Please consider the information on this page to be for guidance purposes only.
The HSCN: Private IT Service Provider connecting from outside of England’s borders Policy document itself should be considered the official NHS Digital policy document under all instances.
Published October 2018.
The Health and Social Care Network (HSCN) delivers new and significantly different network services for health and social care as part of its remit to provide successor services to the N3 network.
HSCN creates the effect of a single network across health and social care providers and their partners. All health and social care organisations in England are within scope of the HSCN solution, which helps deliver an integrated care service.
The Transition Network (TN) provides a platform for continuation of services previously contracted under the N3 agreement. This service is managed as part of the HSCN programme and is delivered by BT. The TN will be managed as a ‘run-down’ service and will be provided for the minimum period required to migrate services to HSCN.
'Run-down service' within the context of this policy refers to the reduction in dependency on the TN as network traffic is migrated to the HSCN. TN traffic will reduce until switched off and the TN contract has been 'run-down' to closure.
This policy sets out when a private IT service provider (ITSP) may connect directly to the HSCN from outside of England’s borders.
To assist with this a set of criteria for provision of service and approved connection scenarios have been provided. These scenarios show what a private ITSP needs to adhere to if they are to:
'Value-add', within the context of this policy, means any additional capability or service accessed by an end-user (such as an NHS trust) which is reliant on a HSCN network connection to access.
The organisation will require an English presence (post code for example) to apply for an Organisation Data Service (ODS) code, which is a pre-requisite for submitting a Connection Agreement. If that is not possible then by exception the HSCN Operations team will manually create a new organisation record and supply unique organisation identifier, so that the foreign organisation can then use the existing self-serve Connection Agreement process.
This means they are not bound by the “within England border” condition.
Private ISTPs must adhere to NHS Digital national guidance regarding off-shoring and the use of public cloud services. This means the UK, the European Economic Area (EEA) or adequate countries.
Adequate countries are a country deemed to have an adequate level of data protection by the European Commission. Full details can be found on the European Commission Policies, information and services page.
This allows data owners scope to release their data to the private ITSP. Any other geographic requirements will be managed by exception.
That is, it supports health and social care public sector bodies within England, and it has the potential to extend to Scotland, Wales, Northern Ireland, and the Channel Islands.
Where there is an approved access scenario for connection to HSCN the HSCN Access Policy allows for this under Section 5.1
“The HSCN Connection Agreement states that ‘connection to the HSCN is provided based on the business need to share information within the health and social care community’.
This means that HSCN is available to any organisation where the purpose of its connection to HSCN is the delivery, facilitation, or support of health and/or social care in England.”
Once the three devolved nations have their HSCN request letters approved the HSCN Access Policy wording will be updated accordingly.
The following three access scenarios describe the interactions between private ITSPs, consumer network service providers (CNSPs), the HSCN Peering Exchange Service (PES) and end consumers. All are outlined in Figure 1 below.
Figure 1 – HSCN private IT service provider connection scenarios from outside of England’s borders
A private ITSP can connect to HSCN, via a CNSP, and offer a ‘value-add’ capability based upon adhering to the “A” and “B” scenarios outlined in Figure 1. Find out what constitutes 'adequate countries'.
A private IT service provider, who is located outside of England, is provided with a HSCN connection to enable their value add capability to be made available to public-sector health and social care communities in England.
The Private ITSP needs to comply with the criteria for provision of service. In particular:
This follows the same approach as Scenario A, however their value add capability can be made available to public sector health and social care communities within a devolved nation.
The private ITSP needs to comply with the criteria for provision of service. In particular:
For completeness this scenario has been included as the HSCN Access policy states that HSCN is available to any organisation where the purpose of its connection is the delivery, facilitation, or support of health and/or social care in England.
This is being extended to devolved nations upon the submission and approval of their HSCN request letters in accordance to Section 255 Health and Social Care Act 2012.
Note: At time of writing “Crown Dependents” are still under review and will be added via the appropriate process channels in due course.
A CNSP will therefore not be permitted to offer a HSCN connection to a public-sector organization outside of the above countries.
A private ITSP will therefore not be permitted to offer their value-add capability to a public sector organization outside of the above countries.
The private ITSP needs to comply with the criteria for provision of service. In particular:
In summary this policy mandates that a private ITSP can proceed with connecting to HSCN, from outside of England’s borders, on the condition that:
This Policy shall be adopted by all private ITSPs who intend to connect to HSCN, via a CNSP, from outside of England’s borders.
For further information and enquiries please email the NHS Digital enquires team at enquiries@nhsdigital.nhs.uk.
| Term | What it means |
|---|---|
| Adequate country | The European Commission has the power to determine, on the basis of article 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection, whether by its domestic legislation or of the international commitments it has entered into. |
| CNSP | Consumer Network Service Provider |
| Crown Dependant |
The Crown Dependencies are not part of the UK but are self-governing dependencies of the Crown. The Crown Dependencies are the Bailiwick of Jersey, the Bailiwick of Guernsey (which includes the jurisdictions of Guernsey, Alderney and Sark) and the Isle of Man. |
| Devolved nation | These are Wales, Scotland and Northern Ireland |
| EEA | European Economic Area |
| H&SCA 2012 | Heath and Social Care Act 2012 |
| HSCN | Health and Social Care Network. The successor service to the N3 network. |
| ITSP | IT service provider |
| ODS | Organisation Data Service |
| PES | Peering Exchange Service |
| Request letter | Formal letter submitted by a Devolved Nation requesting access to HSCN beyond England’s borders. (re: Heath and Social Care Act 2012 – Section 255 and the HSCN Direction 2017) |
| TN | Transition Network - continuation of services to assist migration to HSCN. |