Leicestershire Health Informatics Service

Iaas - Infrastructure as a service

LHIS IaaS provides a fully managed best in class enterprise offering. The service provides fully managed server instances delivered to the customer preconfigured with a range of operating systems, antivirus, critical patches installed and back up routines in place. This is complemented by fast resilient HSCN and internet network links.

Features

• HSCN and Internet Hosting

Benefits

• Service Level Agreement provided
• HSCN and Internet Hosting
• Centrally hosted at LHIS in Leicester
• CRM supported
• Secured by the LHIS IT Assurance Team
• Over 20 years experience

£450 a unit a day

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at lpt.lhis.info@nhs.net. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

541404680612498

Contact

LHIS
01162953500
lpt.lhis.info@nhs.net

Service scope

• Service constraints: Constraints will be agreed with the customer before SLA is agreed
• System requirements: Specific requirements are agreed with the customer

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Response times agreed by SLA. LHIS service desk operates 07:00 to 20:30 Monday to Friday and 08.00 to 13.00 Saturday excluding weekends and UK Bank Holidays. A 24 hour out of hour’s service is available for an additional surcharge. We also provide out-of-hours IT and Senior Management cover where there is a priority 1, urgent loss of service which has a direct impact on patient care and where there is no alternative.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Typically an SLA is drawn up detailing availability, resilience, redundancy and support arrangements and this is then managed during the lifetime of the system.; ; See below for standard response times within LHIS (which may differ if required). When calls are logged with our service desk we grade them with severities depending on the nature of the issue. The service desk operates according to ITIL change management procedures. Each severity has a standard response time as shown below. These standards are negotiable if required to meet customer needs, however customers should note this may have an impact on the service price. ; ; Response Times; Severity Standard Response Times; 1 8 Working Hours; 2 16 Working Hours; 3 24 Working Hours; 4 40 Working Hours; 5 10 Working Days; 6 5 Working Days; 7 5 Working Days; 8 20 Working Days (from receipt into installation); ; LHIS uses back office support and system functions from with the UK.; ; Service Levels are typically based on availability with varying options available from 99% to 99.9%.; ; Standard service hours for the reporting of incidents are 08:00 to 17:00 Monday to Friday excluding UK public holidays. ; ; However 24 hour phone support can be provided at an extra cost.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: On boarding can cater for varying implementations including:; • Deploying new server instances; • Integration and deployment of physical legacy servers to the LHIS IaaS; • The migration of existing server instances to the LHIS IaaS; • Configuration of network, security and application configuration.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Off boarding from the LHIS IaaS service comprises of the complete removal of the managed infrastructure.; ; If the provision of one or more server instance configuration(s) or extractions of relevant data is required by the customer then this will incur a service fee based on the agreed process.
• End-of-contract process: Following completion of any transfer and where agreed with the customer LHIS will delete all live server instances, data and backup copies of elements of the service using CESG approved procedures.

Using the service

• Web browser interface: No
• API: No
• Command line interface: No

Scaling

• Scaling available: Yes
• Scaling type: Manual
• Independence of resources: Dedicated infrastructure resource with agreement with the customer via SLA
• Usage notifications: Yes
• Usage reporting: Email

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
  • Other
• Other metrics: Other relevant metrics as agreed with the customer
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Other
• Other data at rest protection approach: ISO 27001
• Data sanitisation process: Yes
• Data sanitisation type: Hardware containing data is completely destroyed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: Yes
• What’s backed up:
  • Full backup and restore subject to customer specification
  • Hot standby through to grandfather, father, son
• Backup controls: Backup agreed in consultation with the customer to provide the most resilient service
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Supplier controls the whole backup schedule
• Backup recovery: Users contact the support team

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: SLAs are agreed on a customer to customer basis as they are bespoke to the contract.
• Approach to resilience: Available on request
• Outage reporting: Send email alerts and a customer facing dashboard

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: User access controls are assigned according to the requirements of the user and organisation
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
• Devices users manage the service through:
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device on a government network (for example PSN)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: May 2016
• What the ISO/IEC 27001 doesn’t cover: Current coverage is management of email.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • Certified Security Testing Professional
  • Metasploit Pro Certified Specialist (MPCS)
  • Rapid 7 Nexpose Certified Specialist
  • ISEB Information Security Management: Distinction
  • Certified Forensic Investigation Analyst: Distinction
  • EC-Council Computer Hacking Forensic Investigator
  • ISO 27001 Email System Management
  • Certified Information Systems Auditor
  • Microsoft Certified – System Engineer
  • Cisco Certified Wireless Network Associate (CCNA)

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Tigerscheme
• Information security policies and processes: Public Sector and NHS standards for Information Security. ISO 27000 accredited.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: LHIS operates according to ITIL change management procedures
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We operate a security and vulnerability service which is run on a routine and cyclical basis this uses industry standard tools such as Nessus. We are also part of the CareCert alerting system.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We have a formalised incident response methodology which is designed to address issues and threats as they are identified.; ; These incidents are addressed with defined timescales, depending on their severity.
• Incident management type: Supplier-defined controls
• Incident management approach: Incident response processes are defined through NHS security and governance standards. These are delivered through local policy provisions.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: VMware
• How shared infrastructure is kept separate: As specified above we use VMware and Hyper-V technologies

Energy efficiency

• Energy-efficient datacentres: No

Social Value

• Covid-19 recovery:

  Covid-19 recovery

  LHIS were critical to the initial response to lockdown one. We supported several thousand NHS staff in LLR working from home and once the vaccination programme started we were also absolutely key to the establish of the IT Infrastructure for all the Vaccination Centres required in LLR. LHIS were nominated and won the LLR Award for COVID Hero’s for all the work we had done in response to COVID. I attach the nomination below. "We would like to nominate the team at Leicestershire Health Informatics for their outstanding work to keep us all IT operational during this challenging time. Without their continued dedication, as a system across Community, CCGs and Primary care we would not have been able to support remote working to keep our teams and our patients safe. In Particular we would like to highlight the efforts of Ian Wakeford, Tirath Singh, Chris Elliott and Jaz Dhinsa for all of their hard work and dedication in supporting the development and go live of our Covid vaccination sites. These individuals have been fundamental in the set up of our PCN hubs and have dealt with the daily challenge of the national directive changing ensuring they revisit our plans and adapt to ensure we can still deliver. They have achieved this through their own strong team working and working closely with our clinical and managerial teams and as we deployed our PCN teams. They have each taken clear ownership and responsibility over the IT delivery requirements. They have all gone above and beyond during this time helping to support the IT infrastructure on the ground where our teams are now delivering the vaccine. Every vaccine delivered is a life saved and the team at LHIS have played a huge part in helping us to achieve this delivery."

Pricing

• Price: £450 a unit a day
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at lpt.lhis.info@nhs.net. Tell them what format you need. It will help if you say what assistive technology you use.