Unipercare service for home care and service centres

The effectiveness study found that the feelings of loneliness and depression among customers decreased, emotional well-being increased, and customers’ social networks expanded during the use of the product.   Appropriate indicators had been used to measure the impact of different sectors. Due to the short duration of the  effectiveness study, the long-term effects of the service cannot be assessed.¹

Several user experience surveys of the service have been carried out to investigate the risks of customers encountering the following events: falling, anxiety, loneliness and depression. Appropriate indicators have been used for risk assessments. In these surveys, the risks of falling and anxiety have been reduced during the use of the service. The numbers of survey participants were small, the non-response rate high, and the follow-up times were short.¹

Based on customer satisfaction surveys, customers have been satisfied with the service.¹  Based on surveys, organizations have also been satisfied with the service.¹

In general, there is convincing evidence of the impact of physical activity on the risk of falls in older people.² The evidence of the link between ICT use and social isolation, loneliness, social contacts, and well-being has varied in studies. Some studies showed positive evidence; in other studies, there were no differences between study groups.^3,4,5  The studies are already partially outdated, and the terminal equipment has been a computer or tablet, so the proof cannot be fully transferred to the service under assessment.  Different video communication technologies are used in services for the elderly, and there is evidence of their benefits⁶. Since the products are different, this evidence is also not fully transferable to the service under assessment.

The company has processes in place to ensure the safety of its products and to address safety-related risks that have arisen during use. The company has a risk management system compatible with ISO 14971:2019.  According to the manufacturer, no hazard or adverse events related to the use of the product have been reported during its use. The risk analysis carried out on the product is comprehensive.¹

The price of the product consists of monthly operating costs. The user training provided by the company for the employees of the organization, subject to a charge, lasts 3-5 days. The organization should be prepared to train the end-users, and provide them with help-desk services, which may lead to additional costs. The organization decides how to charge the customer for the use of the product.¹

If the product is used via its set-top box for TV, it can be purchased from the importer, or another suitable TV adapter may be used.  The organization should take a stand on whether the organization or the end-user bears the costs of the TV set-top box.¹

Based on the information provided by the manufacturer, it appears that the cost of using the service is reasonable when compared with the provision of an equivalent service in another way.¹  

The assessment was carried out using the database of data security and data protection requirements for social welfare and health care procurement⁷ and the information provided by Uniper and SmartGroup¹.

Based on the responses, the manufacturer meets the security and data protection requirements. The manufacturer has carried out an internal HIPAA audit and SOC 2 certification is in progress.

Risk management and data security testing
The manufacturer has carried out a data security risk assessment. The company has a data security risk testing process in place.

Log management

The manufacturer has log management processes for monitoring the operation of the service, auditing events, and detecting potential attacks.  In addition, the manufacturer has automatic alerts for problems detected.

User management

The password complexity requirements are sufficient. The service provides support for multi-factor authentication. As a login solution, the service uses a cloud-based authentication service provider. It is possible to introduce identity federation if the customer needs it.

Equipment

In our view, the use of the service does not pose any significant security risks with regard to the hardware. The service can also be used through the manufacturer’s Android-based TV adapter. This adapter has been subjected to intrusion testing.

Data protection

The service has been subject to a data protection impact assessment, including a data protection risk assessment.

Personal data of users of the service is stored in the EEA and stored in encrypted form. In addition, risks are reduced by pseudonymising data where possible.

Uniper uses Zoom as a video meeting solution. The Zoom service has sufficient safeguards, so using Zoom will not cause any data protection problems.  If the organization has enabled the recording of video meetings, these recordings are stored encrypted on Zoom’s cloud servers.  In addition, video meetings are end-to-end-encrypted.  Uniper end-user does not have to register for Zoom.

The company has completed an external audit on compliance with GDPR⁷

Other considerations

This assessment does not include interfaces with external services. If the customer introduces other services related to this service, these interfaces must be assessed separately.

General guidance on procurement

During the procurement phase, you should always contact the organization’s IT management, information security specialist, and data protection expert. Discuss with them if the product in question meets your requirements.  In addition, we recommend that hospital districts use the Procurement Information Security Guide of the European Union Agency for Cybersecurity (ENISA) in support of procurement⁸.

The persons involved in the testing of the product are representative of the actual end-users of the product¹.

The accessibility of the product has been assessed by a third party¹. The accessibility statement is available for the product⁹. The online service complies with the A and AA Accessibility Requirements (WCAG Criteria 2.1) and Section 508 of the United States Rehabilitation Act, Section 508^1,9. When using a TV adapter, the remote control serves as a keyboard¹.

It is possible to provide feedback on usability and accessibility via an online feedback channel, and the company will respond to the feedback within 14 days⁹.

The content provided through the service is provided by third parties, so when purchasing content, make sure that they also meet the accessibility requirements¹.

Instructions for clients considering purchasing the product

The purchasing organization must take into account the requirements of the Digital Services Act and note that it is the service provider’s responsibility to comply with the requirements^10,11.

The service is available on smartphones and tablets that support Android or iOS, and on the computer via Chrome web browser. The service can also be used via a TV adapter that supports the Android operating system, which also includes a remote control and a webcam¹.

Interoperability

The product supports the REST API interface. The product is also connected to other companies’ services via the SSL/TLS1.2 interface.¹

Technical functionality

The manufacturer will notify system updates by e-mail.  According to the manufacturer, system updates do not cause interruptions to the service; only the SSL certificate updates can cause a few minutes of service interruptions at night time.  According to the manufacturer, there have been no outages in the service, and the service has not been disabled due to a failure in the last six months. The manufacturer has a process in place to actively monitor the operation of its service and to try to correct errors as quickly as possible.¹  

Training and product support

The company provides training and support to persons responsible for the training of end-users. Training is primarily offered in Finnish. The organization using the service selects two administrators. They are responsible for providing support during the use of the service to the medical staff, who are responsible for customer support while the service is in use.¹

SmartGroup provides support primarily to administrators during regular working hours. The Service Level Agreement (SLA) can be concluded separately, and product support in English is available 24/7.¹

Distribution

Uniper has clients worldwide, e.g. Israel, the EU, Austria and Portugal¹.

1. Digital Health Technology Assessment filled in by the company, not public information
2. Sherrington et al. 2019. Exercise for preventing falls in older people living in the community. Cochrane Database of Systematic Review 2019, Issue 1, Art.NO: CD012424. DOI: 10.1002/14651858.cd012424.pub2.
3. Heins et al. 2021. The Effects of Technological Interventions on Social Participation of Community-Dwelling Older Adults with and without Dementia: A Systematic Review. J.Clin.Med. 2021,10,2308. DOI: 10.3390/jcm10112308
4. Ibarra et al. 2020. A Systematic Review on Technology-Supported Interventions to Improve Old-Age Social Wellbeing: Loneliness, Social Isolation, and Connectedness. Journal of Healthcare Engineering 2020. DOI: 10.1155/2020/2036842
5. Chen & Schultz 2016. The Effect of Information Communication Technology Interventions on Reducing Social Isolation in the Elderly. A Systematic Review. J. Med. Internet Res 2016;18(1):e18. DOI: 10.2196/jmir.4596
6. Saarelainen 2019. Geronteknologia eksistentiaalisten kysymysten ja keskusteluiden mahdollistajana- Tutkimus ikääntyvien Palvelu-TV-toiminnasta. (In Finnish.) https://erepo.uef.fi/handle/123456789/7811
7. Amit, Pollak, Matalon & Co. 2022. Privacy Protection at Uniper Care. Available on request.
8. National Emergency Supply Agency. Cyber Health Project. Information security and data protection requirements for social welfare and health care procurement (in Finnish)  https://www.kyberturvallisuuskeskus.fi/fi/ajankohtaista/ohjeet-ja-oppaat/sosiaali-ja-terveydenhuollon-hankintojen-tietoturva-ja  Accessed on 23.9.2021
9. The European Union Agency for Cybersecurity Procurement Guidelines for Cybersecurity in Hospitals. Available at https://www.enisa.europa.eu/publications/good-practices-for-the-security-of-healthcare-services Accessed on 23.9.2021
10. Accessibility of SmartGroup network services. Available at https://www.smartgroup.fi/anna-saavutettavuuspalautetta-talla-verkkolomakkeella/ In Finnish. Accessed on 9.11.2021
11. Act on the Provision of Digital Services 306/2019
12. Regional State Administrative Agency of Southern Finland, Accessibility supervision unit. The requirements of the Act on Provision of Digital Services. Available at https://www.saavutettavuusvaatimukset.fi/digipalvelulain-vaatimukset/ Accessed on 23.9.2021

Petra Falkenbach, Senior Planning Officer, FinCCHTA

Jari Haverinen, Senior Planning Officer, FinCCHTA

Jari Jääskelä, Information Security Expert, University of Oulu