HSCN Cloud Service Provider (CSP) Policy

This document sets out the Cloud Service Provider (CSP) policy for the Health and Social Care Network. 

This policy defines the role of a CSP within the HSCN operating model and explains the clear distinction between a CSP and Consumer Network Service Provider (CN-SP). This policy supersedes any previous NHS England guidance for HSCN CSPs.

Policy mandate

A CSP typically provides one or more applications or services to its customers. These products and services are wide ranging and include hosted applications and services, web-enabled cloud applications, and other IT infrastructure, components, or functions.

Under the HSCN operating model, a CSP may provide such services to health and social care organisations. These customer organisations will typically connect to CSP services via:

• the HSCN
• a private WAN connection provided by the CSP
• a remote connection, such as remote-access VPN via the Internet, provided by the CSP

In any of the above connectivity scenarios a CSP will provide the customer with access to only the applications or services they have purchased. Onward or pass-through connectivity to the wider HSCN must not be enabled for end users.

Applications and services provided by a CSP may need to access HSCN resources such as SPINE. This Policy allows this functionality but, as stated above, only the system-to-system connectivity is permitted, the provision of general connectivity to the HSCN must not be provided to customers of the CSP.

The diagram below illustrates a typical HSCN CSP scenario.

The provision of general connectivity to the HSCN is the role of a CN-SP and any supplier wishing to provide this type of service must apply to become a CN-SP. Please refer to HSCN supplier information.

Clause 3.5 from the ITSP connection agreement states:

The HSCN Consumer must not re-sell HSCN Connectivity Services, except where connectivity to the HSCN forms an integral and indivisible part of a service offered by the HSCN Consumer including, without limitation, software-as-a-service or data or application hosting, which in each case relies upon an HSCN connection.

HSCN assurance marks

CSPs do not have authority to use the HSCN assurance marks or branding on any website or marketing information. This is reserved for accredited CN-SPs.

If you have any questions around your proposed design for the provision of service acting as a Cloud Service Provider, contact [email protected].

To become a HSCN CSP the “IT Service Provider Connection Agreement”, will need to be signed by the prospective CSP.  The terms of this document may be updated by NHS England periodically and CSPs will need to adhere to these updated terms.

At time of this policy’s publication, the HSCN Direction from the Department of Health and Social Care, dated 19th Oct 2017, outlines the authority to proceed with the deployment of HSCN, however it does not on its own provide the provision of such services outside of England.

Therefore, for the time being, CSPs’ data centres will need to be physically located within England whilst this is being assessed and approved for broader geographically coverage.

This Policy document will be reviewed regularly, and updates will be published on the HSCN web site.

For further information and enquiries please email the HSCN enquires team at [email protected].