SharePoint Clinical Repository Setup

Statement of Work (SOW)
SharePoint Online Clinical Repository Configuration
NHSmail Shared Tenant (@nhs.net) Ecosystem
1. Project Objective & Execution Model
The objective of this engagement is to establish a secure, compliant, and highly structured SharePoint Online workspace optimized for clinical document management and internal collaboration. Due to the unique restrictions of the central NHSmail shared tenant infrastructure, this configuration will be built entirely within existing platform constraints, utilizing native functional controls rather than custom back-end scripting.
To achieve maximum cost efficiency, this project will be executed using a single blended Consultant model (covering both information architecture and functional engineering) working directly via pre-authorized Local Administrator (LA) accounts provided natively by the Trust.
2. In-Scope Activities & Deliverables
The consultant is exclusively responsible for executing the following two core work packages:
Work Package 1: Architecture, Metadata, & Permission Design
• Clinical Metadata & Taxonomy Blueprint: Design a flat Information Architecture utilizing SharePoint Content Types and the Managed Metadata Service (Term Store). This includes mandatory tagging columns (e.g., Clinical Specialty, Document Type [SOP/Guideline/Rota], Review Date, and Document Owner).
• Permission Mapping Matrix: Architect a robust permission hierarchy that aligns with the NHS Data Security and Protection Toolkit (DSPT). This involves planning structural isolation for sensitive clinical directories (e.g., MDT files, audit logs) while maintaining 'Read Only' access for frontline staff on standard operational paths.
• Governance & Versioning Control: Design a major versioning framework (retaining historical iterations) paired with a Content Approval workflow to ensure draft clinical items remain hidden from frontline staff until officially approved by a designated Clinical Lead.
Work Package 2: Hands-On Portal Building & Configuration
• Site Provisioning & Workspace Setup: Log in via the Trust’s provided Local Admin account to provision the target SharePoint site collections natively within the central NHSmail Portal infrastructure.
• Custom View & Filter Generation: Build optimized, user-friendly document library views, search indexes, and metadata-driven navigation filters so clinical staff can retrieve urgent files seamlessly.
• Security & Access Group Mapping: Build and configure Microsoft 365 / Office 365 Groups via the central portal interface. Map these groups directly to the broken inheritance layers defined in the permission matrix to enforce strict data isolation.
3. Explicitly Out of Scope
To keep consultancy costs to an absolute minimum, the following activities are strictly excluded from the consultant's remit and will be handled entirely by the Trust’s internal IT and clinical teams:
• Legacy Data Migration: The physical migration, cleaning, sorting, or uploading of existing documents from old local network drives, shared drives, or legacy systems into the new SharePoint site.
• End-User & Staff Training: Conducting training sessions, workshops, or creating step-by-step user guides for the wider clinical team on how to use SharePoint daily.
• Central Tenant ServiceNow Escalations: Managing or submitting formal escalation tickets to Accenture or NHS Digital for third-party application assessments or global configuration changes.
• Licensing & Identity Management: Managing NHSmail user account creations, visual licensing updates, or resetting staff passwords via the national directory.
• Ongoing Maintenance & Support: Providing post-go-live technical support, troubleshooting, site modifications, or general system administration after the final build sign-off.
4. Estimated Project Schedule & Commercials
Based on a lean, independent contract framework, the project will run on a fixed schedule. DURATION AND COST TBC
5. Trust Dependencies & Constraints
The contract day rate applies strictly to productive engineering time. The Trust must guarantee that the following operational dependencies are fulfilled prior to Day 1 of the engagement:
• Pre-Authorized LA Access: A dedicated, active temporary NHSmail account with Site Collection Administrator rights must be fully provisioned, verified, and handed over to the consultant before work commences.
• Pre-Drafted Taxonomy Data: The clinical department leads must provide a basic structured matrix or spreadsheet outlining required department names, document types, and staff roles on Day 1 to prevent configuration delays.