9 All patient identifiable and sensitive data N/A data is stored and processed within – MUST be maintained in accordance with the local technical environment. Government’s offshoring policy () and Department of Health policy. 10 The Service Provider MUST provide tools to Currently, a number of are in operation ensure that mobile devices are appropriately to manage mobile devices such as secured when accessing the email service. Activesync, Good and Airwatch Mobile This could include: Device Management (MDM) systems. These provide most of the functionality Functions to allow/deny/quarantine specified. by device type, organisation or groups of users. Remove device, expire password, and wipe any data associated with the service. Reporting functions/ capabilities. Detect and block rooted (i.e. jail broken) devices. 11 Each Service Provider SHOULD provide LHIS operates an accredited digital eDiscovery tools to support the forensics function which supports administration of the service, especially with eDiscovery for internal investigations and respect to the Data Protection Act 1998 and supporting criminal investigations. Freedom of Information Act 2000. Support for Subject Access Requests and FOI requests are routinely conducted by the email management team and the processes supporting these requests have been in operation for a number of years. Safety 12 Service Providers SHOULD comply with the Clinical risk management documentation provisions of has been developed and deployed. Interoperability 13 Each Service Provider SHOULD comply with Defined by Microsoft Exchange technical the . specifications.
9 All patient identifiable and sensitive data MUST be maintained in accordance with the Government’s offshoring policy () and Department of Health policy. N/A – data is stored and processed within local technical environment. 10 The Service Provider MUST provide tools to ensure that mobile devices are appropriately secured when accessing the email service. This could include: Functions to allow/deny/quarantine by device type, organisation or groups of users. Remove device, expire password, and wipe any data associated with the service. Reporting functions/ capabilities. Detect and block rooted (i.e. jail broken) devices. Currently, a number of are in operation to manage mobile devices such as Activesync, Good and Airwatch Mobile Device Management (MDM) systems. These provide most of the functionality specified. 11 Each Service Provider SHOULD provide eDiscovery tools to support the administration of the service, especially with respect to the Data Protection Act 1998 and Freedom of Information Act 2000. LHIS operates an accredited digital forensics function which supports eDiscovery for internal investigations and supporting criminal investigations. Support for Subject Access Requests and FOI requests are routinely conducted by the email management team and the processes supporting these requests have been in operation for a number of years. Safety 12 Service Providers SHOULD comply with the provisions of Clinical risk management documentation has been developed and deployed. Interoperability 13 Each Service Provider SHOULD comply with the . Defined by Microsoft Exchange technical specifications.
isb_1596_conformance_assessment_-_lhis__v1_1_hmcm.docx