Skip to main content

HSCN: private IT service provider connecting from outside of England’s borders policy

This page provides a summary of the 'HSCN: Private IT service provider connecting from outside of England’s borders' policy. The content of this page is designed to support users and suppliers understanding of this policy. The policy outlines the approved scenarios and criteria under which IT service providers can offer services over HSCN when based outside of England’s borders.

Please consider the information on this page to be for guidance purposes only.

The HSCN: Private IT Service Provider connecting from outside of England’s borders Policy document itself should be considered the official NHS Digital policy document under all instances.

Published October 2018.

Introduction

The Health and Social Care Network (HSCN) delivers new and significantly different network services for health and social care as part of its remit to provide successor services to the N3 network. 

HSCN creates the effect of a single network across health and social care providers and their partners. All health and social care organisations in England are within scope of the HSCN solution, which helps deliver an integrated care service.

The Transition Network (TN) provides a platform for continuation of services previously contracted under the N3 agreement. This service is managed as part of the HSCN programme and is delivered by BT. The TN will be managed as a ‘run-down’ service and will be provided for the minimum period required to migrate services to HSCN.

'Run-down service' within the context of this policy refers to the reduction in dependency on the TN as network traffic is migrated to the HSCN. TN traffic will reduce until switched off and the TN contract has been 'run-down' to closure.

The policy

This policy sets out when a private IT service provider (ITSP) may connect directly to the HSCN from outside of England’s borders.

To assist with this a set of criteria for provision of service and approved connection scenarios have been provided. These scenarios show what a private ITSP needs to adhere to if they are to:

  • connect to the HSCN from outside of England
  • provide their 'value-add' capability to the wider HSCN community

'Value-add', within the context of this policy, means any additional capability or service accessed by an end-user (such as an NHS trust) which is reliant on a HSCN network connection to access.

Criteria for provision of service

a) The HSCN Connection Agreement can be signed by non-UK private ITSPs

The organisation will require an English presence (post code for example) to apply for an Organisation Data Service (ODS) code, which is a pre-requisite for submitting a Connection Agreement. If that is not possible then by exception the HSCN Operations team will manually create a new organisation record and supply unique organisation identifier, so that the foreign organisation can then use the existing self-serve Connection Agreement process.

b) Private ITSPs are not governed by the Heath and Social Care Act 2012 (H&SCA 2012) or the HSCN 2017 Direction

This means they are not bound by the “within England border” condition.

c) Private ITSPs must only store data in an approved location

Private ISTPs must adhere to NHS Digital national guidance regarding off-shoring and the use of public cloud services. This means the UK, the European Economic Area (EEA) or adequate countries.

Adequate countries are a country deemed to have an adequate level of data protection by the European Commission. Full details can be found on the European Commission Policies, information and services page.

This allows data owners scope to release their data to the private ITSP. Any other geographic requirements will be managed by exception.

d) The HSCN Obligation Framework doesn’t restrict a Consumer Network Service Provider (CNSP) providing a connection outside of England

e) The CNSP Deed supports user access

That is, it supports health and social care public sector bodies within England, and it has the potential to extend to Scotland, Wales, Northern Ireland, and the Channel Islands.

f) The HSCN Access Policy supports user access within defined access scenarios

Where there is an approved access scenario for connection to HSCN the HSCN Access Policy allows for this under Section 5.1

“The HSCN Connection Agreement states that ‘connection to the HSCN is provided based on the business need to share information within the health and social care community’. 

This means that HSCN is available to any organisation where the purpose of its connection to HSCN is the delivery, facilitation, or support of health and/or social care in England.”

Once the three devolved nations have their HSCN request letters approved the HSCN Access Policy wording will be updated accordingly.

Access scenarios

The following three access scenarios describe the interactions between private ITSPs, consumer network service providers (CNSPs), the HSCN Peering Exchange Service (PES) and end consumers. All are outlined in Figure 1 below.

HSCN private IT service provider connection scenarios from outside of England’s borders

Figure 1 – HSCN private IT service provider connection scenarios from outside of England’s borders

A private ITSP can connect to HSCN, via a CNSP, and offer a ‘value-add’ capability based upon adhering to the “A” and “B” scenarios outlined in Figure 1. Find out what constitutes 'adequate countries'.

Scenario A - providing value-add capability to end consumers in England

A private IT service provider, who is located outside of England, is provided with a HSCN connection to enable their value add capability to be made available to public-sector health and social care communities in England.

Supporting messages

The Private ITSP needs to comply with the criteria for provision of service. In particular:

  • part a) for which the ITSP will need to apply for, sign and adhere to the ITSP Connection Agreement
  • part c) for which the ITSP will need to maintain adherence to the specific list of allowable countries
  • part f) for which the ITSP needs to know where their end public-sector customer base is located.

Scenario B - providing value add capability to end consumers in a devolved nation

This follows the same approach as Scenario A, however their value add capability can be made available to public sector health and social care communities within a devolved nation.

Supporting messages

The private ITSP needs to comply with the criteria for provision of service. In particular:

  • part a) for which the ITSP will need to apply for, sign and adhere to the ITSP Connection Agreement
  • part c) for which the ITSP will need to maintain adherence to the specific list of allowable countries. 
  • part f) for which the ITSP needs to know where their public sector end-customer base is located.

Scenario C - end consumers who are not in England or a devolved nation

For completeness this scenario has been included as the HSCN Access policy states that HSCN is available to any organisation where the purpose of its connection is the delivery, facilitation, or support of health and/or social care in England.

This is being extended to devolved nations upon the submission and approval of their HSCN request letters in accordance to Section 255 Health and Social Care Act 2012.

Note: At time of writing “Crown Dependents” are still under review and will be added via the appropriate process channels in due course.

A CNSP will therefore not be permitted to offer a HSCN connection to a public-sector organization outside of the above countries.

A private ITSP will therefore not be permitted to offer their value-add capability to a public sector organization outside of the above countries.

Supporting messages

The private ITSP needs to comply with the criteria for provision of service. In particular:

  • part b) which covers the subtlety between a private sector and a public sector health organisation
  • part f) for which the ITSP needs to know where their public sector end customer base is located

Policy mandate

In summary this policy mandates that a private ITSP can proceed with connecting to HSCN, from outside of England’s borders, on the condition that:

  • the private ITSP adheres to the criteria for provision of service a), b), c) and f)
  • the private ITSP aligns with access scenarios A and B

This Policy shall be adopted by all private ITSPs who intend to connect to HSCN, via a CNSP, from outside of England’s borders.

Further information and enquiries

For further information and enquiries please email the NHS Digital enquires team at enquiries@nhsdigital.nhs.uk.

Glossary of terms

Term What it means
Adequate country The European Commission has the power to determine, on the basis of article 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection, whether by its domestic legislation or of the international commitments it has entered into.
CNSP Consumer Network Service Provider
Crown Dependant

The Crown Dependencies are not part of the UK but are self-governing dependencies of the Crown.

The Crown Dependencies are the Bailiwick of Jersey, the Bailiwick of Guernsey (which includes the jurisdictions of Guernsey, Alderney and Sark) and the Isle of Man.

Devolved nation These are Wales, Scotland and Northern Ireland
EEA European Economic Area
H&SCA 2012 Heath and Social Care Act 2012
HSCN Health and Social Care Network. The successor service to the N3 network.
ITSP IT service provider
ODS Organisation Data Service
PES Peering Exchange Service
Request letter Formal letter submitted by a Devolved Nation requesting access to HSCN beyond England’s borders. (re: Heath and Social Care Act 2012 – Section 255 and the HSCN Direction 2017)
TN Transition Network - continuation of services to assist migration to HSCN.

Related pages

  1. asset
Last edited: 2 November 2018 12:19 pm