Access to Provide policies for external staff
Version: V1
Ratified by: Technology Programme Group
Date ratified: 25/11/2022
Job Title of author: Information Governance Manager
Reviewed by Committee or Expert Group Technology Programme Group Related procedural documents
Review date: 25/11/2025
It is the responsibility of users to ensure that you are using the most up to date document template – ie obtained via the intranet.
In developing/reviewing this procedure Provide Community has had regard to the principles of the NHS Constitution.
Version Control Sheet
1. Introduction
It is important that all staff employed by or working for the Provide Group have access to all policy documents that are necessaryfor their role. Access to policies is usually provided through the MyCompliance system for which access is automated through Active Directory (AD) accounts.
A limited number of staff, such as external contractors working for Provide may not be issued with AD accounts that enable access to Provide policies as they have no other requirement for access to Provide Group computers This SOP outlines the steps that can be taken to enable access to policy documents for such staff.
2. Responsibilities
Line managers are responsible for identifying who requires access to the policies (joiners/leavers) Line Managers are responsible for ensuring all such users have read and accepted all relevant policies
Service desk is responsible for collating the service manager requests and passing them onto the Information Governance (RA service desk queue) team to be actioned.
Information governance is responsible for setting up the non-AD account on MyCompliance and producing access reports.
3. Adding Email Based Users
Staff without AD accounts can gain access to MyCompliance using an email address and password. Where an NHSmail or other Provide Group corporate email account has been issued, this should be used, where no email account has been issued they can use a nonProvide email account For reasons of both security and functionality, they will be required to login each time to access the MyCompliance platform using their email address and password here MetaCompliance - MyCompliance Cloud
1. Manager must request the non-AD account user to have access to MyCompliance via the ServiceDesk Portal Mandatory details to be provided are: the requested user’s forename, surname, email address, job title, department (see appendix 1)
2. Access is setup using their email address supplied.
3. Non-AD user accesses MyCompliance via the internet using this website https://cloud.metacompliance.com/account/login (they need to login each time)
4. Manager to request via the service desk that the external staff account is ceased when staff leave (they may not appear on the ESR leavers lists)
5. Regular reports (quarterly) to be sent to managers showing access and the managers will need to confirm this is still required. Information Governance will run the quarterly reports.
Please note:
• The non-AD staff member will not be able to use MetaEngage (policies pop-ups on Provide laptop screens for staff to accept). The external staff will have access to all policies but will need to log in to access the system to read new policies.
• Managers will need to be responsible for ensuring all such users have read and accepted all relevant policies as this will not be monitored centrally.
• Managers will need to make external staff aware of the system and the users responsibility as part of local induction
• Managers will need to log calls each time any such staff leave as the external staff will not be on our ESR leavers lists
• Managers will need to periodically review a list of who has access to MyCompliance via email login and confirm it is still correct (this acts as a control for managers forgetting to inform of leavers)
Appendix 1 - How to Add Email-Based Users on MyCompliance
Navigate to User>User Management from the left-hand menu pane on Admin Home.
You will be presented with the Manage Users table.
On the left-hand side, you will see 2 options for user Creation: User (single) and Bulk Upload (multiple):
Creation: User (single)
Below are the mandatory details required for upload of an email-based user:
Forename
Surname
Role: Admin or User
User Type: EMAIL
Department
Create/add to subgroup(s): YES/NO
Custom Details (if applicable and Custom Attributes have been added)
Below are the optional details for upload of an email-based user:
Supervisor
Supervisors Manager
Group Name
Once all relevant details are filled in, click the green Create New User button, and the email-based user will be added to the platform. They will reside in the Manage Users table and will be added to a Group/Subgroup made up of the Department and GroupName field, if Create/add to subgroup(s) is selected as YES on the point of upload.
Bulk Upload (multiple):
Below are the mandatory details required for bulk upload of email-based users:
User Type: Email
Bulk Upload Type: New Users/Replace Existing User List
Create Add to Subgroup(s): YES/NO
Bulk Upload: UPLOAD SPREADSHEET
Spreadsheet Guidelines
Mandatory Fields in Excel/CSV:
Forename
Surname
Department
Optional Fields in Excel/CSV:
Supervisor
Supervisors Manager
Group Name
Group Guidelines
If you have enabled Create/Add Sub-group(s), your groups will be created based on the Department and GroupName values you provide in your spreadsheet. The Department value you use corresponds to Parent User Groups, and the GroupName value corresponds to Sub Groups.
A Parent User Group can either contain a flat list of users, or a list of Sub Groups that each contain users. A Parent Group cannot contain both users and Sub Groups at the same level, so it is important that you ensure your spreadsheet is set up correctly, otherwise users may not be added to groups based on the existing structure.