Assessment
Somerset Council, case management system for the drug and alcohol service (ERFX1003379)
Third pass. The 8 October note left this blocked on a Proactis account we do not hold, and predicted the file would end as a no bid once the specification arrived. That prediction can now be tested, because I found Somerset's requirement list without the portal.
Recommendation: do not bid. I have recorded a SKIP so it stops returning to the queue.
The check, answered
The check was: read the Somerset spec on Proactis, and confirm whether it mandates NDTMS submission and cross-organisation multi-agency access. Both halves are now answered yes, in Somerset Council's own words.
Somerset published its requirement list as a Microsoft Forms market engagement questionnaire, linked from the preliminary market engagement notice under the same procurement identifier. The form is still live and carries 28 numbered requirements. The portal was never the only route to them.
NDTMS is mandated, twice.
2. Requirement: A system that meets the requirements of National Drug Treatment Monitoring System (NDTMS).
3. Requirement: Need to ensure that any future changes or updates to NDTMS criteria are built into the system and ready for any go live dates?
Cross-organisation multi-agency access is mandated.
4. Requirement: A system that enables role-based access in a multi-agency environment to ensure that commissioners have full access to all data.
The tender notice says the same thing in its scope line: "a secure, hosted, fully supported, multi-agency, web-based Information/Case Management System".
A third requirement confirms how deep NDTMS runs in the design. Requirement 13 asks for records on clients "not in structured treatment (for example Tier 2, Tier 4 and non-user episodes)". Structured treatment, tiers and non-user episodes are NDTMS dataset vocabulary. The council is not asking for a report at the end of a general case management system. It is asking for a system whose clinical model is NDTMS.
Be precise about what this evidence is. It is the council's published requirement list for the market engagement round that led directly to this tender. It is not the final invitation to tender specification, which still sits on Proactis. Requirements can move between the two. I am confident on direction and not on wording.
Why this is a no bid
Two walls, either of which is enough.
NDTMS. The claims library holds 211 claims. None mentions NDTMS. We hold no claim either way, so every answer to requirements 2, 3 and 13 would be a verification question rather than an answer. Requirement 3 goes further than a one-off build. It asks the supplier to commit to tracking future changes in NDTMS criteria and shipping them before each go-live date. That is a standing commitment to an England-only statutory reporting regime that Carepatron does not operate in today.
This is the same shape as the Medicaid claiming disqualifier in our rubric, which exists because jurisdiction-specific statutory submission is a product, not a feature. The rubric does not name NDTMS, so I am not claiming a literal hard disqualifier. The score lands below the threshold without it.
The certification and availability block. Requirement 24 is a single mandatory list, with "Evidence to be provided, including Certificates, where requested":
The solution must be hosted in a tier 3 data centre and provide: Compliance with the 14 Cloud Security Principles: Full Disaster Recovery; Recovery Point Objective (RPO) 1 hour; Recovery Time Objective (RTO) 4 hours; Minimum support hours 8.30am - 5.00pm; ISO 27001 Certified or equivalent; ISO 9001 Certified or equivalent; Cyber Essentials Certified.
Our position against that list, from the library:
| Requirement 24 item | Carepatron |
|---|---|
| RPO 1 hour, RTO 4 hours, full disaster recovery | known-gap-no-rto-rpo, status gap. We do not publish recovery objectives or a DR test cadence. The claim's own caveat says always render this as [VERIFY], never answer it |
| ISO 27001 certified or equivalent | Not held. SOC 2 Type II is arguable as equivalent, and that is the council's call, not ours |
| ISO 9001 certified or equivalent | Not held, and nothing in the library is equivalent |
| Cyber Essentials certified | Listed in the Trust Center per compliance-additional-frameworks, status partial. Its caveat warns that buyers treat Cyber Essentials as a formal attestation, so point at the Trust Center rather than assert certification |
| Minimum support hours 8.30am to 5.00pm | Met. Support runs 24/7 per support-model |
| Browser-based, no local install | Met |
Three of those six are things our own playbook forbids us from answering. Rule 5 is explicit: never quote a number we do not hold, no SLAs, no uptime figure, no RTO or RPO. A tender that scores quality at 45 per cent and asks for certificates as evidence is not a tender where [VERIFY] placeholders compete.
The rest of the requirement list, for the record
Worth keeping, because the category is genuinely ours and the next one of these may be winnable.
Carepatron answers cleanly on roughly half the list. Requirement 9, group sessions, is covered by clinical-group-notes. Requirement 5, locally adapted forms, is covered by clinical-form-builder. Requirements 8, 12, 14 and 22 map to progress notes, scheduling and reminders, prefill and support, all supported. Requirements 7, 11 and 17 on audit, risk flags and service user relationships are plausible and would need checking.
The failures cluster, and they cluster away from the clinic and towards the council:
- Requirement 1, full access to all data in all tables by API, scheduled files or downloads.
known-gap-api-client-endpoints-onlybounds the API to client endpoints.known-gap-bulk-export-excludes-notesmeans notes and appointments leave per client record. "All data in all tables" is not something we can offer. - Requirement 19, reporting tools on all of the above with maximum flexibility.
reporting-custom-reports-via-exportis filterable CSV only. There is no report builder in the product. - Requirement 20, interface to financial systems such as D365. No claim exists.
- Requirement 15, interoperability with other systems. Partial at best, and
known-gap-no-hl7-fhirapplies to the health partners the service works with. - Requirement 5, in its second half.
known-gap-no-conditional-logicmeans branching intake is not available.
The rubric caps anything with two or more stated-mandatory gap frictions below PURSUE. I count at least four.
Two further gaps the engagement form does not ask about, but a UK council contract will: known-gap-no-wcag-conformance, and known-gap-no-data-residency-choice against a council holding substance misuse records on a 7.5 year contract.
The score
43, down from 60 on the queued record and 62 on its duplicate. Below 45 is a SKIP.
| Dimension | Weight | Score | Why |
|---|---|---|---|
| Product fit | 35 | 9 | Hosted outpatient case management is our shape. NDTMS, full-table data access, recovery objectives and the D365 interface are not |
| Buyer fit | 20 | 15 | All-age community substance misuse treatment, outpatient, multi-agency. Genuinely adjacent to our sweet spot |
| Size fit | 15 | 11 | Three hubs plus outreach across a county service. Neither notice states a staff count, so this is an estimate |
| Winnability | 15 | 2 | Purpose-built NDTMS vendors hold this category. Price weighted 50 per cent. We missed the March engagement round and the demos |
| Feasibility | 15 | 6 | Submission runs through a Proactis account we do not hold. Enquiry deadline is 23 October, eight days away |
On winnability, one concrete data point. Halo, at halosystem.co.uk, markets itself as a drug and alcohol case management system supporting NDTMS CDS-R, and says it has worked in the sector since
- Mayden sells an addictions product in the same market. These vendors ship requirement 3 as
their core business. Retrieved 15 October 2026 via web search, not from the council.
What would change the call
One thing: an NDTMS submission capability in the product, built and maintained against the dataset's changing business definitions. That is not a feature request, it is an England public health product line. Nothing in the library suggests it exists or is planned, and I am not going to imply a roadmap.
Published recovery objectives and ISO 27001 would reopen UK public sector tenders more broadly. They would not fix this one on their own.
If Somerset reposts without the NDTMS requirements, which would be unusual, rescore it. The underlying product fit is better than 43 suggests.
Routes tried today
The 8 October note recorded eight routes, all of which ended at Proactis. I did not repeat the ones that failed for structural reasons. What I added:
- Find a Tender notice 094813-2026. Fetched in full by curl. Confirmed the tender is live, not market engagement. The queued record still described it as "still at market engagement stage", which was wrong by eight days.
- Find a Tender OCDS record for ocds-h6vhtk-066260. Fetched. Carries both releases, and the full text of the March engagement milestone including the Microsoft Forms URL. This is the route that worked.
- The Microsoft Forms market engagement questionnaire, rendered with Firecrawl. Returned all 28 requirements in full. This is the document the check needed.
- Proactis public endpoints, rendered with Firecrawl rather than curl. Confirms the 8 October finding properly. The page is a JavaScript login shell that returns HTTP 200 for any path, so the earlier 200s meant nothing. The only onward route is
/Account/Registration/Register. There is no public opportunity browser. - Proactis registration. Not attempted, by standing rule.
- Somerset Council democracy site. Still HTTP 403 to automated requests, now via Cloudflare.
- Web search for the incumbent. Surfaced Halo and Mayden as the category vendors, and confirmed NDTMS CDS-R as their headline capability.
A note on the duplicate
This solicitation sits in state.db under two source ids. exa_neural:f9e3c845829202f8 is the one that reached the drafting queue, scored REVIEW 60 on 15 October. uk_find_a_tender:ocds-h6vhtk-066260 is the same tender, scored REVIEW 62 on 8 October. I have recorded SKIP 43 against both, so neither returns. This note supersedes 2026-10-08-somerset-council, which I have marked superseded.
That is the third confirmed instance of the dedupe problem already staged in memory/proposals/rfp-radar-same-solicitation-recurs-under-new-source-ids.md.
Sources
- Find a Tender notice 094813-2026, "Case Management System - Drug and Alcohol Service", Somerset Council, UK4 tender notice, published 7 October 2026. Retrieved 15 October 2026.
- Find a Tender OCDS record for ocds-h6vhtk-066260, covering releases 019608-2026 (planning, 4 March 2026) and 094813-2026 (tender, 7 October 2026). Retrieved 15 October 2026.
- Somerset Council, "Market Engagement - Drug and Alcohol - Case Management System (CMS)", Microsoft Forms questionnaire, 28 requirements, linked from notice 019608-2026. Retrieved 15 October 2026. All requirement quotations above come from this form.
- halosystem.co.uk substance misuse page, and mayden.com addictions page, for the competing vendor read only. Retrieved 15 October 2026 via web search.
library/claims.json, claim ids cited inline.- Prior note
2026-10-08-somerset-council, now superseded.
Machine-written first pass against the verified claim library. Not reviewed by a person unless the status says so.