Third Party Connection Process - IntroductionFor the purposes of the process, a 'third party' is defined as an organisation not included in the definition of a 'Health Service Entity' as described in the BT and C&W Managed Network Services Agreement (MNSA). The definition of Health Service Entities includes; Health Service Bodies, Health Authorities, NHS Trusts etc. An example of a third party might be an external provider of managed applications but who is not part of the Health Service. Caldicott / DPA IssuesThe Third Party Connection Process covers ONLY the Infrastructure Security of the environment connecting to N3. It does not cover the requirements for security of any data that may pass between participating organisations or the approval for any data flows mentioned in the application. Approval of the application by the NHS Information Authority – Third Party Security Manager should not be taken as approval for any dataflow or business relationships mentioned in the application. Responsibility for Data Security issues remain with the participating organisations in any business relationship and the Data Owners involved. NHS and Third Party organisational participants must ensure that Caldicott Guardian approval has been issued for a business process where, access to, or transfer of, personal data or Patient Identifiable Data is involved before that process is implemented. Where Patient Identifiable or Personal Data my be exposed to a Third
Party organisation as a result of any access permitted to perform a support
function or as the result of a business dataflow then the Organisation
permitting the access to their environment or the Data flow to take place,
their Data Owner(s) and Caldicott Guardian, should ensure that there are
appropriate technical and organisational measures employed in relation
to the access or transfer of data within the participating organisations,
including sufficient policies, procedures and contractual agreements,
to cover their responsibilities under Caldicott and the Data Protection
Act. Secure Application HostingOrganisations may wish for applications/material to be hosted on NHSnet
with access to the application/material without the necessity to take
an NHSnet connection. If this service would meet the organisation’s
business need then please see Web
Based Application Hosting page For Third Party Organisations located in ScotlandPlease email: ISSGTelecomms@isd.csa.scot.nhs.uk For Organisation in
|
| To download the Process Documents in |
Further security reference documents are available from: 3rd Party Connections Managers
On-line view of the Document Checklist also supplied in the above Process Documents
Third Party Connections/Approval
List
A-Z list of companies/organisations with third party connections to NHSnet,
including those who have been recently granted connection approval.
|
Published by: |
Bill McKay |
Published: |
1 May 2002 |
Revised: |
10 February 2005 |
|
Last modified on: 16 February 2005 |