Plan for the day

1. Plan for the day • Objectives and principles • Some pictures of SCPEA • The Assurance Process • What has worked, How and Why? • Moving from pilots to general take-up. • Lunch • Identity and Information Sharing • Registration Authorities and Identity • Key questions • Consent and governance • Products, procurement and markets • …..(your issues?)

2. Some pictures of SCPEA • Trying to reflect back to you what we think we have observed. • Systems and environments • Roles and relationships • Agencies and partnerships We are looking for your comments, discussions suggestions.

3. Applications Client Facilities Server Facilities Intranet The Internet

4. Post-it Notes Development and Support Facilities In House Provision Applications Client Facilities Server Facilities Intranet The Internet

5. Post-it Notes Remote Development and Support Facilities Applications Client Facilities Server Facilities Intranet The Internet Different Facilities Providers

6. Post-it Notes End to end security, safety and performance PDS SSB NASP - BT N3 Applications Client Facilities Server Facilities Intranet The Internet

7. Post-it Notes R R Data quality and consistency PDS SSB Record System Other Apps NHS Trust Facilities (LSP) Applications Client Facilities Server Facilities NASP - BT N3 Intranet The Internet

8. Caldicott Guardian Post-it Notes Other service providers and record holders Service manager R R Practitioner Client Information Governance Manager CfH Technical Support Data Quality Manager Local Technical Support PDS SSB NHS Trust Facilities (LSP) Record System Other Apps Applications Client Facilities Server Facilities NASP - BT N3 Intranet Roles and Relationships

9. Local Authority Department of Health Practices Practices Adult Social Services Department Commissioning Relationships PCT Housing (ALMO) Health Care Partners Voluntary Sector Organisations Social Care Partners Connecting for Health Acute Trust Fire Brigade IT Provision Commercial Suppliers Commercial Suppliers Applications, Systems and Service Suppliers Organisations and Agencies I

10. Applications, Systems and Service Suppliers Housing (ALMO) Procurement Relationships Lead Authority Local Authority PCT DoH Contact Point Connecting for Health Acute Trust Fire Brigade Children’s Services Adult Social Services Voluntary Sector Organisations DCSF Police Local Strategic Partnership Organisations and Agencies II sys OA1 OA2

11. Plan for the day • Objectives and principles • Some pictures of SCPEA • The Assurance Process • What has worked, How and Why? • Moving from pilots to general take-up. • Lunch • Identity and Information Sharing • Technical developments across Government • Key questions • Consent and governance • Products, procurement and markets • …..

12. The Assurance Process Assurance involves the separation of inspection and implementation responsibilities. This requires that principles, plans and criteria are made explicit. For a technical system (component) testing is empirical. For a socio-technical system….

13. Document the specific local process or configuration according to the standard • The standard must be clearly and accessibly documented. • Must be adequate, relevant and applicable to the local situation • Must involve all parties with a stake or responsibility

14. Inspect and approve the document • Inspection competence • Inspection capacity Compares two documents: the plan and the standard

15. Implement the documented process/configuration • Resources and capacities • Capability and commitment

16. Inspect and approve the implementation • Inspection competence • Inspection capacity. Compares a set of observations with a specification.

17. Ongoing monitoring and audit of structures and processes • Access and visibility • Inspection competence • Inspection capacity. Compares a set of observations with a specification.

18. Review the implementations and the standards against outcomes • Access to the evidence. • Participation and voice. • Power to make decisions and to mandate change. Applies a set of principles and values to observations and evidence.

19. The accreditation process is applied to: • Technical products • Facilities such as platforms, networks and buildings. • Technical services • Client care processes • Client service management processes.

20. What is the scope of SCPEA? • Technical products • Facilities such as platforms, networks and buildings. • Technical services • Client care processes • Client service management processes. • Document process according to the standard • Inspect and approve the document • Implement the documented process/configuration • Inspect and approve the implementation • Ongoing monitoring and audit of structures and processes • Review the implementations and the standards against outcomes

21. The graveyard spot… • Workshop material on Registration Authorities, smart cards and information sharing. • Part of SOCITM work on LA response to the different technical initiatives in ID and security • DoH, DWP, DCSF, DCLG.

22. Subject User Sponsor ● ● An identity that can be authenticated. A token that is depended upon to link these together. ● A role that confers the appropriate rights and capabilities respecting the record system. A User is to be provisioned to access a record service controlled by a custodian. The record contains information about an individual – the subject. The process is imitated by a sponsor. To achieve this the user requires: Custodian

23. Subject User Sponsor Citizen Employee Local Authority Employer CRM System A User is to be provisioned to access a record service controlled by a custodian. The record contains information about an individual – the subject. The process is imitated by a sponsor. These roles can be mapped onto a number of different situations: Custodian

24. Child Pupil Subject Parent Head Teacher User School Records Sponsor A User is to be provisioned to access a record service controlled by a custodian. The record contains information about an individual – the subject. The process is imitated by a sponsor. These roles can be mapped onto a number of different situations: School Custodian

25. Subject User Sponsor Someone I trust Me My Home Page A User is to be provisioned to access a record service controlled by a custodian. The record contains information about an individual – the subject. The process is imitated by a sponsor. These roles can be mapped onto a number of different situations: Custodian

26. Subject User Sponsor Practitioner Service User The commissioning of Voluntary Sector Organisations to deliver service represents a particularly complex case. Care Agency Case Records Service Commissioner A User is to be provisioned to access a record service controlled by a custodian. The record contains information about an individual – the subject. The process is imitated by a sponsor. These roles can be mapped onto a number of different situations: Custodian

27. Other relationship holders Confirming Information Supplier. Subject User Sponsor Credentials ● ● Credentials are presented to the registrar. This results in a new entry in the register. ● These have been created in other relationships and data has been collected in a confirming information service. NewEntry A Registrar creates a new identity: Registrar Custodian

28. Other relationship holders Confirming Information Supplier. Subject User Sponsor ● ● That the registration process is fit for purpose and is adhered to. That the quality of data in the register conforms to the registration standards. ● That the presenting individual corresponds to the one in the credentials and that they are valid. NewEntry Responsibilities of the Registrar Registrar Custodian

29. Other relationship holders Confirming Information Supplier. Subject User Sponsor Card Token Issuing Process Identifier Printed Information Identity Info Provisioner Token Provider NewEntry NewEntry ● ● Provisioning data is recorded for future authentication purposes. Electronic and printed information is placed on a blank card. Capability ● Appropriate electronic keys and certificates are placed in the card memory. Producing a smart card Registrar Custodian

30. Other relationship holders Confirming Information Supplier. Subject User Sponsor Card Token Issuing Process Identifier Printed Information Identity Info Authority Provisioner Token Provider ● That capabilities are necessary and sufficient for each role. Capability ● That only qualified, current role holders are granted capabilities. Responsibilities of the Authority Registrar Custodian

31. Other relationship holders Confirming Information Supplier. Subject User Sponsor Token Identifier Printed Information Identity Info Provisioner Token Provider Capability ● That the intended capabilities are associated with each token. ● That each tokens are delivered to the intended recipients. Responsibilities of Token Provision Registrar Custodian

32. Other relationship holders Confirming Information Supplier. Subject User Sponsor Token Identifier Printed Information Identity Info Authority Provisioner Token Provider Authenticator Capability ● That all issued capabilities have been appropriately mandated by the Authority. ● That the list of valid capabilities is maintained and made available to authentication services. Provisioning Responsibilities Registrar Custodian

33. Other relationship holders Confirming Information Supplier. Subject User Sponsor Token Identifier Printed Information Identity Info Authority Provisioner Token Provider Authenticator Capability ● What sorts of agencies and organisations are appropriate for these roles ? ● Which can be shared between different domains of identity and authentication ? Questions: Registrar Custodian

34. Questions and issues that have arisen in the Lessons Learned exercise

35. Prerequisites: • What are the minimum requirements on an adult social care context to connect to spine services? • Organisational structures and relationships • Technical systems and processes • Political • What are the potential show stoppers? • What are the possible remedies?

36. Demography service as a starting point • Arguments for: • Clearly defined service • Good vehicle for addressing the technical problems of connection and inter-working • Clear information management benefits • Against: • Scaling the user registration approach. • Practitioner/client benefits are indirect (?)

37. Documentation issues • There is an awful lot of material ! • There have been many comments about: • Coverage • Levels of abstraction, specificity and detail • Realism • Organisation and accessibility • Where is further investment needed? • CfH + who?

38. Consent and information governance • Social care practice and clinical practice. • Who must be involved in the change process? • How standardised is the design? • Process • Instruments (forms, reports, records…) • What is the relationship between technical and organisational developments?

39. Products, services and markets • What is the role of suppliers in rollout and take-up? • Accredited products and Accredited installations. • What is the transferability of SCPEA developments? • User groups and the LA community?