your organisation will need to complete a DCB0160 process. This will be guided by our existing clinical safety case and supported by our team. Please note that this information is commercially sensitive and will be shared directly with your project team during implementation.  LinksDCB0129 Clinical Risk Management Standard EIDO Clinical Risk Documentation on SharePoint 

EIDO may receive patient data from hospital customers for use in its digital products. This data is processed in line with the policy set by the customer, who acts as the data controller. How data is handledThe customer sends patient data to EIDO. EIDO processes the data using one or more of its digital products. Once processing is complete and the retention period has passed, the data is purged. The diagram below shows this workflow. What purging meansPurging redacts (anonymises) all identifiable patient data. This includes names, addresses, contact details, and signatures—wherever they appear in the core database or system log files. When the data retention period ends, the patient is added to the purge queue. Each night, a process redacts their identifiable data and logs the purge.  Retention periodsThere are two types of data retention period: Type Description Time period Standard Triggered when a patient episode is complete. Data is purged after th

If you need help using the EIDO Consent Suite, our support team is here to assist. How to get supportYou can access support through the EIDO support desk:support.eidohealthcare.com The support site includes:A searchable knowledge base with help articles Guidance on common requests and troubleshooting Contact options for technical support

The EIDO Consent Suite is a highly available platform, with a target uptime of 99.9%. You can check the current system status at:status.eidohealthcare.com This status page is also used to:Announce upcoming maintenance windows Share release notifications Provide real-time updates during maintenance Customers can subscribe to alerts via email, Slack, or API. Find out more in Deployment process.

 OverviewThe EIDO Consent Suite is delivered as a cloud-hosted Software as a Service (SaaS) solution. It runs in a highly available production environment hosted by Amazon Web Services (AWS). When new features are developed or bugs are resolved, updates are deployed to the AWS production environment. This section outlines how those updates are managed. Types of releaseEach update is packaged into a release and tested in staging and UAT environments before being deployed to production. Releases are versioned and fall into three categories: Major releaseIntroduces large-scale features or platform enhancements. The major version number changes (e.g. from 1.5 to 2.0). These may include breaking changes, which will be communicated in advance. Feature releaseAdds new functionality or improves existing features. These are typically requested by customers and versioned as 1.y (e.g. 1.6). Patch releaseFixes bugs or addresses security vulnerabilities. These are versioned as 1.1.x (e.g. 1.1.3). B

This checklist outlines the key actions that must be completed before and during go-live to ensure a safe and successful launch of the Consent Suite. Information governance and clinical safetyData Protection Impact Assessment completed and approved Clinical Safety Case Report (DCB0160) signed off Standard Operating Procedure (SOP) updated and approved Cloud Security Assessment (DTAC) completed and approved Digital consent forms signed off for live use IT set-upProduction environment deployed and fully tested, including connectivity and end-to-end consent workflows Patient data flow enabled (recommended 4 weeks before go-live to enrich the system). This step only applies to customers sending patient data, not using query-response only. All required hardware (e.g. iPads) tested and ready for use Staff user accounts created and confirmed on the live system IT support accounts created for first-line support at the hospital Support and communicationBusiness continuity plan in place (refer t

EIDO provides structured training to support a smooth transition from paper-based to digital consent. Training is tailored to different user roles and delivered in a way that encourages early adoption and confidence in the system. Clinician trainingWe’ll attend audit meetings, consent working groups, or other sessions where we can reach a broad group of clinicians. These sessions include a live demonstration of the system, showing how standard users carry out consent. Sessions typically last 60 minutes and can be recorded for wider sharing. Department-specific training can also be arranged with your EIDO Implementation Lead. Admin user trainingAdmin users manage system settings and user accounts. Their training covers all admin functions and typically lasts 60 minutes. Refresher sessions can be arranged as needed. Topics include:Adding, editing, and archiving user accounts Audit and reporting Creating custom information articles Managing system settings, including IT integration option

You can create a deep link from your Electronic Patient Record (EPR) or Patient Administration System (PAS) directly to a patient’s record in the EIDO Consent Suite. This is done using a patient search URL. How it worksThe URL includes query parameters that allow the Consent Suite to search for a patient using one of the following identifiers:ID Patient Number Medical Number NHS Number ExampleTo search for a patient using their NHS number, the URL would look like this:/patients?search=4857773456&key=nhs_numberThis example searches for a patient with the NHS number 485 777 3456. Note.The base URL for sandbox is: sandbox.eidodigital.comThe base URL for UK prod is: uk.eidodigital.com

When a consent form is completed, a PDF is generated and stored in the patient’s record. There are several ways to return this PDF to your hospital systems:SFTP JSON Webhook HL7 MDM JSON API The document return process is event-driven. Specific events in the consent session—such as “patient complete” or “consent form complete”—can trigger actions. The method you choose will depend on your organisation’s internal capabilities. SFTPSFTP configuration is managed within the Consent Suite dashboard:Go to Settings in the main menu. Select SFTP Settings from the left-hand menu. Add a new SFTP connection by entering your server details. Under the Trigger Events tab, choose which events should initiate the transfer. The PDF will be delivered to your specified folder on the SFTP server. JSON WebhookWebhooks allow third-party systems to extend the Consent Suite’s functionality. A webhook is a type of notification—also known as an HTTP request or callback—that sends a small payload of data to anot

 Simple, secure access for your usersSingle Sign-On (SSO) allows users to access the EIDO Consent Suite using their existing credentials—no need to remember another password.Once SSO is enabled, users who are already logged into their computer can open the Consent Suite and be signed in automatically. If your EPR is integrated with EIDO, users can simply click the EIDO button and go straight to the dashboard—no extra login required. Supported identity providersWe currently support integration with:Microsoft Entra ID (formerly Azure Active Directory) NHS Mail ImplementationSSO setup is handled by your IT team. We provide a detailed step-by-step guide in our knowledgebase to support the process: Knowledgebase: Single Sign On 

 Secure, flexible integration with your EPRThe HL7 Bridge enables a secure connection between your hospital network and the EIDO cloud platform, hosted on AWS. It allows HL7 messages containing patient demographic data to be sent from your EPR to EIDO, where they are parsed and added to your organisation’s account. Each customer has a dedicated HL7 listener instance. This ensures data isolation and security, and allows updates to be deployed to one customer without affecting others. How it worksHL7 Bridge diagramAn event in your EPR triggers the Trust Integration Engine (TIE) to send an HL7 message to EIDO. The HL7 listener receives the message, extracts the patient demographic data (PID segment), and adds the record to your EIDO account. Only the PID segment is required - no episode or patient history data is needed - making this a lightweight and flexible integration. Event triggersYou choose which events in your EPR or TIE will trigger messages to EIDO. Common examples include:Patie

 Seamless integration with hospital systemsThe EIDO Consent Suite is built to work smoothly with a wide range of hospital systems. We offer flexible integration options to suit the varied workflows and technical environments across healthcare organisations. How it worksUsing our secure API, the Consent Suite connects directly with your Electronic Patient Record (EPR) or Patient Administration System (PAS). This allows for the secure exchange of patient demographic data and completed consent forms in PDF format.Secure data exchange diagramOur API supports HL7, FHIR and JSON data formats, giving you the flexibility to integrate in a way that works best for your organisation. Designed for all pathwaysThe system is pathway-agnostic, meaning it can support any patient journey or consent workflow. Here’s how it typically works:Patient demographic data is sent to EIDO before the consent discussion. The clinician uses the EIDO dashboard to complete the consent process. Once consent is recorded

Before initiating deployment, please ensure the product requirements document is completed and reviewed. This document provides the foundation for configuring the Sandbox environment and aligning the Consent Suite setup with the customer’s clinical and operational needs. The Sandbox environment will be used throughout the integration and consent workflow testing phases. You will be provided with a Product requirement document as part of the implementation. The product requirements document is a living document and will evolve throughout the project lifecycle. These initial details are needed to streamline the build process, reduce rework, and support a smooth go-live: Full name and address of the Trust or Hospital Primary admin user details Product modules to be enabled (e.g. PDF, Article, Consent) Agreed procedure list Required consent forms (e.g. CF1, CF2, CF3, CF4) Patient data configuration (which demographic data points are needed) Customised content requirements – agreeing these

This meeting is focused on agreeing the technical approach for integrating the EIDO Consent Suite with your organisation’s systems. It builds on the base outlined in Integration options and should include colleagues with relevant technical knowledge. Attendees:EIDO Implementation Manager EIDO Product Director EIDO IT Engineer (if required) Trust or Hospital IT Lead Trust or Hospital Project Manager Agenda:Patient demographic messaging Document storage and retrieval Authentication via Active Directory / Single Sign-On (optional) IT networks and infrastructure (firewalls, connectivity) Trust Integration Engine (TIE) Actions:Agree the approach for sending demographic data to EIDO Agree the method for returning PDF consent forms to the document management system Confirm infrastructure setup, including VPN and firewall configuration Schedule follow-up meetings as needed 

The kick-off meeting marks the formal start of the implementation project. It brings together all key stakeholders to agree the scope, responsibilities, timelines, and next steps. This meeting sets the foundation for a successful deployment of the EIDO Consent Suite. Before the meeting: Preparation Task Details Confirm attendees All project stakeholders should be identified and invited. Share API specification Ensure the API specification document is circulated in advance.  Suggested meeting agenda: Agenda Item Details Project scope Confirm the intended scope of the implementation. Roles and responsibilities Identify key stakeholders and confirm their roles (refer to the Resource Planning section). Delivery timescales Agree timelines for each phase: • Phase 1 – Initial specialty roll-out and early adopters • Phase 2 – Hospital-wide roll-out • Phase 3 – Full trust-wide roll-out

To ensure a successful implementation of the EIDO Consent Suite, it’s important to identify the key stakeholders and confirm their responsibilities early in the project. This section outlines the typical roles involved, along with guidance on confirming their duties and expected time commitments outside of clinical responsibilities.  Role Responsibilities Time Commitment EIDO Implementation / Project Support Lead Oversee implementation activities and coordinate between internal teams and EIDO. 10-20 hours per week Project Sponsor Provide strategic oversight and executive support. Often a CCIO or Consent Board Lead. 1 hour per week (more during kick-off and go live) Trust or Hospital Project Manager Manage project timelines, resources, and internal coordination. 10-20 hours per week Consent Clinical Lead Provide clinical leadership and ensure alignment with consent processes. 2-

The EIDO Consent Suite is a digital application designed to support and enhance the consent process in healthcare settings. It allows clinicians to create digital consent forms, share high-quality procedure information with patients, and collect signatures remotely when needed. By improving access to clear, trusted information, the system helps both patients and clinicians take part in a more informed, collaborative, and efficient consent process. The application is accessed through a secure online dashboard, where clinicians can manage the full consent journey. Patient data can be sent to the Consent Suite using a secure integration. Multiple options are available, including how the completed consent form is returned to your clinical systems. During implementation, EIDO will help configure the system to meet your organisation’s needs. This includes customising consent forms and workflows – whether you need anaesthetic consent, image permissions, or something bespoke. You can read more

The EIDO Consent Suite is a digital solution that helps healthcare organisations improve the way they manage patient consent. From enhancing patient understanding to supporting clinical teams, the Consent Suite helps embed a safer, more consistent consent process. This toolkit is designed for project teams responsible for deploying the EIDO Consent Suite. Inside, you'll find technical guidance, implementation resources, and step-by-step support to help you deliver a smooth rollout. The System overview article is a good starting point, or jump into some System configuration information about the application. If implementation is your area, then the Project set-up section will guide you through the process.  What does implementation involve?The implementation process is designed to be structured and collaborative. Here’s a summary of what to expect:Kick-off and planningAgree your delivery scope, set timelines, and define roles. A project initiation document will guide the setup.Resource