Business continuity

As with most connectivity for healthcare delivery, the Health and Social Care Network (HSCN) is an important consideration.

Section 2 (Technical and security) of the HSCN Obligations Framework, specifically obligation ID TOW16* states that mobile connectivity could either be used as a temporary resilient connection, or for more permanent connections, provided written approvals and are obtained from the HSCN Authority. See footnote  for the full wording of TOW16.

As mobile networks don’t offer an integrated HSCN SIM service, to access HSCN, you would need either:

• a Remote Access Server (RAS) solution from an approved HSCN Consumer Network Service Provide (CNSP), or
• a Virtual Private Network (VPN) connection to a private healthcare domain that already has HSCN access 

This connectivity option is available to view in the online HSCN Technical Guidance – Scenario 4.

It is strongly recommended that NHS organisations make use of the support and guidance provided by the National Cyber Security Centre (NCSC).

Review the Data Security and Protection (DSPT) Toolkit. This is an online self-assessment tool that allows organisations to measure their performance against the National Data Guardian’s 10 data security standards. As data security standards evolve, the requirements of the DSPT are reviewed and updated to ensure they are aligned with current best practice.

Refer to Cyber Essentials. This is an effective, government backed baseline scheme that will help you to protect your organisation, whatever its size, against a whole range of the most common cyber-attacks.

Mobile connectivity is offered by mobile operators on a “reasonable endeavours” basis and it is therefore difficult to define contractual SLA’s due to the nature of use across a wide area of unknown coverage. Network coverage and quality can change without prior notification, so any business continuity planning should include regular testing of any mobile backup solution.

Failover to use of mobile solutions should be included in any testing and also the failover between SIMs within the cellular solution itself. Loss of a network can be simulated through the use of applying bars to the relevant account with the mobile operator.

Mobile backup connectivity solutions are also unlikely to have the same bandwidth as primary connectivity and therefore strategies for application prioritisation and Quality of Service (QoS) rules may need to be included in the business continuity planning for use of mobile backup solutions.