Plan for the day Objectives and principles Some pictures of SCPEA The Assurance Process –What has worked, How and Why? –Moving from pilots to general take-up. Lunch Identity and Information Sharing –Registration Authorities and Identity Key questions –Consent and governance –Products, procurement and markets –…..(your issues?)

Some pictures of SCPEA Trying to reflect back to you what we think we have observed. Systems and environments Roles and relationships Agencies and partnerships We are looking for your comments, discussions suggestions.

Intranet Server Facilities Applications Client Facilities The Internet

Intranet Server Facilities Applications Client Facilities The Internet Development and Support Facilities Post-it Notes In House Provision

Intranet Server Facilities Applications Client Facilities The Internet Post-it Notes Different Facilities Providers Remote Development and Support Facilities

Intranet Server Facilities Applications Client Facilities The Internet Post-it Notes N3 PDS SSB NASP - BT End to end security, safety and performance

Intranet Server Facilities Applications Client Facilities The Internet Post-it Notes N3 PDSSSB NASP - BT Data quality and consistency NHS Trust Facilities (LSP) Other Apps Record System RR

Post-it Notes Intranet Server Facilities Applications Client Facilities N3 PDS SSB NASP - BT NHS Trust Facilities (LSP) Other Apps Record System RR Client Caldicott Guardian Local Technical Support Data Quality Manager CfH Technical Support Other service providers and record holders Practitioner Service manager Roles and Relationships Information Governance Manager

Social Care Partners Applications, Systems and Service Suppliers Commissioning Relationships Department of Health Organisations and Agencies I Health Care Partners Practices PCT Acute Trust Connecting for Health Practices Local Authority IT Provision Adult Social Services Department Fire Brigade Housing ( ALMO) Voluntary Sector Organisations Commercial Suppliers

Contact Point DCSF Local Strategic Partnership Connecting for Health DoH PCT Acute Trust Police Fire Brigade Voluntary Sector Organisations Children’s Services Adult Social Services Local Authority Lead Authority Housing ( ALMO) Applications, Systems and Service Suppliers Procurement Relationships Organisations and Agencies II sysOA1OA2

Plan for the day Objectives and principles Some pictures of SCPEA The Assurance Process –What has worked, How and Why? –Moving from pilots to general take-up. Lunch Identity and Information Sharing –Technical developments across Government Key questions –Consent and governance –Products, procurement and markets –…..

The Assurance Process Assurance involves the separation of inspection and implementation responsibilities. For a technical system (component) testing is empirical. This requires that principles, plans and criteria are made explicit. For a socio-technical system….

Document the specific local process or configuration according to the standard The standard must be clearly and accessibly documented. Must be adequate, relevant and applicable to the local situation Must involve all parties with a stake or responsibility

Inspect and approve the document Inspection competence Inspection capacity Compares two documents: the plan and the standard

Implement the documented process/configuration Resources and capacities Capability and commitment

Inspect and approve the implementation Inspection competence Inspection capacity. Compares a set of observations with a specification.

Ongoing monitoring and audit of structures and processes Access and visibility Inspection competence Inspection capacity. Compares a set of observations with a specification.

Review the implementations and the standards against outcomes Access to the evidence. Participation and voice. Power to make decisions and to mandate change. Applies a set of principles and values to observations and evidence.

The accreditation process is applied to: Technical products Facilities such as platforms, networks and buildings. Technical services Client care processes Client service management processes.

What is the scope of SCPEA? Document process according to the standard Inspect and approve the document Implement the documented process/configuration Inspect and approve the implementation Ongoing monitoring and audit of structures and processes Review the implementations and the standards against outcomes Technical products Facilities such as platforms, networks and buildings. Technical services Client care processes Client service management processes.

The graveyard spot… Workshop material on Registration Authorities, smart cards and information sharing. Part of SOCITM work on LA response to the different technical initiatives in ID and security DoH, DWP, DCSF, DCLG.

Custodian Subject Sponsor A User is to be provisioned to access a record service controlled by a custodian. The record contains information about an individual – the subject. The process is imitated by a sponsor. An identity that can be authenticated. ● A role that confers the appropriate rights and capabilities respecting the record system. ● A token that is depended upon to link these together. ● To achieve this the user requires: User

Custodian Employee Employer Citizen CRM System Local Authority Subject Sponsor These roles can be mapped onto a number of different situations: User A User is to be provisioned to access a record service controlled by a custodian. The record contains information about an individual – the subject. The process is imitated by a sponsor.

Custodian Parent Head Teacher Child Pupil School Records School Subject Sponsor These roles can be mapped onto a number of different situations: User A User is to be provisioned to access a record service controlled by a custodian. The record contains information about an individual – the subject. The process is imitated by a sponsor.

Custodian Subject Sponsor Me Someone I trust My Home Page These roles can be mapped onto a number of different situations: User A User is to be provisioned to access a record service controlled by a custodian. The record contains information about an individual – the subject. The process is imitated by a sponsor.

User Custodian Subject Sponsor Care Agency Service User Practitioner Case Records These roles can be mapped onto a number of different situations: Service Commissioner The commissioning of Voluntary Sector Organisations to deliver service represents a particularly complex case. A User is to be provisioned to access a record service controlled by a custodian. The record contains information about an individual – the subject. The process is imitated by a sponsor.

Confirming Information Supplier. Custodian Subject Sponsor Registrar Credentials New Entry Other relationship holders User A Registrar creates a new identity: Credentials are presented to the registrar. ● These have been created in other relationships and data has been collected in a confirming information service. ● This results in a new entry in the register. ●

Confirming Information Supplier. Custodian Subject Sponsor Registrar New Entry That the registration process is fit for purpose and is adhered to. ● That the presenting individual corresponds to the one in the credentials and that they are valid. ● That the quality of data in the register conforms to the registration standards. ● Responsibilities of the Registrar Other relationship holders User

Printed Information Confirming Information Supplier. Custodian Subject Sponsor Registrar New Entry Provisioner Token Provider Other relationship holders Token Identifier Identity Info Card Issuing Process User Producing a smart card Electronic and printed information is placed on a blank card. ● Appropriate electronic keys and certificates are placed in the card memory. ● Capability New Entry Provisioning data is recorded for future authentication purposes. ●

Printed Information Confirming Information Supplier. Custodian Subject Sponsor Registrar Provisioner Authority Responsibilities of the Authority Token Provider Other relationship holders Token Capability Identifier Identity Info Card Issuing Process User That capabilities are necessary and sufficient for each role. ● That only qualified, current role holders are granted capabilities. ●

Confirming Information Supplier. Custodian Subject Sponsor Registrar Provisioner Token Printed Information Capability Identifier Identity Info Responsibilities of Token Provision That the intended capabilities are associated with each token. ● That each tokens are delivered to the intended recipients. ● Token Provider Other relationship holders User

Confirming Information Supplier. Custodian Subject Sponsor Registrar Provisioner Token Printed Information Capability Identifier Identity Info Authority Provisioning Responsibilities That all issued capabilities have been appropriately mandated by the Authority. ● That the list of valid capabilities is maintained and made available to authentication services. ● Authenticator Token Provider Other relationship holders User

Confirming Information Supplier. Custodian Subject Sponsor Registrar Provisioner Token Printed Information Capability Identifier Identity Info Authority Questions: What sorts of agencies and organisations are appropriate for these roles ? ● Which can be shared between different domains of identity and authentication ? ● Authenticator Token Provider Other relationship holders User

Questions and issues that have arisen in the Lessons Learned exercise

Prerequisites: What are the minimum requirements on an adult social care context to connect to spine services? –Organisational structures and relationships –Technical systems and processes –Political What are the potential show stoppers? What are the possible remedies?

Demography service as a starting point Arguments for: –Clearly defined service –Good vehicle for addressing the technical problems of connection and inter-working –Clear information management benefits Against: –Scaling the user registration approach. –Practitioner/client benefits are indirect (?)

Documentation issues There is an awful lot of material ! There have been many comments about: –Coverage –Levels of abstraction, specificity and detail –Realism –Organisation and accessibility Where is further investment needed? CfH + who?

Consent and information governance Social care practice and clinical practice. Who must be involved in the change process? How standardised is the design? –Process –Instruments (forms, reports, records…) What is the relationship between technical and organisational developments?

Products, services and markets What is the role of suppliers in rollout and take-up? Accredited products and Accredited installations. What is the transferability of SCPEA developments? User groups and the LA community?