Welcome to the webinar - meeting the secure standard

Transcription

1 Welcome to the webinar - meeting the secure standard The webinar will begin at 10.00am. Please synchronise your web and phone presence by inputting your Attendee ID into the phone. Participant lines will be muted during the presentation. The webinar will be recorded. You can use the chat messaging feature on the right of the screen to ask questions. Please only use this for questions, not general comments. 1

2 Meeting the secure standard Tuesday 14 November 2017 Presented by NHS Digital and Accenture

3 Agenda Introduction Henry de Ferrars Overview and objectives Damian Dube About the secure standard Dayam McIntosh Benefits of meeting the standard Paul Stapleton Risks of not meeting the standard Dayam McIntosh NHSmail migration options Andrew Pearson Next steps Damian Dube

4 Objectives of the webinar Providing information and support to organisations on how to meet the secure standard Identify the benefits of meeting the standard and NHSmail Explain the risks associated with not meeting the standard Identify barriers organisations are facing Provide information on different migration options available Information on next steps to take Questions

5 Overview of meeting the secure standard Overall risk of not meeting the standard Options for meeting the secure standard 540 organisations have met the secure standard Working with 52 organisations to accredit using O organisations self-accrediting More than 18 self-migrations to NHSmail in the past year Around 50 managed migrations with Accenture

6 The Secure Standard DCB1596

7 About the secure standard The secure standard has been in service since 2014 and sets the minimum requirement for all services within Health and Care. It is overseen by the Data Coordination Board (DCB) who took over responsibility for the approval of standards from SCCI. DCB is a sub-group of the Digital Delivery Board (DDB) This covers national governance arrangements for information standards, data collections and data extractions. ISB1596 SCCI1596 DCB1596

8 Security principles Availability The ability to send and receive s 24/7/365 Integrity Using a trusted service that can send official data Confidentiality Privacy and not causing a breach Secure standard principles s containing PID/PCD must be securely transported when they are sent s should be securely transported as they are received s should be properly routed to a recipient. Clinical Safety

9 The service landscape Untrusted domains O365 NHSmail Assured services, nhs.uk, domain information tool Self accrediting organisations that host services

10 NHSmail meets the secure standard

11 Benefits of NHSmail

12 NHSmail benefits Cost Reduced : IT cost Use of paper Mileage costs (SfB Virtual meeting) GP travel costs (i.e. CO2 emissions) Hospital activity (SfB clinician to clinician/clinician to patient remote consultation) Enablers A secure and modern exchange SfB A&VC Virtual meetings; remote consultations Time Reduced time : Handling paper Spent travelling to meetings (SfB Virtual meeting) A secure and modern exchange SfB A&VC Virtual meetings Efficiency and effectiveness Increased : Reduced : Speed of communication (Instant Messenger and Presence) Staff satisfaction Collaboration (Collaboration tools Reliability Patient travel (Clinician to patient remote consultation) Instant Messaging and Presence (IM&P) Use of a single secure Collaboration tools e.g. Federation, Shared /Resource mailboxes, Joint Calendars 24/7/365 SfB A&VC Remote consultations Security and safety Increased : Security Certainty that PID will be dispatched from a secure Anti-virus/anti-spam detection, Deep persistent threat detection and Data loss prevention tools A secure and modern exchange

13 Case studies Validation Baseline activity/metrics Realisation targets Case studies in progress Self-migration at South, Central and West CSU (Self-Migration) Enabling paperless GP practices Hammersmith and Fulham centres for health Efficiency and effectiveness Swanton Care and Community Looking for further opportunities

14 Risks of not meeting the secure standard

15 What service do you use? Let us know using the polling feature

16 is a business critical ICT service Falls Service Assisted Technology: (Eg. Community Equipment Services, Telecare, Blue Badge) Optometrist Voluntary Sector Family Local Authority: Adult Social Care commissioning Dietician Ambulances Adult Social Care: Public and private domiciliary services Dentist Other local authority Prisons Carer/Service User Health organisation GP Transport Service Safeguarding vulnerable adults Mental Health Organisations Acute (eg. urgent care, outpatients, admissions) Social Worker: Duty Team Podiatrist Hospice/End of Life CCG: Commissioning Community Nurse Social Work Case Manager Pharmacy Occupational Therapists Police Physio Single Point Assessment Care Navigator/ Multidisciplinary team link Local Authority: Housing

17 Not meeting the standard public trust Risk one: Build and sustain public trust Ensure citizens are confident about sharing their data to improve care and health outcomes The last cyber attack saw the closure of mainly planned services National Information Board s Personalised Health and Care 2020 Framework

18 Not meeting the standard - vulnerabilities Risk two: Far reaching vulnerabilities NHSmail Securely hosted with dual active-active data centres in England Anti-phishing: DKIM, SPF, DMARC NHSmail is continuously upgraded and patched with 24/7/365 monitoring NHSmail provides anti-virus, anti-spam, deep persistent threat detection and cloud prescanning NHSmail deletes 150,000 spam s per day Did not spread the WannaCry Cyber Attack

19 NHSmail security

20 Not meeting the standard becoming untrusted Risk three: Untrusted domain The health and care community: Services may not allow s to be sent to your domain Blacklisting Your domain? Secure services

21 NHSmail migration options

22 There are a range of options available for organisations to migrate to the NHSmail platform SELF MIGRATION For organisations with simple migration requirements & experienced technical teams Migrating organisation determines migration method & project scope Light touch migration support service & user guidance from NHS Digital Timescales driven by migrating organisation can take 3-6 months depending on complexity Assured against NHS Digital best practice migration checklist Third Party migration - with support for project from a technology or service provider 17 Completed and 18 in the pipeline Self-migration guidance MANAGED MIGRATION For organisations with >2000 mailboxes Service provided by Accenture, NHSmail service provider Automated process driven by Quest tooling and Accenture delivery centre (24x7) Fixed scope rapid migration, typically 12 weeks Co-existence maintained between source and target Project risk transferred Monitored against NHS Digital best practice migration checklist 22 organisations have migrated working with Accenture Investment Required NHSmail Top Up Services

23 The key benefits of the self-migration options are FLEXIBILITY Organisation can determine migration scope & timetable Local resources, experience & expertise utilised Organisation can run project via it s own internal processes COST Lower cost option no external investment required May not need any additional staff resources to run the project GOVERNANCE Assured against NHS Digital best practice migration checklist Local IG team has overview of the project Local organisation owns the risks and issues of the project NHSmail project initiation template Self-migration project documents Self-migration project plan Organisation self-migration guide Self-migration guidance

24 The key benefits of the Accenture managed migration options are PACE A proven seven step process enables: Managed Migrations to be typically completed in a 12 week period The impact on local help desk and support teams to be minimised Any risk of data loss or IG incidents to be contained SCOPE Clearly defined scope: Accenture focussed on data transfer Local data is copied and not transferred Bulk new account provisioning Provides opportunity to update shared mailboxes, distribution lists and delegated permissions BUSINESS AS USUAL Quest migration tooling will: Provide co-existence during migration project Drive managed and partial migration approaches Provide one-touch end user input during account switch over Mean no black out or down time IMPLEMENTATION WORKSHOP DEDICATED PROJECT READINESS SUPPORT MIGRATION GUIDE BESPOKE QUEST TOOLING ** Procurement of migration services is via a NHSmail Top Up Services Agreement and Catalogue both drafted and approved for migrating organisations by NHS Digital **

25 NHSMAIL OFFERING INSTANT MESSAGING & PRESENCE The Instant Messaging and Presence features enable users to: Send Instant Messages to any user with access to NHSmail Skype for Business Set and view Presence based on availability to send/receive Instant Messages Automatically detect Presence based on Outlook Calendar Manage Contacts and Contact Groups Set and view Location information CORE SERVICE NO CHARGE AUDIO & VIDEO CONFERENCING Audio and Video Conferencing features enable users to: Control access permissions and settings for Skype for Business Meetings Upload PowerPoint files to share on screen Share a Desktop or Window Manage a Question and Answer session Create and collect responses to Polls Collaboratively Whiteboard ideas and tasks 55p is currently funded centrally by NHS Digital but will be payable from April TOP-UP SERVICE 1.03 PUPM CONFERENCING DIAL IN The Dial-in Conferencing features enable users the ability to: Issue a Skype for Business Meeting invite with dial-in telephone numbers and a meeting ID Join Skype for Business Meetings via a dial-in telephone number TOP-UP SERVICE 1.6p Per minute, per connection Costing is calculated on a per user per month costing model. Organisations are only charged for the number of accounts that are enabled at a given time. Dial-in conferencing charges are consumption basis per connection per minute. To start the procurement process, please contact nhsmail.development@accenture.com.

26 WHAT DOES IT LOOK LIKE The NHSmail Skype for Business Service offers core (free to NHS organisations) and top-up (funded by NHS organisations) features. Below shows some of the features and how you can access them. The feature set can be built up depending on the requirements of your users; for example, a user could be provisioned with Instant Messaging and Presence only or with Instant Messaging and Presence plus Audio and Video Conferencing. A more detailed overview is available in the NHSmail Skype for Business Service Description Document.

27 Ways of working with Skype for Business During piloting, we identified several ways that clinicians can work with Skype for Business. This is not an exhaustive list but those detailed may inspire how your organisation can look to use Audio and Video Conferencing tools in the future. WAYS OF WORKING Remote working: Connect with clinicians across sites to resolve patient problems in real-time Ways of working Instant access to expertise: Clinicians are able to use Skype for Business as a tool to contact other healthcare experts in real time across static and mobile devices Teaching: Real-time virtual coaching between senior and junior staff Discharge Co-ordination: Connected discharge planning process with online coordination between nurses, physicians and discharge coordinators

28 Next steps NHS Digital will publish the slides and a recording of this webinar on the NHSmail support pages shortly Contact feedback@nhs.net if you have queries not answered via the information provided within the NHSmail Support pages Contact feedback@nhs.net to register interest in the NHSmail information sharing webinar on 21 st November 2017 You will receive an from your regional IBC Lead asking for information of how you intend to meet the secure standard

29 IBC regional leads Midlands & East Jane Berezynsky: London Nicola Willis: South - Christina Malcolmson: North Martin Spotswood: jane.berezynskyj1@nhs.net nicola.willis2@nhs.net c.malcolmson@nhs.net martin.spotswood@nhs.net

30