HSCN: private IT service provider connecting from outside of England’s borders policy

Please consider the information on this page to be for guidance purposes only.

The HSCN: Private IT Service Provider connecting from outside of England’s borders Policy document itself should be considered the official NHS Digital policy document under all instances.

Published October 2018.

The Health and Social Care Network (HSCN) delivers new and significantly different network services for health and social care.

HSCN creates the effect of a single network across health and social care providers and their partners. All health and social care organisations in England are within scope of the HSCN solution, which helps deliver an integrated care service.

This policy sets out when a private IT service provider (ITSP) may connect directly to the HSCN from outside of England’s borders.

To assist with this, a set of criteria for provision of service and approved connection scenarios have been provided. These scenarios show what a private ITSP needs to adhere to if they are to:

• connect to the HSCN from outside of England
• provide their 'value-add' capability to the wider HSCN community

Criteria for provision of service

a) The HSCN Connection Agreement can be signed by non-UK private ITSPs

The organisation will require an English presence (post code for example) to apply for an Organisation Data Service (ODS) code, which is a pre-requisite for submitting an HSCN Connection Agreement. If that is not possible then by exception the HSCN Operations team will manually create a new organisation record and supply unique organisation identifier, so that the foreign organisation can then use the existing self-serve Connection Agreement process.

b) Private ITSPs are not governed by the Heath and Social Care Act 2012 (H&SCA 2012) or the HSCN 2017 Direction

This means they are not bound by the “within England border” condition.

c) Private ITSPs must only store data in an approved location

Private ISTPs must adhere to NHS Digital national guidance regarding off-shoring and the use of public cloud services. This means the UK, the European Economic Area (EEA) or adequate countries.

Adequate countries are a country deemed to have an adequate level of data protection by the European Commission. Full details can be found on the European Commission Policies, information and services page.

This allows data owners scope to release their data to the private ITSP. Any other geographic requirements will be managed by exception.

d) The HSCN Obligation Framework doesn’t restrict a Consumer Network Service Provider (CNSP) providing a connection outside of England

e) The CNSP Deed supports user access

That is, it supports health and social care public sector bodies within England, and it has the potential to extend to Scotland, Wales, Northern Ireland, and the Channel Islands.

f) The HSCN Access Policy supports user access within defined access scenarios

Where there is an approved access scenario for connection to HSCN the HSCN Access Policy allows for this under Section 5.1

“The HSCN Connection Agreement states that ‘connection to the HSCN is provided based on the business need to share information within the health and social care community’. 

This means that HSCN is available to any organisation where the purpose of its connection to HSCN is the delivery, facilitation, or support of health and/or social care in England.”

Once the three devolved nations have their HSCN request letters approved the HSCN Access Policy wording will be updated accordingly.

Access scenarios

The following three access scenarios describe the interactions between private ITSPs, consumer network service providers (CNSPs), the HSCN Peering Exchange Service (PES) and end consumers. All are outlined in Figure 1 below.

Figure 1 – HSCN private IT service provider connection scenarios from outside of England’s borders

A private ITSP can connect to HSCN, via a CNSP, and offer a ‘value-add’ capability based upon adhering to the “A” and “B” scenarios outlined in Figure 1. Find out what constitutes 'adequate countries'.

Scenario A - providing value-add capability to end consumers in England

A private IT service provider, who is located outside of England, is provided with a HSCN connection to enable their value add capability to be made available to public-sector health and social care communities in England.

Supporting messages

The Private ITSP needs to comply with the criteria for provision of service. In particular:

• part a) for which the ITSP will need to apply for, sign and adhere to the ITSP Connection Agreement
• part c) for which the ITSP will need to maintain adherence to the specific list of allowable countries
• part f) for which the ITSP needs to know where their end public-sector customer base is located.

Scenario B - providing value add capability to end consumers in a devolved nation

This follows the same approach as Scenario A, however their value add capability can be made available to public sector health and social care communities within a devolved nation.

Supporting messages

The private ITSP needs to comply with the criteria for provision of service. In particular:

• part a) for which the ITSP will need to apply for, sign and adhere to the ITSP Connection Agreement
• part c) for which the ITSP will need to maintain adherence to the specific list of allowable countries. 
• part f) for which the ITSP needs to know where their public sector end-customer base is located.

Scenario C - end consumers who are not in England or a devolved nation

For completeness this scenario has been included as the HSCN Access policy states that HSCN is available to any organisation where the purpose of its connection is the delivery, facilitation, or support of health and/or social care in England.

This is being extended to devolved nations upon the submission and approval of their HSCN request letters in accordance to Section 255 Health and Social Care Act 2012.

Note: At time of writing “Crown Dependents” are still under review and will be added via the appropriate process channels in due course.

A CNSP will therefore not be permitted to offer a HSCN connection to a public-sector organization outside of the above countries.

A private ITSP will therefore not be permitted to offer their value-add capability to a public sector organization outside of the above countries.

Supporting messages

The private ITSP needs to comply with the criteria for provision of service. In particular:

• part b) which covers the subtlety between a private sector and a public sector health organisation
• part f) for which the ITSP needs to know where their public sector end customer base is located

In summary this policy mandates that a private ITSP can proceed with connecting to HSCN, from outside of England’s borders, on the condition that:

• the private ITSP adheres to the criteria for provision of service a), b), c) and f)
• the private ITSP aligns with access scenarios A and B

This Policy shall be adopted by all private ITSPs who intend to connect to HSCN, via a CNSP, from outside of England’s borders.

For further information and enquiries please email the NHS Digital enquires team at enquiries@nhsdigital.nhs.uk.