Secure Standard Introduction for Health and Social Care Organisations 09 June 2014 Clive Star 1

Background Developed to support the secure exchange of sensitive information between Health and Social Care Organisations using secure services Builds on the Information Governance Toolkit organisations already complete with some additional enhancements on a few of the individual baseline controls Developed with a potential to step up to meet Public Sector accreditation requirements

Scope Applies to health, public health & social care organisations in England Under the 2012 Health Act, organisations must have “due regard” for standard Standard covers services for personal and sensitive data only

The Specification The Secure standard is available at: Contains: –The Information Standards Notice –The Specification –The Baseline Control Set

Principles Aligned to ISO Independent accreditation Supports insourced and outsourced systems Organisation compliance System/Service provider compliance Clinical safety approval for the service Organisations with Public Sector (HMG) certification do not need to accredit to this standard as well

Health & Care Conformance Evidence of a security risk assessment for the service i.e. to consider whether is contains personal & sensitive data or not One of either the Information Governance Toolkit (IGT) / Public Services Network (PSN) Code of Connection or an Information Security Management System (ISMS) conforming to ISO Published policies and procedures for the use of secure using mobile devices Evidence provided by the service provider that they have met this standard. Clinical safety approval for the service Published policies for the use of with insecure systems

Interoperability - How it will work Secure will communicate via the Government Secure Intranet (GSi) / PSN infrastructure All services will need to conform to pan- government standards The HSCIC will create and administer 3 domains: – NHSmail – Secure NHS systems –TBC – Secure care systems

IT Services that meet the Standard Health and Social Care using –.nhs.net - NHSmail Local Government / Social Services –.gcsx.gov.uk Central Government –.gsi.gov.uk,.gse.gov.uk, gsx.gov.uk Criminal and Justice –.cjsm.net,.scn.gov.uk,.pnn.police.uk Military –.mod.uk

Next Steps Determine if your service contains personal or sensitive data Register with so we can include you in future targeted Seek evidence of conformance to health & care requirements Ensure service conforms to supplier aspects of standards. If you host your own you are the supplier Self-certify conformance. Good practice is to publish this, as with NHSmail: (