Use of services or facilities provided by the NHS CFH is for ASRs and their Authorised Users only, and in accordance with the requirements for those services.

Organisations are not authorised to access NHS CFH services unless an IGSoC submission has been completed, submitted and approved by the NHS CFH IGSoC Team.

By signing and submitting the IGSoC, the Authorised Signatory agrees to accept future versions of the IGSoC in order to continue receiving NHS CFH services.

The ASR will be notified of changes to the IGSoC in advance of new versions becoming effective, using the email address provided on the initial IGSoC form or later notified in writing.

This agreement may be terminated by either party at any time. The organisation may then have its services from NHS CFH ceased.

The ASR is required to enforce, through local disciplinary or contractual measures, where necessary, the Information Governance standards and processes including, where appropriate, the registration process and adherence to conditions identified in the RA01 registration form signed by its Authorised Users.

If there are any changes to the ASR's legal status, i.e. change to its name, merger with another organisation or anything that otherwise changes its legal status, the new organisation must resubmit an IGSoC.

In the event that NHS CFH changes the conditions of being an ASR, it may require the organisation to reaffirm their compliance or otherwise with the relevant changes at that time.

Contents of this IGSoC must not be altered or modified from their original state.

Use of the Airwave service shall be in accordance with the Airwave Codes of Connection and Practice (as amended from time to time) and made available to Airwave users.

The services provided by NHS CFH to the ASR must be used for accessing NHS CFH accredited systems and services and not for inappropriate browsing of other internal and internet systems.

Inappropriate browsing of the Internet shall be defined by the ASR, through an Acceptable Usage Policy (AUP) made available to all local Authorised Users. Such policies shall indicate the scope and extent to which users may make use of these network services, including specific guidance on access to the Internet.

Inappropriate browsing of internal systems shall be defined as anyone attempting unauthorised access to any system connected to the N3 environment without permission from that system owner.

The ASR should appoint a person to have responsibility for the security management of the ASR's network connection(s) and their locally connected systems.

ASR shall manage their networks and connected systems in accordance with their Security Policy.

NHS CFH services should be protected against unauthorised viewing and have sufficient inactivity timeout settings via the organisations security policy. This should be enforced through local policies and procedures.

Access to NHS CFH infrastructure and connected systems are subject to appropriate access and authentication controls that meet the NHS CFH Information Governance standards (as amended from time to time). Those services not applicable to Smartcard access and authentication control, should have suitable policies, procedures, processes, controls and monitoring to ensure NHS CFH standards are met.

The use of NHS CFH provided infrastructure or services for unauthorised advertising or other non-healthcare related activity is expressly forbidden and must not be undertaken.

NHS organisations may make limited use of NHS CFH provided infrastructure to enable them to access services via the Internet as might normally be required to carry out such other business activities as are usual for providing care to patients, subject to such use being de minimus in terms of the resources consumed and of a nature not likely to bring the NHS into disrepute.

NHS organisations with a substantial requirement for non-NHS commercial activities must make separate arrangements and not use the NHS CFH provided standard service or services for such purposes.

Any and all types of communications, including wireless communications, used by the ASR associated with services delivered by NHS CFH and its contracted Service Providers or by NHS CFH compliant system suppliers.

An Information Governance framework, appropriate to the organisation type, is delivered and periodically updated in the NHS Information Governance Toolkit and Registration Authority guidance.

ASR must meet NHS CFH information governance requirements as identified in the NHS Information Governance Toolkit.

The ASR undertakes to ensure that the activities of its Authorised Users are overseen by an appropriate Information Governance framework.

In the event of an identified or reported service problem or incident, relevant support staff may be required to investigate and resolve those problems by accessing the functions and data affected. All such problem management activity shall be subject to NHS CFH information governance controls.

The ASR shall have a process for internal information security audit and management of alerts. This process should be tested for compliance at least twice in any twelve month period.

Unauthorised access may be considered for appropriate legal action by the system owner. ASRs are strongly advised to provide network management facilities, e.g. caching and filtering, that permit the permission or prohibition and logging of internet usage for the purposes of providing auditing and appropriate reporting to line management as defined in the local AUP. Action against such reporting is a matter for local organisations. The ASR shall enforce this locally through their procedures.

Each ASR shall ensure that, in the performance of its obligations under this IGSoC, it complies at all times with the Data Protection Act (1998).

The ASR shall proactively take steps to ensure the quality, accuracy and integrity of information and the appropriate use of the NHS number, in accordance with DH and NHS CFH policy.

The ASR acknowledge that, if required to process personal data (as the term `personal data' is defined in section 1(1) of the Data Protection Act 1998), in the course of providing the NHS CFH services, it shall do so only on the instruction of an appropriate Data Controller and shall maintain in place, having regard to the state of technological development and the cost of implementation, all appropriate measures, procedures and policies to protect the security and integrity of any such personal data.

Any threat or security event affecting or potentially affecting the security of NHS CFH provided infrastructure or services must be immediately reported via the NHS CFH incident reporting arrangements and/or other contacts provided by NHS CFH, for example the local RA manager for Smartcard incidents.

All systems connected to NHS CFH provided infrastructure shall be subject to up to date Anti-Virus/malware procedures and products in accordance with the NHS CFH published requirements and industry standard good practice, as documented on the NHS CFH website http://www.connectingforhealth.nhs.uk .

IGSoC compliance checks are required annually.

Compliance monitoring is through annual NHS CFH Information Governance Toolkit returns for ASRs or other forms of assurance required by NHS CFH.

The ASR shall allow NHS CFH or its representatives to carry out up to two ad-hoc on-site audits in any twelve month period.

Any connections to other systems or networks that are not covered by an approved IGSoC must either be disconnected or comply with a security mechanism specifically approved by the NHS CFH IGSoC team. If an ASR is in doubt over its compliance, the NHS CFH IGSoC team must be consulted for advice and guidance.

ASRs shall ensure that all users (both Authorised Users and other personnel accessing IT) in their organisation who may impact the performance/security of NHS CRS and/or services are aware they must not connect or reconfigure computer/network devices or load software which has not been notified where necessary to or authorised in advance by the ASR according to the highest standards and good practice guidance published by NHS CFH (as occasionally amended) Department of Health or provided by the NHS Connecting for Health IGSoC team.

Non-NHS organisations are required to provide written evidence, in a standard form, that their requirement to receive services is supported by an NHS organisation.

In the event that sponsorship for certain services expires, access to these services may be withdrawn.

In the event that all sponsorship expires and is not replaced, NHS CFH retains the right to deactivate service access.

ASRs shall ensure that they meet the requirements of DH and NHS CFH policy on personal data leaving England, or being viewed from overseas, by completing and complying with the Information Governance Offshore Support Requirements.

A copy of the Information Governance Offshore Support Requirements is available on request or can be downloaded from http://www.connectingforhealth.nhs.uk/igsoc .

Process