Shaping Cloud and GM HSCP

• The Greater Manchester Combined Authority (GMCA) and Greater Manchester Health and Social Care Partnership (GM HSCP) did an audit in terms of understanding their digital estate and what they would need to do in terms of cloud migrations.
• Through this discovery phase, came a desire to share assets, avoid repetition and have things built centrally. They looked at pain points from an identity and access management perspective and found that a key pain point for users was having to have numerous passwords and logins to access digital products.  
• Shaping Cloud was asked to look at the market for an identity access management tool but nothing currently existed that fit their needs. Hence the creation of GM Identity.
• User verification was identified as a key element in providing GM Identity in a safe and secure way.
• After assessment, NHS login was identified as a solution for end users.
• Having NHS login on the platform has: given confidence and ease of access for users and helped accelerate the on boarding of apps who require citizen access to a certain level of identity verification.

There was a desire for Health & Social care and the Combined/Local Authority in the Greater Manchester area to work together and create a seamless approach and shared assets to improve the health, wealth and wellbeing of the 2.8 million people living in the region.

Hence, the GM HSCP was formed to take charge of health and social care spending for the region. The GM HSCP includes 23 public sector organisations such as NHS Trusts (community, mental health, secondary care and ambulance) and Local Authorities.

The GM HSCP developed a digital plan to:

• connect and modernise the region’s health and social care system
• empower staff with technology that helps them provide better care and
• make services more accessible for people wherever they are in Greater Manchester

This led to the creation of the GM Digital Platform, which is a multi-supplier digital platform that provides robust and secure data sharing and application development across Greater Manchester. However, due to the plethora of systems and associated login credentials already established, it was recognised that time could be saved for citizens with a single login.  

Plus, there was also a need to reduce the time developers spent working on identity and access management. This resulted in the creation of GM Identity - a regional identity service for the public sector.

• GM Identity is Greater Manchester’s Identity and Access Management (IAM) product and is a collaboration between the Greater Manchester Combined Authority (GMCA), the GM HSCP and Shaping Cloud.
• GM Identity launched in January 2020 and is a plug & play solution alongside Azure Active Directory, which facilitates a safe gateway to put in front of apps and manage citizen access to the platform. It needed the compliance and data security to ensure the right person was accessing the right data.
• After a market assessment, it was concluded that NHS login provided the right level of verification and authentication needed for members of the public to access the platform.

• Identity credentials and user permissions follow users across the network of apps and tooling, reducing account creation and maintenance tasks across all administrative touchpoints.
• GM Identity is currently utilised by applications to reduce smoking in pregnancy, digitise child development plans, and facilitate interactions with various stakeholders regarding school age children’s development requirements.

The benefits of having NHS login on the platform are still being realised and will become more valuable as more apps and services are added and users can see the speed and convenience realised from a single, linked login option.

For the end users, having an NHS login has:

• given them a high level of trust in the platform as it has the NHS branding
• shown users how quick, easy and simple it is to then sign up for other apps and websites
• given them a seamless, centralised and consistent process to accessing digital services and tools

As Philippa Hendrie, Project Manager at Early Years Digitisation (using NHS login as part of GM Identity) told us, "There’s certainly a level of confidence if you say NHS login, that puts people’s minds at ease that its not some sort of separate thing. You don’t have to explain how it all works or how the securities have been put in place, it has a certain gravitas to it".

Shaping Cloud benefits

Benefits include:

• having the expertise to help developers wanting to be a part of GM Identity to be fully compliant, understand their legal obligations and have the level of assurance needed
• having the knowledge and expertise with NHS login to help future clients with advice on the level authentication required for a product
• a plug and play identity verification service bolted into the regional identity service they’ve developed that can be trusted by clients and citizens alike

GMCA & GM HSCP benefits

Benefits include:

• information can be shared between the general public, health care professionals and local authority representatives, safe in the knowledge the data is secure and being accessed by appropriate parties
• having NHS login as part of GM Identity which ensures that the right person accesses the right information at the right time
• from an IG perspective they can be confident that 3rd party suppliers hit their required governance and compliance levels to provide safe and secure digital tools for their citizens

For developers, the key benefit is one of time and money in that those who wish to be a part of the platform now don’t have to think about or invest in a login solution, they can just plug and consume the service, saving the client time and money.

Rebecca Stockdale (Head of Product at Shaping Cloud) said, "Digital leads for Regional partnerships like Integrated Care Systems (ICS) or Sustainability and Transformation Partnerships (STP) can focus on what they’re building, doing quicker development and save money not having to create an authentication process for each app, or create unnecessarily complicated identity and access management solutions. Public sector orgs can instead focus on the needs of their users and ensure that their data is safe guarded by an assured and secure identity service that’s easy to use and a consistent experience."

• For the NHS login on boarding team, working in a collaborative way with Shaping Cloud has helped us develop the process, understand in more detail and respond better to this new approach of on boarding for a digital platform.  
• NHS login is working closely with GMCA and Shaping Cloud to help with its successful implementation across the platform and iterate the level of verification to fit with the user case for the different apps and services.
• For instance, it has been found that for the Early Years product the highest level of verification provided by NHS login (P9) was not the best fit for everyone and actually a mid-level of verification was more appropriate. Shaping Cloud and GMCA are now working towards implementing this verification level alongside the P9 level so users have the option.
• This will help facilitate the ease of user on boarding for Early Years as they can uplift to a P9 in their own time, when convenient and when they need to access services which require a higher verification level, if they need to.
• “After receiving user feedback we’ve seen the benefit in reducing the authentication level to P5 which enables increase level of activation to certain people within the community”, Phillippa Hendrie (project manager at Early Years Digitisation).