DXS Vulnerability Disclosure Policy

1. About DXS

DXS International plc supplies clinical decision support and referral software to general practice in the United Kingdom. Our software handles patient information, so we take reports of security weaknesses seriously, and would rather hear about one from you than read about it elsewhere.

2. Scope of this policy

This policy applies to any security vulnerability you are considering reporting to DXS in DXS software (Point of Care, BestPathway, Next-Gen and ExpertCare), DXS websites and internet-facing DXS services. Please read it before you report, and act in accordance with it. We value the time and effort of people who report vulnerabilities responsibly, and we welcome security researchers who wish to test our software and services in line with this policy. We do not offer payment or bounties for vulnerability reports.

The following are out of scope, and must not be tested under this policy: systems run by our customers, such as GP practice clinical systems and networks; national NHS systems and services; and services provided by third parties, such as our hosting and cloud providers. If you find a vulnerability in a third party’s service through DXS, please report it to that organisation, or tell us and we will pass it on.

3. How to report

Send your report to security@dxs-systems.co.uk, or use the secure form at www.dxs-systems.co.uk/vulnerability-disclosure/. We treat every report confidentially, and the form lets you report anonymously if you prefer.

Please tell us the website, address or product where the vulnerability can be seen, what kind of vulnerability you believe it is, and clear steps to reproduce it. A benign, non-destructive proof of concept helps us confirm the issue quickly and accurately.

4. What happens next

We will acknowledge your report within 5 working days and aim to complete our assessment within 10 working days. We will tell you whether we have accepted it.

Priority is set by impact, severity and how easily the issue can be exploited, so some reports take longer than others to resolve. You are welcome to ask how a report is progressing; please do so no more than once every 14 days so that our team can concentrate on the fix. We will tell you when the issue is resolved, and may invite you to confirm that the fix is adequate.

5. What we ask you not to do

Please do not break any law or regulation. Do not access more data than is necessary to demonstrate the issue, and do not modify or delete anything. Do not use high-intensity, invasive or destructive scanning tools. Do not attempt or report denial of service, and do not disrupt our services or those of our customers. Do not attempt social engineering or phishing against our staff, customers or users, and do not attempt physical access to our premises.

Please do not report issues that are not exploitable, or observations that a service does not match a best-practice checklist, such as a missing security header or a cipher suite we have chosen to support. Do not discuss the vulnerability other than through the route in this policy, and do not ask for payment for telling us about it.

6. What we ask you to do

Please comply with data protection law and respect the privacy of our users, customers, staff and the patients whose information our software handles. If you encounter personal data, stop, do not share or republish it, tell us what you encountered, and delete it securely as soon as it is no longer needed, and in any event within one month of the issue being resolved.

7. Disclosure

Once an issue is resolved, we are happy to discuss publication with you, and ask that you coordinate the timing with us so that our customers receive consistent guidance. If you would like to be credited, tell us and we will agree with you what is published. If you would rather stay anonymous, we will respect that.

8. Your personal information

We use your contact details only to handle your report and keep you updated, and keep them for 6 years after the report is closed. Our Customer and Website Privacy Notice explains your rights.

9. Legal position

This policy is written to be compatible with good practice in vulnerability disclosure. It does not give you permission to act in any way that is inconsistent with the law, or that would put DXS or any organisation we work with in breach of a legal obligation.

10. Other routes

If you would prefer not to report to us directly, you can report a vulnerability to the National Cyber Security Centre.