ORCHA & Cloud Gateway partnership: Safe health products need secure foundations

We're pleased to share that we're partnering with Cloud Gateway, a UK provider of secure infrastructure services to the NHS, central government, local authorities and police forces. 

Whilst here at ORCHA we're focused on assuring that digital health products are safe to use, Cloud Gateway make sure the infrastructure that those products run on can be trusted and evidenced.

Health and care organisations increasingly expected to demonstrate compliance across both areas, though the two halves are rarely joined up.

Read on to learn more about why we're working together to give suppliers and developers a more straightforward route to proving they have both a safe product and secure foundations. 

The pressures our customers share

A digital health product can pass every assessment going — clinical safety, data protection, technical stability — and still run on infrastructure nobody can properly account for. The product is assured. What it runs on, connects through and moves data across often isn't, at least not by anyone who can evidence it on demand.

Now more than ever, health and care organisations are being asked to prove safety and security to boards, auditors and regulators, and the proof increasingly has to cover the whole chain rather than the layer at the top.

Cloud Gateway work on the layer beneath the one we do, for many of the same organisations, and they approach it the way we approach ours.

Who ORCHA is, for Cloud Gateway readers

ORCHA assesses digital health products - apps, platforms and increasingly AI-enabled tools - against the standards health and care organisations need them to meet before they can be recommended or deployed.

We've completed more than 40,000 assessments across 9,000 products. Only around one in five meets the basic standards for safety, privacy and usability, which is the reason we exist. Health systems need a reliable way to tell the difference, and the vendors building good products need a way to prove which side of the line they're on.

Health and care organisations use our assessments to decide what they put in front of patients and staff. Developers become ORCHA Assured to get assurance-ready and stay that way, instead of rebuilding the evidence from scratch every time a new requirement lands, and demonstrate their product meets the safety standards patients and buyers expect.

Who Cloud Gateway is, for ORCHA readers

Cloud Gateway is a secure infrastructure operating platform built for organisations that cannot afford to fail. We bring connectivity, security and observability together as one service, delivered by our UK-based team on sovereign infrastructure, under one operating model.

Founded in 2017, Cloud Gateway works with NHS trusts and ICBs, central government, local authorities and police forces, along with the healthcare and government technology providers who serve them. Customers include NHS England, X-Lab, Boots Digital Health and Cleveland Clinic. At our core we're an engineering company, with deep experience in regulated environments. Delivery is fully managed or co-managed, backed by a 24/7 UK-based Network Operations Centre, and accredited to ISO 27001, ISO 9001, ISO 14001 and Cyber Essentials Plus, with HSCN and PSN connection status.

What brings most health and care organisations to us is evidence. Services rarely fail inside one neat technology silo. They fail in the gaps between suppliers, and those gaps are also where governance debt builds up: controls nobody can demonstrate on demand, and questions nobody can answer quickly. Running connectivity, security and observability as one service means the evidence a board, an auditor or a DSPT submission calls for is a product of how the service is operated, rather than something assembled by hand every time it's asked for.

The same problem, one layer apart

A vendor taking a digital health product through DTAC handles clinical safety, penetration testing, data protection and information governance as four separate conversations with four separate specialists, then assembles the result into something a health system will accept. Assurance ends up being built by hand, over and over.

Cloud Gateway's customers meet the same problem one layer down. Networks, clouds, firewalls and remote access bought as separate contracts, with no single party accountable for how they behave together, and no straight answer available when an auditor asks what went wrong.

Both organisations exist because that fragmentation is slow, expensive and almost impossible to evidence. Both of us are built on the view that organisations should be able to get one accountable answer rather than five partial ones. That shared starting point is why we're developing ways for our clients to navigate both product and infrastructure assurance at scale.  

George Stern, Strategic Solutions Lead, Cloud Gateway, said:

"Many of our conversations start with a network or a security control and end up somewhere else entirely: what's running across it, and what evidence can be generated to prove the estate is working as it should. Health and care organisations are either building or buying digital tools at rapid pace - requiring them to deploy quickly but still evidence them thoroughly. Those two pressures pull against each other. Every gap between suppliers is somewhere governance debt can build, and assurance that stops at the product boundary leaves one of the biggest gaps of all. ORCHA have built the independent evidence base for the product layer at a scale nobody else in the UK has. We do that job one layer down, our combined expertise is greater than the sum of its parts."

Jordan Hawkings, Head of Partnerships at ORCHA, said:

"Most of the assurance conversation stops at the product. But a product is only as safe as what it runs on, and very few organisations can see both at once. Pair that with AI arriving faster than most organisations can put controls around it, the question of what these tools run on, and who is accountable for it, become much harder to leave until later. Cloud Gateway understand the infrastructure layer the way we understand the product layer and I'm excited to explore how we can help our customers together."

What's next

We're working out where our two organisations are most useful to each other's customers, and we'll share more as that takes shape. In the meantime, if you're building or buying digital health technology, both halves of this picture are worth your attention. 

Visit Cloud Gateway to learn more or contact ORCHA to discuss how we can help.