ITGUI01 Using Provide Technology Equipment Abroad by Provide Community

Using Provide Technology Equipment Abroad

Version: 2

Ratified by: Technology Programme Board

Date ratified: 26/10/2020

Job Title of author: Assistant Director – IT & Systems

Reviewed by Sub Group or Expert Group Technology Programme Board

1. Using Provide Technology Equipment Abroad

This document is designed to inform managers when they are considering if they should allow staff to use Provide Technology equipment abroad. The document is not intended to offer guidance about deciding if to accept a request to work abroad, this should be discussed with your HR Business Partner, and after consulting Provide policies including:

• HRPOL16 Flexible Working Policy

• HRPOL17 Special Leave Policy

• HRPOL24 Annual Leave Policy

• HRPOL26 Psychological Wellbeing of Staff Policy

• HRPOL31 Attendance Management Policy

This guidance should not be used to encourage, or facilitate, any employee to work while on holiday. Periods of annual leave should involve continuous rest and a break from work.

The following principles have been shared to all staff by HR and must be followed:

1) Staff will only be permitted to work remotely overseas or from a secondary location where: the nature of their work permits remote working; incurs no additional burden on the service or other team members; and is consistent with the standard of service delivery being maintained.

2) Staff will only be permitted to work remotely overseas or from a secondary location where the standard and reliability of an available internet/WIFI connection can be assured before the staff member proceeds and is of a comparable standard to that available in the UK. In practice this is likely to restrict working to those with access to private property with an internet connection (second homes/time shares etc). Being reliant on a service that is not assured will not be supported: for example, reliance on a hotel WIFI provision, a local internet café or rented accommodation will not be supported.

3) Staff proceeding overseas to work or from a secondary location will accept the risk of incurring additional expenses. For the avoidance of doubt, Provide CIC will not, under any circumstances, cover any additional travelling expenses incurred by virtue of working overseas or from a secondary location, whatever the cause. Staff should think carefully around how they would meet a requirement to attend Provide premises, e.g. in the event of IT equipment failure; the necessary redeployment of staff due to a change in the COVID-19 response affecting their service; or any other contingency that would necessitate a change in their circumstances. Staff working remotely will continue to be required to meet the needs of their service and it should not be assumed that a request to take annual leave will be approved simply in order to avoid incurring additional personal expenditure.

2. Scope

This document presumes that the request is for use within the European Union (EU). The guidance will likely be different for countries outside of the EU, especially when it comes to costs and in some countries the use of encryption (as used by Provide) is illegal and

can result in severe sanctions for individuals (including imprisonment in the foreign country).

All requests for use of devices outside of the EU will need to be assessed on an individual basis and should be made with a minimum of 30 days’ notice to provide.servicedesk@nhs.net

3. Considerations

Using devices abroad will mean a reduced level of support and greater risk so the first question should always be, is this a real requirement or is there an alternative? If there is a reasonable alternative, do not allow use of the equipment abroad.

4. Cost

This will need to be verified with the Provide Technology Team but a majority of Provide issued mobiles use the EE network and are on ‘Roam like at Home’ tariff which means usage in the EU comes out of Provide’s main allowance, so effectively it will be like the user is still in the UK. This is capped at 15GB per month for the combined total for all sharers, after which a surcharge of £7.20 per GB will be made for use within Provides shared pool of data, data outsideofProvide’sshareddatawillbe charged at approximately £36 per GB.

It is recommended that Wi-Fi is used for any prolonged periods of work. Streaming of music or video should be avoided whilst tethering.

The method of connection for laptops should be considered, if a user is working abroad for any extended period of time and is planning to connect by tethering to their mobile (as opposed to via a Wi-Fi connection), an individual data plan for their phone may be required as a high level of data may be used. The cost for individual data plans are charged to service budgets.

Calls from the mobile to other Provide EE mobiles and UK numbers will remain the same as if being in the UK, calls to the mobile from the UK will be charged as if they are an international call, this varies by country but as a guide:

Landlines: £1 minute

Mobiles: £1 minute SMS: 35p each

Note: Prices correct as of July 2020 but subject to change, please contact the Technology Department for latest pricing information.

5. Functionality

Provide systems, NHS Mail and national applications should continue to work from Provide devices. NHS Mail should also be available from most personal internet connected devices.

Electronic devices may need a travel plug adaptor, it is important to check that these will supply the correct voltage and frequency and that there is a good fit with all devices that

will be required to be plugged in, this varies in different countries. Having the wrong voltage may cause the device not to charge or could damage the device.

6. Smartcards

Smartcards will work abroad but support above and beyond adding or removing access rights will be limited. Users must register for the self-unlocking functionality as this can’t be done on their behalf remotely.

If a card becomes damaged or needs replacing for any reason, this will be sent to the sponsor for the service who will need to meet the user to activate the card. In reality, this will need the user to return to the UK.

7. Support

Support will continue to be available on a best endeavour’s basis, through the Technology Service Desk and subject to the connection strength and nature of the issue, the Service Desk should be able to connect to laptops remotely. However, where it is not possible to connect to a device and an engineer visit is required, this will only be available from Provide bases in the UK and may require the user to be present.

8. Patching & Security

Devices will continue to be patched each time they connect to the Provide network. However, there are occasions where patches need to be applied manually by an engineer and in such cases, the laptop will need to be made available at a Provide UK base for patching before it can continue to be used. Devices that are not able to be patched will be blocked from connecting to the Provide network, whilst this may cause great difficulties for staff working abroad, it is essential to maintain a secure network.

The line manager should check that the staff member has adequate insurance in place to cover the loss or damage of their equipment.

9. Access to Personal and Sensitive Information

This should be done only through approved secure email systems such as NHS Mail, Provide’s shared drives and systems only. Paper records should not beused abroad.

Some contracts may stipulate that data is not processed or transferred outside of the UK or Provide may have stated this in tender responses. It is the responsibility of the service manager to check if this is the case with their service and should not permit staff to use their laptop abroad if this is the case.

The service manager must ensure that any data transferred outside of the UK must be reflected in the services annual Information Flow Mapping exercise and reviewed on an annual basis, compliance with GDPR and the Data Protection Act 2018 and Department of Health guidelines must be maintained.

10. Workstation Environment

The service manager will need to assure themselves that there is adequate physical security in place and that the working environment is appropriate, equipment will need to be locked away when not in use. Risk assessments may need to be completed to ensure appropriate safeguards are in place.

11. Reporting

The Technology Service Desk should be informed when laptops or tablets are taken outside of the UK and within the EU, the following information should be informed to provide.servicedesk@nhs.net:

• Full name of the user

• Line manager

• Model and asset tag number of device(s)

• Location and country of work

• Dates outside of the UK

Provide issued laptops, tablets or mobiles must not be taken outside of the EU without written permission from the Assistant Director for IT & Systems or the IT Operations Manager.