Introduction

This document provides organisations, seeking to federate with NHSmail Calendar, with a list of common questions and answers on federation. The document also provides a summary of the on-boarding, support and disconnection (de-federation) processes.

Overview

The NHSmail service has been designed to enable interoperability with third-party systems. NHSmail Calendar is one key area of the service where interoperability holds significant value in enabling collaboration across health and social care:

• • NHSmail Calendar federation enables NHSmail users to view free and busy information within the calendar between users in a partnering organisation that has federated calendars.
  • Federated contacts can only view, by default, the free and busy information within the calendar. The individual users can opt to share increased visibility to make the location and subject fields within their calendar available if they choose to.
  • Calendar federation is controlled by security configurations that must be reciprocated between NHSmail and partnering organisations.

For guidance, FAQs and technical information on how to federate with NHSmail, please refer to Federation and synchronisation

• NHSmail Calendar federation requires the consent and correct configuration of both parties of the federated relationship, which will need to be completed by the Microsoft Exchange system administrators; Accenture on behalf of NHS England.
• Currently, federation with NHSmail is only being offered to those organisations operating in a health and care setting, for example, local authorities, publicly funded health services, pharmacies etc.
• NHSmail Calendar federation will only be offered to health and care organisations operating with Microsoft Exchange 2010 SP3 or higher.

Terminology

Interoperability – the ability of computer systems or software to exchange and make use of information.
Federation – functionality which allows users to communicate with others outside their organisation.
Authorised signatory – officer or representative vested (explicitly, implicitly, or through conduct) with the powers to commit the authorising organisation to a binding agreement.
Federation partner & Partner – organisation with which calendar federation / sharing is enabled between.
Federation Partnership Agreement (FPA) – a formal document agreeing the federation between the partner organisations.
Domain Name System (DNS) – the Internet’s system for converting alphabetic names into numeric IP addresses.
De-federation – the process of disconnecting the link to NHSmail calendar federation service.
End-user – user of the calendar service.
Single Point of Contact (SPoC) – a person or department serving as the co-ordinator or focal point of information, concerning an activity or program. For calendar federation, the SPoC is each organisation’s local helpdesk purposed for providing IT support.

Guidance and process flows to federate / de-federate

High-level federation process for NHSmail Calendar

Organisations wishing to federate with the NHSmail Calendar service must demonstrate that they:

• work in a health and care environment and the system will be used for such purposes
• hold a level of information governance maturity
• will confirm by signing up to the federation partnering agreement that organisations hold an appropriate level DSPT or an equivalent e.g. PSN CoCo.

Organisations should read the Calendar federation section later in the document, to understand the requirements for federation. The above will be demonstrated by signing and accepting the terms set out in the Calendar Federation Partnership Agreement.
Process for organisations seeking to federate with NHSmail Calendar:

• The process starts by emailing feedback@nhs.net to raise a request. Please detail firstly the Microsoft Exchange infrastructure in use and secondly, the health and care use in the initial request.
• If the federation request meets the acceptance criteria as demonstrated above, the NHSmail team will respond with a Calendar Federation Partnership Agreement (FPA) which must be completed and signed by an authorised signatory for your organisation.
  If the request doesn’t meet the acceptance criteria, the organisation will be informed why it cannot federate with NHSmail.
• Once completed and signed, please return the FPA to feedback@nhs.net. The FPA will be reviewed by NHSmail and, if approved, the request will be submitted to the NHSmail technical team who will advise when the federation will be enabled. Any concerns identified at the point of submission will be communicated back to the federation partner.

Please note: In terms of expected timescales, all federation requests
approved for implementation will be processed on the 7^th of each month, with the change taking up to 10 days.

• Upon enablement, the NHSmail technical contact will liaise with the federation partner’s technical contact to perform testing to ensure the service is operational.
• Upon successful federation, NHSmail will publish details of federated organisations on the NHSmail Portal help pages, including the name of the organisation, date federated and the federated partner’s statement on their intended use of the federation service.

Process representation for federation

High level de-federation process from NHSmail Calendar

Once federation is in place, there are two ways a federated partner can have their federation suspended or revoked:

1. The term of the NHSmail contract with the current NHSmail delivery partner coming to an end which will invoke the process to remove federation services with the federation partner.
2. If there is a change in the business, technical or operational infrastructure of the federated partner organisation, for example, if the federated partner ceases to trade, there is a change in ownership, change of name, technology/security change or anything that would require a new application for federation. In the second scenario, for revoking federation, it is the responsibility of the federated partner to notify NHSmail via feedback@nhs.net within 48 hours of any unplanned changes or issues occurring and within 24 hours of any planned changes being agreed. The appropriate contact identified within the FPA must notify their counterpart within the organisation using NHSmail.

There is no formal requirement for the renewal of an FPA. It is the partner organisation’s responsibility to notify NHSmail to remove federation or of any changes with the partner (in line with the de-federation process outlined) that impact the federation.

Process representation for de-federation

Support model for federated organisations

If issues are experienced with the federation service, such as a partner end-user is unable to access an NHSmail user’s calendar, the partner should:

• Contact the NHSmail user whose calendar they wish to view
• Ask the user to check their calendar settings to ensure shared calendar permissions have been set appropriately.
• Contact their own organisation’s support desk to raise a fault, if access is not blocked.
• The partner’s support desk will provide support in the first instance, using their internal escalation process
• Arrange for their SPoC, using the contacts identified in the FPA, to escalate the issue with the NHSmail national helpdesk, if the investigations by the partner identify that the issue lies with the NHSmail service. The NHSmail helpdesk will follow its standard process to identify and resolve the issue.

NHSmail are only able to investigate issues on the NHSmail side of the connection.
If there is a change in SPoC at the partner organisation, it is the partner’s responsibility to notify NHSmail through helpdesk@nhs.net. Only the identified contacts within the FPA are authorised to request information or support from NHSmail.
Process representation for helpdesk support

Calendar federation

The NHSmail Calendar federation service uses the Microsoft Azure platform to allow safe access to calendars across organisations using Microsoft Exchange 2010 SP3 or newer. The configuration information below supports an organisation in enabling the calendar federation service. The federation will be enabled upon successful approval of the federation partnership organisation.

Governance responsibilities

As with all systems, controls can only go so far, so users should always be aware of their individual responsibilities in relation to information governance and clinical safety. Users must act in accordance with their own organisational governance and clinical safety policies and processes. The NHSmail Acceptable Use Policy (AUP) also provides guidance on calendar federation.
The NHSmail service has calendar access limited by default to free / busy visibility through the scheduling assistance. Individuals are empowered to increase the level they wish to share to include location and subject information within the Outlook calendar view.
This does not mean that federated organisations operate with the same criteria. Some may have limited to no access by default, or full access.
The recommendation from the NHSmail service is for users to not share or store any sensitive or confidential information within calendar entries. This also includes ensuring subject field within the calendar entry are specific to the meeting and not including any sensitive or confidential information

Frequently Asked Questions (FAQs)

Federating with NHSmail Calendar service

Technical requirements & synchronisation

Technical support arrangements

Clinical safety

Connection renewal