Cloud innovation guidance

In line with the UK Government Innovation Strategy, the NHS and healthcare providers are using cloud technologies as a means to rapidly prototype and evaluate services. In essence, organisations are looking to use the cloud to drive secure, data-driven innovation and advance key business initiatives, but they have a number of competing business priorities. Therefore, by taking an approach that considers business, technical, and financial priorities together, they can gain greater value from their cloud innovation strategies.

Cloud service providers are releasing new products and services on a weekly basis based on global customers and innovators keen to test, learn and adopt these new releases. Most of the cloud providers first release these features within the USA before rolling these out to other continents for general availability based on customer demand.

To help facilitate innovation within the NHS, NHS England teams work closely with Cloud service providers to provide feedback and direction with regards to technologies the NHS are wanting to adopt. This helps bring these technologies to UK based regions, but this can take time based off the demand the cloud service providers are seeing for their services, which may slow down the understanding and innovation using new technology.

This guidance sets out that it is OK to use global regions for the understanding, learning, and trialling of new cloud services as there is no personally identifiable or production data being used to trial this, all data being used must be a complete test set data and new services being used for innovation are decoupled from production services used by the NHS.

This will allow informed decisions backed by understanding and interaction with the new services and provide evidence to use cases that can be pasted onto the cloud service providers to offer a service within the UK.

During any innovation trial, learning platform, or investigation no personally identifiable data, production data, or data that is captured from an NHS production system must not be used. All trial data must be a represented test set of data to maintain that no data is

All Innovation workloads must undergo a Data Privacy Impact Assessment (DPIA) to understand what the impact would be if the innovation platform does leak or breach any form of data and it is up to local or national IG teams and Senor Responsible Owners (SRO’s) to have final approval for proceeding with new innovation workloads.

Cloud Innovation workload platforms should have a realistic time limit set on them (which can be extended if required) to ensure that the platforms do not remain in service longer than they need to and cause additional cost, effort, and duplication to manage and maintain them. As part of this, any NHS or healthcare innovation workload should be managed and monitored for cost and consumption of services. Furthermore, an exit strategy should be put in place to close down any innovation cloud workloads once the platform is not required, and all information to form an outcome is gathered.

Innovation security

All cloud platforms must follow the NHS Cloud security guidance including innovation workloads outside of the UK.

Innovation development

All code generated as part of an innovation programme of work should follow the NHS Cloud development guidance.