Appendix B: voice and IP telephony

Voice and IP telephony services play a crucial part in the day to day operational services for NHS organisations. During the past decade there has been continuous growth for services based on Internet Protocol IP telephony (IPT) services. 

This is partly due to the ever evolving technology and solutions which offer greater versatility than that of the traditional public switched telephone network (PSTN) based services. Voice and IPT are more commonly deployed as part of a converged network solution which allows for easier day to day management and better flexibility to expand services as and when required.

Most IPT solutions offer basic facilities such as:

• call waiting
• call forwarding
• caller ID
• phone number porting
• voicemail (that can allow remote access to messages and alert services)
• video phone calls (with appropriate handsets)

VoIP services come in many varieties that are tailored for service provisions for local, regional and nationwide deployments. DPNSS (Digital Private Network Signalling System) standards and services options for variations in IP Voice deployments should be defined as part of the engagement with your supplier.

Multiple lines: the internet can be used as virtual trunk lines known as SIP trunks (trunking is where access to many clients is provided by sharing a set of lines rather than providing them individually), to connect calls to other telephone users via carrier companies who set up media switches on the internet. If a site already has SIP (Session Initiation Protocol) connectivity within their current infrastructure, then this should provide an easier to deploy solution.

The two common IP voice offerings are:

Hosted IP telephone services

This service provides a network hosted IP telephony platform (such as internet/cloud based backbone solution) and the provision of converged IP telephony services on a local site. Customers will be able to benefit from a consistent quality, and can be extended to be based on a subscription voice service across small medium and large groups of sites, which is flexible to cater for future organisational change.

To ensure service continuity in the event of any potential service outage/network failure, options for local break out to PSTN connectors should be factored into design considerations.

Local Gateway Services

The Local Gateway Service (LGS) provides equipment that is housed on site and managed locally in-house to connect an existing local voice private branch exchange (PBX) infrastructure. The availability of voice trunks will be dependent on the wide area network (WAN) connection provided at the site.

Recent advances in voice over Internet Protocol (VoIP) technology and extensive testing of VoIP voice services quality indicate that the high quality voice service should be achievable across a correctly specified WAN. It is strongly advised that customers compress their voice across their WAN. Along with Quality of Service (QoS) management, compression tools are usually a feature of the customer premises equipment (CPE) used as the voice traffic controller.

The ITU standard for voice quality measurements is based on:

1. The CODEC used by VoIP to compress voice across the WAN is G.729a
2. Mean Opinion Score (MOS) algorithm. MOS is rated on a scale of 1 (noise) to 5 (perfect quality). Minimum MOS score of 3.7 "Toll Quality" generally accepted as 4 or better. 
3. Jitter of no more than 25 ms
4. Packet Loss of no more than 0.5%
5. Round Trip Delay of less than 150ms

Cost savings

The most common reason for considering VoIP is the cost savings afforded by making calls over broadband. However, as well as being able to make free calls between VoIP users, many services also offer savings over standard fixed-line to local, national, international and mobile numbers.

Significant savings can be made on legacy ISDN circuit and landline rentals. These are variable, but can quickly add up depending on the size of the organisation. In addition savings can also be made on the capital cost of a physical PBX. VoIP also provides complete cost control on the amount spent each month, with packages that give unlimited calls to local and national numbers for a fixed monthly cost and capped rates mobile breakout and international destinations.

Enhanced mobility

Software that allows you to use a "softphone" on a local PC, allows staff to have the ability to work from anywhere. VoIP calls are directed via a telephone number, and not to a fixed location, so the location is irrelevant to business partners and customers. As incoming phone calls can be automatically routed to where you are connected to the internet, staff can make and receive calls using the same number wherever they are located.

Enhanced business operations

As well as features such as three-way calling, call forwarding, voicemail and caller ID, VoIP services also offer a number of advanced features (Unified Comms tools) including:

• video calls and video conferencing
• integrated collaboration tools like instant messaging and presence

NHS standards

There are no specific NHS standards for voice and IP telephony services.

If an organisation procures a hosted VoIP solution, the rules around security, handling and storing of data and the correct IG controls, such as off-shoring, should be considered when planning and negotiating service requirements with suppliers.

Customer considerations

1. Maintenance costs for hosted voice solutions are the responsibility of the supplier.
2. Your internet/cloud connection accesses the suppliers remote PBX to send and receive VoIP calls.
3. Local resources to maintain and manage the IP Telephony systems and/or suppliers of services.
4. Various types of VoIP phone hardware can be deployed to suit business and budget requirements.
5. Scalable VoIP solutions for growth or business mergers.

Customer requirements

Procuring VoIP solutions can present some challenges given the inter link to other technologies such as unified communications (UC) services (as documented in Appendix C of this document). In order to develop a solution that incorporates the right mix of service offering, it is essential that the work to develop the business requirements captures the key business objectives and drivers in order to obtain the best value for money/return on investment solution.

The mix of site planning may vary dependant upon the organisation.

1. GP sites - These can range in size (small practice to large GP site)
2. Medium to large NHS organisation such as NHS Trust 
3. Wider community group, such as regional collaboration/ Community of Interest Network (COIN) service provision.

Planning considerations

It is good practice to separate data networks and voice networks into two logical designs.

Having the correct reporting tools to monitor and manage VoIP services.

Can the existing LAN support VoIP services?

1. Will you need to uplift current network links and internet bandwidth to accommodate a new deployment?
2. Analyse current usage of LAN/ network bandwidth/ Internet gateway 
3. QoS profiling/bandwidth shaping to protect services and applications (NHS/ HSCN guidance available here). HSCN QoS policy stipulates the use EF class of service to protect voice call performance.
4. Obtain supplier metrics for typical voice packet sizes - user concurrency profiling
5. The business calling habits - are the calls in the organisation mainly local,or national/long distance?
6. Keep at least one PSTN line for external break out for back up purposes

Service negotiation considerations

When entering into discussions with suppliers for IP telephony services, it may be worth considering some of the points below to ensure that some of the key services elements are factored into design and cost planning:

1. What will be the up-front costs? Will all cost cover hardware, phones and associated software?
2. End-user licences requirements?
3. Numbering plan - Planning in line with NHS/ HSCN guidelines?
4. A clear break down of tariffs:
   • What is the cost of making calls?
   • On net calling should be free
   • Are capped rates offered?
   • Costs for mobile/ PSTN break out?
5. What happens if there is a problem and will there be a charge for maintenance?
6. End user training requirements to use the new system?
7. Process for Small Moves and Changes (SMAC's)

It is vitally important that organisations adopt some IP telephony security principles for the day to day use of the services. There are some key considerations that should be factored into the operational service to minimise any potential security breaches.

To avoid possible "man-in-the-middle" confidentiality breaches such as eavesdropping, VoIP traffic sniffing and application attacks, some default measures should be put in place:

1. Adhere to ISO 27001 security practices and processes when applicable - undertake the appropriate VoIP service security risk assessments for your environment.
2. Apply appropriate security encryption controls for sensitive voice traffic.
3. Where deemed appropriate, apply SIP encryption as extra layer security .
4. Configuration of VLANs to separate voice and data traffic.
5. Configure dial plans and user policy and implementation of strict user policies.
   • Apply device certificates 
   • Restrict the types of calls allowed on the network, by device, user, and other criteria, such as time of day e.g. International call - barring where appropriate 
   • Apply strong user password authentication 
   • Management of sensitive voicemails
6. Protect the voice infrastructure, meaning firewall/intrusion prevention system (IPS) closely managed and apply the correct patches and software updates. Updates for anti-virus systems should always be kept up to date.

The security obligations for hosted voice service should be clearly set out and mutually agreed with the service provider. All documentation of the VoIP services should be clearly defined and obligations for all parties understood.

Hosted VoIP service providers should be able to provide clear lines of process to deal with any security issues, but it is important that regular service reviews are maintained to ensure that security standards are upheld to the highest levels and adhere to the correct local and national standards for IP telephony.