Nhsmail at Northern, Yorkshire & Humber Directors of Informatics Forum

NHSmail at Northern, Yorkshire & Humber Directors of Informatics Forum

9th May 2008

Additional Material, References, Responses & Clarifications

------

[1] Information Governance

Issue: Organisations need to identify and control ‘corporate’ data. Individual email accounts are a poor way of managing this process. Corporate data should not leave the organisation when the individual leaves

Response: in addition to individual email accounts NHSmail supports the concept of a ‘generic account’ (currently there are over 10,000 of these on the service). These are shared or multi-user accounts which can:

-retain corporate information separate from individual email accounts

-reflect, via the account name, corporate management and workflow, Some (real) examples are:

-Generic accounts can only be set up by LOAs (local organisation administrators) and must have an ‘owner’ who controls the ACL (access control list) to ensure that accounts are named appropriately and that there are controls over who has access to account contents

-For information which resides in individual mailboxes it is possible to create a simple business process which removes data from the mailbox before the user leaves the organisation – either by taking the .PST file of an Outlook user or by using the download feature of the NHSmail portal.

-For individual accounts we will be introducing a capability in the new Exchange based service to enable an Organisation to export mail data from a user’s mailbox when they are flagged as a leaver. This functionality is planned for delivery in the second or third release of the Exchange service.

Issue: NHSmail needs to make clear its Information Governance policies

Response: As legal entities each NHS organisation is responsible for its own compliance with information governance policies.

-NHSmail makes data sent via the service available to NHS organisations to use in whatever way local policies permit / describe

-Data on the NHSmail platform is retained by the service in perpetuity, unless deleted by the user. Deleted material is also currently stored (in the Secondary Mail Archive) in perpetuity – this policy is under review for the Exchange based variant of NHSmail as Exchange permits users a two week window in which they can restore material they have deleted

[2] Data management

Issue: Policy on data restores is not clear

Response:

-Requests for data restores are funded centrally. The CFH NHSmail team reserves the right however to approve / not approve requests

-Requests for the restore of clinical data will take priority over other types of data restore otherwise all requests are treated on a ‘first come first served’ basis

-Restores are carried out on a ‘best endeavours’ basis. No guarantees for timescales will be given

-Requests for covert data searches (disciplinary, criminal) are subject to a separate policy (see appendix A)

Issue: the imposition on quotas has compelled NHS organisations to provide storage mechanisms for email based data in excess of quota thresholds

Response:

-Organisations should be looking to provide storage repositories for information transported via email which is of value to the organisation. The carriage medium (email) is not suited to document management or enabling organisations to identify and manage its information assets

-The provision of an ‘archive’ (ie more storage space based on individual accounts) will not significantly assist in the management of information as it will (a) have its own limits (there can be no promise of infinite storage) and (b) not help in identifying or managing information of corporate value

-On average 95% of email data are files attached to email. One way of mitigating the email quota restriction is to enable users securely to share files which would otherwise be attached to email and sent to multiple users. The NHSmail team is currently working with its National User Group and Programme Board to develop a business case for creating a nationally available collaborative toolset to allow NHSmail users to share material without the duplicative process of email

[3] Mobile solutions

Issue: the move to exchange will enable NHSmail users to access the service via a wide range of mobile devices but only if these are ‘upgraded’ first

Response:Exchange 2007 supports the Exchange Activesync protocol on Windows Mobile devices running version 5 with MSFP (Messaging and Security Feature Pack) or later as detailed on the following web site:

-Version 5 was released in May 2005 with the feature pack available as a download released in November 2005.

-Anyone with a windows mobile device up to 2 years old should be able to leverage the new service. The attached shows the feature differences between the devices.

-Microsoft do not back port the built in email client but it is possible to purchase third party email clients for the older windows mobile devices.

-Nokia operates a different model to Windows in that it makes the latest client available to previous versions.

-If an Organisation rates longevity of the device as a priority they may prefer to consider Nokia as their referred handset.

Issue: NHSmail does not support the BlackBerry device

Response: As noted in the previous point NHSmail on Exchange will support a range of mobile devices – over 200 – offering the full Blackberry experience (ie ‘push’ email, calendar access etc) at no additional cost to NHSmail users (apart from device and airtime costs). In addition CFH believe the monthly air time cost for a device connecting to Exchange will be in the region of £10 per month compared to around £35 per month with Blackberry.

-The NHSmail Programme Board has asked the CFH NHSmail team to work with the service supplier to investigate whether it is possible to create a BlackBerry service on the new NHSmail which can be charged to users.

-The BlackBerry technical and licensing model does not permit NHSmail to offer a BlackBerry service equivalent to the Windows Mobile Active Sync without charge. It should also be noted that the DR (disaster recovery) design of the BlackBerry service is less robust than devices running under the Windows Mobile Active Sync protocol.

-Blackberry is able to license and use the Exchange Activesync protocol (Apple have now licensed Activesync for the iPhone). If Blackberry do license the protocol it will provide a more robust/resilient service than the current method of integration with Exchange.

[4] Migration to Exchange 2007

Issue: there is no ‘believable’ date for the transition to Exchange

Response: the Exchange-based NHSmail service will be available for live use from September 29th (2008). This was communicated to all users in the May 2008 edition of the NHSmail newsletter

The detail of the migration approach is currently being worked on and will be communicated soon.

[5] Third party usage

As a general statement of policy CFH is keen to ensure that the NHS and its business partners (for example Pharmacists and Dentists) have a secure communication route enabled via NHSmail.

-As with other NHS staff users of NHSmail,CFH requires local organisations to be assured that users they admit to the platform are properly validated and duly managed (for example processed as leavers/joiners). In practice this means that a Trust wishing its Pharmacists, for example, to have NHSmail accounts will need to extend its LOA (Local Organisation Administrator) support to include these groups

-Please remember that NHSmail users may communicate securely and directly with email users on other secure Government domains – these are listed below. Please also note that this now includes those local authorities using the ‘Government Connect’ email domain of GCSX.GOV.UK – this is particularly useful for those NHSmail users wishing to communicate with Social Services staff in local authorities

-gsi.gov.uk

-gsx.gov.uk

-gse.gov.uk

-pnn.gov.uk

-scn.gov.uk

-pnn.police.uk

-eu-admin.net

-gsisup.co.uk

-cjsm.net

-psops.net

-gcsx.gov.uk

Appendix A

Covert Data Search Policy

Appendix B

Windows Mobile 5 / 6 comparison

Appendix C