Onboarding artefacts

The Supplier Conformance Assessment List (SCAL)' s purpose is so a a product supplier or end user organisation if they are developing an inhouse product, can declare and record that their product complies or meets with a range of organisational, technical product and compliance requirements. Including information governance and security, clinical safety and individual user interaction. 

The SCAL provides end user organisations with information so they can assure themselves to ensure the product they have developed reaches the right quality compliance requirements and standards.  The developing party is responsible for providing the information for the SCAL.

The SCAL underpins the technical conformance process and is included in the connection agreement that every supplier signs before their product can connect to NHS Digital's services. 

A SCAL is per (supplier) product, however a single SCAL can cover integration to more than one NHS Digital service.

The SCAL maps all the requirements needed to link with a specific service and the evidence required during the technical conformance process and is supplier or product focused.

With the SCAL,  the connecting party logs where a product meets the technical, information governance and clinical safety requirements in a technical and business context.

Many sections of the SCAL can be completed in parallel to the testing so it is recommended that all connecting parties familiarise themselves with the SCAL as early in the process as possible.

On successful completion of the SCAL process a Technical Conformance Certificate (TCC) is issued

If the organisation has previously completed a SCAL for an NHS Digital product: the organisation will need to update the general and architecture tabs and complete the required NEMS tabs.

If the organisation has NOT completed a SCAL for an NHS Digital product: the organisation will need to update the general and architecture tabs and complete the required NEMS tabs.

The SCAL is working document and will be updated through each stage to reflect testing activities and evidence. It contains guidance to help complete the required information and to complete the assurance requirements for onboarding.  

The connection agreement is the agreement with the connecting party who is processing the data (this is either the publisher or consumer) either as a processor subject to contract with a provider, or as the controller for the data and health and care provider.

The agreement is formed formed between the connecting party and NHS Digital. comprises of a set of terms and conditions, links to the SCAL, and any special terms for a service and exists as an agreement for the duration of connection to the service.

It references the end user organisation and individual end user obligations. It only needs to be completed by the organisation directly connecting to NHS Digital systems.  

Controllers are also expected to sign a Data Sharing Arrangement (DSA) that sets out their data protection responsibilities as controller for the event message, either as subscriber or publisher.  DSA, is the responsibility of the connecting party to ensure the DSA is made available to their end users and they agree to the arrangement.