Home Integrated Identity Management FAQs

FAQs

Integrated Identity FAQs

ESR
ESR Interface
ESR Interface / User Identity Manager (UIM)
HR/RA Integration
Identity Management
Implementation  
NHS Care Records Service (CRS)
Position Based Access Control (PBAC)
Process
User Identity Manager (UIM)

ESR        

What would be the impact of ESR downtime on the interface operation?
No transactions can take place whilst ESR is down.

Will ESR workstructures need to be revised as a result of mapping and linking to access control positions in UIM?
A review of workstructures in ESR should be conducted as part of the mapping exercise to access control positions. This may inform changes to workstructures to correct information such as the job title which is free form text and may be inconsistent. Equally positions in ESR may need to be consolidated where there is replication or split if they define more than one role each of which require different levels of access. Further recommendations are given in Appendix 1 of the PBAC toolkit.

How can you determine the roles associated to an access control position from within ESR?
Roles are attached to the access control positions in UIM and are not visible in ESR. The key points are:
a) that access control positions have a logical name so that when a user in can clearly understand which to link to an ESR position based on:
b) an agreed mapping of the relationship between the 2 types of position.

Will there only be one data matching report between ESR and the Spine for loading data prior to implementation of the ESR interface?
One data match / cleanse cycle is the norm; however for a large number of records the cycle can be repeated a number of times by agreement between the NHS organisation and the ESR data team.

What is the date for switching off ‘traditional’ ESR access? (ie username and password)
This is likely to occur during October 2009. The exact date will be communicated to ESR Executive Sponsors when it is known.

How do we keep the ESR to UIM position mapping up to date?
Once the initial definition, mapping and linking of positions is completed during implementation, maintenance procedures will need to be established such that when new positions are required in either system a mapping is agreed to an equivalent in the other system. Where no equivalent exists then it will also need to be defined and set up.

Is the linking of an ESR position to an access control position a manual process?
Yes. Guidance is given in Appendix 1 of the PBAC toolkit. Mapping should be done once access control positions have been defined using the PBAC methodology. The ESR organisation position profile report can be used to map the one set of positions to the other. Once this has been agreed and signed off, positions can be linked from the positions editor in ESR workstructures.

Can you import position mappings?
No. Positions need to be linked one at a time in ESR. This allows for the organisation to manage a staged rollout across the organisation and to ensure that adequate checks are put in place as each position is linked to ensure that the correct access rights are granted to employees assigned to those positions.

Can volunteers be handled in ESR?
Yes. Volunteers need to be set up as 'employee' in ESR with a type of 'Honorary Contract' this will ensure that they do not get paid but because they have an employee record then can be linked to NHS CRS.

How are ESR access levels defined?
Access to NHS CRS applications is controlled via the definition of roles to access control position in UIM. If the ESR interface is in use then the assignment of an employee to an ESR position which is linked to an access control position in UIM will automatically ensure that the correct access is granted. Therefore access roles are not directly defined in ESR but are inherited by virtue of the job that an employee does.

When do we need to start thinking about data cleansing of ESR positions?
This should be done as part of the PBAC work in your organisation and can be started now in line with the recommendations in the PBAC toolkit.

Does ESR automatically grant access rights for existing NHS CRS users?
No. Access rights are defined by the access control position in UIM and cannot be granted in ESR as such. When an employee is linked in ESR to a Spine directory entry in NHS CRS and they are also assigned to an ESR position which is linked to an access control position then ESR is deemed to have control of the organisation person record in UIM. If the employee's assignment in ESR is changed to a different ESR position linked to different access control position then the access rights will be changed accordingly.

Will there be more work required in future in order to define an ESR position?
If the ESR interface is in operation when new ESR positions are defined there should be a procedure in place that considers whether that new position will require employees in that position to have access to NHS CRS applications. If this is the case then either an existing access control position should be mapped to the new ESR position or else a new access control position should be defined. The converse will also be true when new access control positions are defined.

Can terminations be undone?
Yes. If the termination date has already passed and access rights in UIM revoked and assuming that the employee was linked to the Spine (organisation person record closed) then identity checks will need to be redone and a lookup on the Spine made from ESR to the closed record. A request is then made for it to be reopened. When the record is reopened it can then be linked again to the ESR employee record.

Who will be the sponsor in ESR, how are they set up, and will this be recorded and auditable?
Firstly you need to decide who the sponsor will be for each staff group / department etc. In ESR employees can be defined with a new role type of 'RA Sponsor'. Then in workstructures it will be possible to select against the appropriate organisation unit from the list of employees defined as 'RA Sponsors'. Tagging an organisation unit like this means that all organisation units and positions below this automatically inherit that employee as sponsor. When the interface operates for any relevant changes the name of the sponsor is sent to UIM and recorded in the auditable record. Sponsors in ESR need to be CRS sponsors (eg, e-GIF level 3), Smartcard and one of the sponsor activities

Will existing SUD entries be matched to ESR entries automatically?
In order to load large numbers of matching entries from the SUD to ESR as part of the ESR interface implementation it will be necessary to take an extract from each system, match on name and NI number and produce a cleanse / match report. Once corrections have been made all matching entries will be loaded into ESR. This means that the UUID from the SUD will be loaded in to ESR and the e-GIF flag set to appropriate level automatically. This process is detailed in the M-3980 document available from the ESR website and KBase.

How are Inter-Authority Transfers handled?
The IAT process in ESR operates prior to an applicant being hired. When the portable data set is received from the old trust into the new trust they then are hired, will have their id checks completed and will at that point, assuming that the interface is in operation, be linked to the SUD. It is expected that a closed record in the SUD will be found if they had access to NHS CRS in the previous trust. A request will be made to open the record at which point the link to ESR can be made.

ESR Interface                                                                                                                 back to top

Bank system interfaces to ESR - could these be used as a back door to NHS CRS to allow access to be granted?
No. Bank interfaces in common with others import data that affect pay (e.g. hours worked and if overtime, bank holiday etc). The key to access control rights updates is the position link between ESR and UIM; a bank interface does not touch workstructures

Who will be the ESR interface pilots?
Heatherwood and Wrexham Park Hospitals NHS Trust (first of type), Northampton General Hospital NHS Trust, NHS Isle of Wight, NHS Gloucestershire, NHS Camden, West Midlands Ambulance Trust, West Suffolk Hospital NHS Trust, North Tees PCTs, Newham University Hospital NHS Trust, Frimley Park Hospital NHS Foundation Trust, Salford Royal NHS Foundation Trust, Oxfordshire Learning Disability NHS Trust.

How will the solution manage those individuals with more than one ESR position (multi post holders)?
In UIM a person may have an association to more than one access control position to cope with the same individual doing different jobs where each has different systems access requirements; just as in ESR where a person may have assignments to more than one position because they do different jobs. The ESR interface will allow each position in ESR to be able to be linked to the equivalent access control position in UIM.

Which ESR users will be able to update employee records with the UUID?
HR data entry (with RA) and HR Administration (with RA) and RA only are the only URPs which will be able to manage the UUID in ESR. Prior to the deployment of the ESR interface this can be done manually, thereafter it will be via the interface processes between ESR and UIM which enable search and select actions against NHS CRS. Selection of a matching record will pull in the UUID from the Spine User Directory and store it against the ESR employee record.

How often will the interface operate between ESR and UIM?
The interface operates in 'real time' and activity is triggered based on input within ESR.

Are there any performance implications on ESR operation?
McKesson have done a 'proof of concept study' and agreed upgrades to both hardware and network which are now in place to support the solution with no difference in performance.

If a secondary assignment in ESR is changed to become the primary assignment what happens relating to access rights via the position?
There is no change to the user’s access rights, simply an ESR assignment change.

The new assignment status of 'inactive - not worked' - would this status not be required in conjunction with other existing statuses e.g. maternity leave and other types for long term absence and would a flag therefore not be better?
Inactive - not worked' is a new assignment status designed for use for Bank staff who work on an intermittent basis. It can also be used for those on long term absence. Other Assignment statuses of 'Maternity Leave', 'Career Break', 'Suspend' will change the access rights of the employees associated to an NHS CRS position and remove the access rights until the assignment status is set to Active again.  There is no need to link the "Inactive - Not Worked" to these assignment statuses.

Once the ESR interface to UIM has been turned on can it be turned off again?
This process is not recommended as there maybe complications with outstanding records which are being processed and the possibility of errors with access rights.

Do we need to map every ESR position to UIM?
Only those positions with access rights

Why is Spine data being loaded onto ESR and not just linked to ESR?
For those organisations with large employed user bases of NHS CRS compliant applications a data match / cleanse / load facility is being offered by the NHS ESR data team to ensure speed accuracy and data quality during initial implementation. For those organisations with few or no matching employee records between the Spine and ESR no data load is required. In these cases once the interface is activated individual look up / links can be performed on an as need basis.

As employees are added often to ESR how quickly is the interface updated?
This information is updated in real time. This is particularly important for matters such as changing details or access rights.

If a person is on ESR as an employee for the purposes of being paid (primary organisation) but mainly does work in another trust (secondary organisation) how will this scenario be catered for by the interface?
If the NHS CRS access (access to clinical systems) for the employee relate to another NHS Organisation (ESR VPD) than the one they are paid at and this Organisation are using the ESR/UIM interface, then they will need an employee record (possibly as an honorary contract if they are not paid by that Organisation) in the other VPD as well. This record must then be assigned to an ESR position which is linked to an access control position in UIM – thus enabling access to the appropriate clinical systems.

If the employee also requires access to ESR in the secondary Organisation then at present they should use alternative person types than Honorary.  This is to ensure that the employee record can be linked to the ESR user record (currently Honorary records are not available to be selected in the Person list to associate to an ESR user).

How is the name of the Sponsor in ESR linked to the SUD record?
The RA sponsor(s) will be defined as a new role on the relevant employee records in ESR where the interface is in operation. These records will be linked to the SUD by means of the UUID in the same way as for every other matching record.

How does a sponsor approve access when the ESR interface is in place if the assignment of an employee to an ESR position which is linked to an access control position automatically grants access?
The way that sponsors approve is changing. Traditionally sponsors approved every access role per person - this no longer needs to be case with the introduction of PBAC, UIM and the ESR interface. The key sponsor is that for the definition of each access control position which holds the roles that determine which access is granted. This sponsor will be at a senior level in organisation. The mapping and linking of ESR positions to access control positions also needs to be signed off at a senior level. Once this is done positions can be linked between the two systems. The sponsor (manager) of each employee needs to be defined within organisation units in ESR workstructures. When interface activities take place from ESR to UIM requiring a change of position and of access rights the name of sponsor stored in ESR is used to update UIM: but the access rights are granted automatically on the basis of the fact that the access position itself and the linking of it to ESR has already been approved.

If ESR positions are modelled around cost centres will this have to change in future to support the interface?
Regardless of whether ESR workstructures are based on an HR or Financial model a review of the set up should be conducted as part of the mapping exercise to access control positions. This may inform changes to workstructures to correct information such as the job title which is free form text and may be inconsistent. Equally positions in ESR may need to be consolidated where there is replication or split if they define more than one role each of which require different levels of access. Further recommendations are given in Appendix 1 of the PBAC toolkit

Who will be able to use the RA workbench?
The RA workbench in ESR will be accessible to 3 new URPs - HR Data Entry (with RA), HR Admin (with RA) and RA only. These URPs should be allocated to ESR users who are also RA agents.

Skills and competencies - if a trust changes to a new clinical system or an individual moves from one trust to another how can we ensure that they have the correct skills to operate the new system? Can access rights be with held until they are fully train?
As soon as a person is assigned to a position in ESR with a link to an NHS CRS access control position they inherit the access rights associated with that position assuming that they have had a NHS CRS Smartcard issued to them. Local organisations need to decide how they administer the process of granting new or changed access rights.

Is it envisaged that differences in competencies will be used to control access to NHS CRS compliant systems via association with positions?
No. Whilst competencies can and should be associated with positions in ESR to help manage the matching of skills to jobs these are not taken into account when defining access rights to systems via the association of ESR positions to access control positions.

What happens when a position is ended in ESR in relation to access rights via linked access control positions?
Within ESR Local Workstructures it is not possible to eliminate a position whilst it still has active assignments associated with it.  Therefore there is no impact on the interface as the employee assignments would have to have been previously been ended. Ending an assignment will result in the removal of access rights. The changing of the position hiring status to Eliminated is the way in which users should "end date" a position when it is no longer required.  Once this position is end dated no new employees can be assigned to the position.

If an employee is terminated and the rehired, either immediately (usually for pension requirements) in the same or following pay period how would this be managed in CRS?
As the e-GIF status has been reset on termination to No, the identity will need to be rechecked on their new appointment, this then will enable the employee to be re-searched on NHS CRS and for the association to the NHS CRS record to be completed.

What would be impact of NHS CRS downtime on ESR?
If the Spine Authentication Service is down then no one can log into an NHS CRS compliant application. Instances of this are very rare. There are no contingency plans centrally as the underlying reasons are local issues, rather than related to the Spine itself.

ESR Interface/User Identity Manager (UIM)                                                               back to top

What training will be provided for the new technical solutions for UIM and ESR interface?
For ESR: the user guide will be updated, elearning (Captivate) will be provide, quick start guides developed and the standard McKesson training course for HR and student guides updated. The latter will be offered as part of the ongoing McKesson contract to supply training to ESR user (not via McKesson professional services at this time).  
For UIM: A training document will be provided.

HR/RA integration                                                                                                            back to top

Who has done HR/RA process integration?
The HR/RA business process integration toolkit provides details on this and is available from the NHS Connecting for Health website.  For full details contact Lynda Scott, Business Development Consultant at NHS Employers on 07789 653308 or Lynda.Scott@NHSemployers.org
http://nww.connectingforhealth.nhs.uk/implementation/registrationauthorities/governance/ra-guidance/hrra-business.pdf

 

Identity Management                                                                                                      back to top

What does e-GIF stand for?
e-GIF refers to the Electronic Government Interoperability Framework. The e-GIF defines the technical policies and specifications governing information flows across government and the public sector. They cover interconnectivity, data integration, e-services access and content management. Level 3 relates to level of security clearance agreed as required for access to patient care systems. All users requiring access to such systems must completed sufficient identity checks to meet this.

Is e-GIF level 3 the same clearance requirement for all employees irrespective of their role?
Yes, for the purposes of NHS employees if accessing NHS CRS.

How does Integrated Identity Management relate to the mandated NHS Employment Check Standards?
The identity checks required for HR, RA and access to NHS CRS (e-GIF level 3 compliance) are identical to those undertaken for the hiring of new employees. This follows the Employment Check Standards mandated to the NHS from April 2008 which will be monitored in the Annual Healthcheck.

How is access control enforced when someone transfers from one trust to another with different clinical systems?
In order to be granted access to any systems in a different organisational profile the SUD entry has to be associated with local access control positions. Whether or not the user is controlled by UIM or ESR in the original organisations the user can be managed in the second organisation by either UIM or ESR. If organisation is an organisation associated with the initial organisation (e.g. GP practice associated with PCT) then if controlled by ESR then the position will need to assigned through ESR

 
Implementation                                                                                                                 back to top

What can trusts do now, before technical solutions are available?
A number of actions can be undertaken by NHS organisations now:
1. HR / RA Process integration can be started or completed prior to technical solutions being available. Please contact your SHA RA lead and review the HR/RA toolkit for more information.
2. Other toolkits covering strategic decision making and PBAC are available. 3. The Integrated Identity Management  Implementation Approach Guide is available from www.esrsolution.co.uk/iim and should also be reviewed.4. NHS organisations can begin the data cleansing process now by running Active User reports in both CRS and ESR to close down old or duplicate records.  Identification of null NI numbers and their population in the NHS CRS is also an exercise that will help to reduce the cleansing effort required once their implementation cycle begins.5. NHS organisations need to ensure that they set up NHS net email accounts to send and receive data via a secure email channel.
6. Since April 2009, work has been underway on the move of ESR to NHS CRS Smartcard enablement. This work is scheduled to be completed by the end of August.http://nww.connectingforhealth.nhs.uk/implementation/registrationauthorities/governance/ra-guidance/hrra-business.pdf

Are special health authorities, ambulance services and SHAs part of the Integrated Identity Management project?
All NHS organisations in England should have an RA function in place. If they access any NHS CRS compliant applications be they clinical or not that are part of the NPfIT programme then yes they will be part of the project.

What are the implementation timescales?
These are yet to be determined for UIM and the ESR interface. The outcomes from the pilots will provide indicative timelines.  As far as HR/RA integration and PBAC are concerned timelines are included in the respective toolkits.

What are the implications for bank staff?
In order to manage access rights for bank staff they will need to be linked to one of a number of generic bank positions in ESR covering each different area of work. An equivalent generic bank access control position will need to be set up on UIM and the corresponding bank staff linked accordingly. A new generic bank access role has been added to the RBAC database for this purpose.

What RBAC code should be assigned to ESR users?
Where the ESR user no existing record in the SUD the R8008 admin/clerical support access role should be used as there are no baseline activities associated with this. Where there is an existing record there is no need to change or add to any existing roles.

Will the RA Sponsor field in ESR use the Supervisor hierarchy and if not what are the implications for more than one RA Sponsor per organisation or for individual exceptions?
No – the Supervisor hierarchy is separate. The RA sponsors are attached to organisational unit within Workstructures using a list of RA sponsors derived from those employees who have the role of 'RA Sponsor' defined.  Where you have a hierarchy of sponsors e.g. sponsor at department level, sponsor of sponsors at a division level and sponsorship rights approver at the top level of the organisation then you should map and set these up against the equivalent organisational units in the workstructures hierarchy.

Will there be a separate ESR URP for any of the RA set up maintenance / approval processes?
Yes. 3 new URPs will be available: 'HR Data Entry With RA'; 'HR Administration With RA' and 'RA only' will cover the new RA functionality within ESR. These should be allocated to ESR users who will also be RA agents. If these users are purely RA then the RA only URP will apply, otherwise if they are HR users who are also taking on an RA role then one of the 2 augmented HR URPs will apply.

What guidelines will be available for data cleansing and matching for the data load process into ESR?
A document has been produced 'M-3980 NHS CRS to ESR matching user guidance' - this contains data cleansing and matching guidance for both the ESR user data load and the ESR interface data load. A data cleansing report will be produced both prior to and following the data load for organisations to action.

When data is loaded into ESR from the SUD as part of the interface implementation are only e-GIF 3 level individuals loaded or will the 'pre-registered' group also be loaded?
All matching entries will come across regardless of the e-GIF status. The e-GIF status will be recorded in ESR. At this point users in ESR may make the necessary identity checks and put these onto the system to bring them up to e-GIF 3. Only e-GIF level 3 employees in ESR who are linked to a position which is in turn linked to an access control position will inherit any access rights.

When are NHS organisations expected to have finished the rollout of Integrated Identity Management?
There is no defined deadline although it is expected that most organisations will adopt PBAC and integrate HR and RA processes over the next six months and then look to adopt the technical solutions in the year following (i.e. by the end of 2010). Support from the ESR Registration Account Managers remains in place until April 2011. In order for organisations to take advantage of this support they are encouraged to adopt the ESR interface before this date. Rollout within individual organisations will depend on the selected implementation strategy

When carrying out employee record matching, will differences in upper/lower case type be checked?
Record matching takes place in two ways:
1. Using SUD look ups from within ESR when the interface is in operation. A 'fuzzy' search is used to find matching entries on name and NI number, case sensitivity is taken into account in the search. If a match is found but the small discrepancies in case or spelling the user should determine a course of action for correction of the data to the appropriate entry.
2. Using the data match / cleanse / load service offered by the ESR data team for matching records between ESR and the SUD prior to the implementation of the ESR interface again a 'fuzzy' match is adopted. Any discrepancies will be highlighted in the reports produced and cleansing will need to take place before the data load. This procedure is covered in the M-3908 data cleansing guidance document.

Are the data load slots to assist with implementation the same as the data load slots currently available until end of August?
No. It is expected that regular data load slots will be available following availability of the ESR interface in early 2010 for data load of UUIDs for matching SUD entries into ESR employee records. Exceptions to this are the pilots who will be able to load data before this time.

Is there any funding available to help NHS organisations to carry out implementation?
No. Any implementations need to factor in costs/resources needed to complete the piece of work. Benefits will be documented in advance of the pilot project and comparisons of actual benefits collated during the pilots. These will be communicated to all organisations to assist with business case justification for the project. Examples of benefits include: manpower savings involved in implementing HR, RA integrated processes, single sign-on, and with the introduction of the technical solutions, savings of time and removal of duplicate data entry.

What is the role of the ESR Registration Account Managers?
This new role will work in conjunction with the existing regional ESR Operations and Benefits Account Managers to provide specific support for ESR Registration implementation activities and the wider aims of the Integrated Identity Management Initiative.

Can you pre-register people at e-GIF level 0?
Yes but you need to verify their access level when they actually start. Should be e-GIF level 3 compliant.

Who is producing implementation guidance?
The central teams are producing the following guidance:
For Integrated Identity Management: An overall implementation approach guide to the whole of the initiative is being produce and will be available shortly.
For ESR: an implementation guide is being produced ready for the pilots who will trial the methodology. The guide and associated plans will be updated following the pilots to reflect lessons learned and then be issued to the wider NHS.
For UIM: NHS Connecting for Health Access Control Team will be producing an online implementation guide.

What support will be provided centrally to local teams?
Detailed advice and guidance in the form of implementation guides, sample project plans, user guides, elearning materials, lessons learned from pilot sites, a process pack etc will be provided for ESR users implementing the interface to UIM. Additionally support will be provided by the Registration Account Manager in each SHA region and the wider ESR Operations and Benefits team.

NHS Care Records Service (CRS)                                                                              back to top

Move from IA10 to IA11 – why do it at all if IA12 is coming out soon?
IA11 provides sig enhanced functionality eg notification of certificate renewal

How will trusts resource deployment of IA11?
IA are released annually and should be part of IT plans.

Should volunteers and students be put on ESR if they need access to NHS CRS?
Many organisations already choose to put volunteers and student on ESR with an employee role type of 'Honorary Contract' so that they do not get paid. Once on ESR if there is a need for them to access NHS CRS applications they can be linked to SUD entries and their assigned positions in ESR linked to access control positions in UIM. It is not however necessary to do this as they could be managed entirely by UIM for access to NHS CRS if there is not deemed to be any need for them to be recorded in ESR for any other purpose.

How should RA agents deal with a staff member's record who leaves for another organisation where they also need access to NHS CRS applications?
Do an RA03 and close their record on the system. You could consider adding a question to the termination form which would find out their destination on leaving. The Smartcard may also be destroyed, but the RA03 closes their system access regardless so the card would not work anyway. A request to close the position associated with the org should be created and this can be actioned by the RA. If the position is managed by another position then the sponsor can also remove the position

How do you grant access to external auditors?
External auditors will need to login to ESR with a Smartcard. Usually they will be allocated an audit URP giving view only access to the data. They will need to be set up in ESR as if they were an external shared service user, a record on the SUD, a smartcard allocating and a link of the UUID between ESR and the SUD as for any other ESR user. If they only access the systems for specific periods of time then their profile in NHS CRS can be time limited or controlled via the ESR assignment status (can be set to ‘Active’ when they are auditing and  ‘Inactive not working’ at other times – the change of status temporarily removes or grants access).  Via UIM the external auditor would need to be registered and then issued with a Smartcard and appropriate position.

How can the RA role and processes be demonstrated to external auditors?
Digital signatures can be recalled if required, due to the lack of paperwork involved in the new system. These will be accepted by auditors.

Position Based Access Control (PBAC)                                                                     back to top

Is there any guidance on how to name positions?
Guidance will be available during pilot phase. However, ultimately it is up to individual organisations to agree their naming conventions. It is worth noting that PCTs are likely to have more complex naming needs than acute trusts. Also, displays in alphabetical order.

Are there examples of what the PBAC pilots have done?
Yes. Case studies are included in the PBAC toolkit.

How are PBAC roles allocated to ESR positions, and by whom?
This is covered in the PBAC Toolkit, Appendix 1

Can position mapping be carried out now?
Yes. Organisations can work through the PBAC methodology from now to define an agreed list of access control positions. The mapping of these to ESR positions can be done as per the suggestions in Appendix 1 of the PBAC toolkit in advance of the technical solutions becoming available. Your organisation would then be ready to start interface implementation when it is available early in 2010.

How do work groups relate to access control positions?
Positions can contain one or more workgroups.

Does PBAC allow for existence of a unique position e.g. Caldicott guardian?
Yes. Positions with only one member.

How do positions relate to RBAC?
Positions are a logical grouping of RBAC attributes.

Can positions be organised in hierarchies?
Yes, this is how they are managed. A position can manage the membership of one of more positions.

What is a typical ratio of access position to ESR position?
This will entirely depend on how your organisation defines access control positions and how workstructures in ESR are set up. Typically in ESR there will be 100's if not 1,000's of positions but it is expected that only a few 10's of access control positions will be needed.

If positions are assigned which allows a person to access / do / view a record (even though they shouldn't / haven't been trained to do so) how does this fit with the NHS CRS where only those who need access to a record will be able to do so?
If they don't need access then don't associate them with a position. If access is considered sensitive by the organisations then associate with a different position, all user based by professional and legal controls.

What were the main issues raised by IG when PBAC were being assigned?
None.

 
Process                                                                                                                           back to top

How are Sponsors decided?
Depends on individual organisations, they need to be appointed by the Executive Management Team.

How will the HR input downtime imposed by some payroll departments impact on access changes via the interface?
Organisations' payroll providers should not impose downtime periods as ESR supports transactional processing at all times up to the point that the payroll is processed. Legacy working practices should not continue in operation and this is covered by the RA5 process. If such practices do continue there will be a knock on effect to the timely granting and revocation of access rights where the interface from ESR to UIM is in use.

Payroll freezes go against best practice guidance from ESR, so this is a matter which needs to be discussed with individual organisations which have payroll freezes. Guidance is currently being written and there needs to be a case by case review.

Should the existing RA paperwork currently collected go to line managers to be added to personal files?
This is up to individual organisations and is not something this project can prescribe. Individual organisations must be sure that whatever actions they take with regard to existing paperwork will satisfy local information governance standards.

How long does the RA paperwork currently collected need to be kept, and why?
Paperwork should be kept until the staff member is 70, or until 6 years after retirement. This is in line with DH guidance.

Some organisations have undertaken a piece of work to introduce an electronic document management system to remove the need for keeping paperwork.

Is there an audit trail of roles and/or activities being added and/or deleted to a person’s record?
At the moment sponsor details are not recorded - but UIM will record this information. This demonstrates the value of keeping existing paperwork.

Why are special health authorities not included on the list of missing NIs?
Special Health Authorities are included in this list.

Is there a Standard Locum Card and process?
No, short term access processes are available.

Does all this bring an urgency to HR Transactions unlike currently?
Yes.

Is it possible to view other trusts’ positions, ie to share learning and/or good practice?
Yes, in ERS.

Will Calendra still operate?
Yes, until switched off. But you should not use Calendra once you start using UIM.

 

User Identity Manager (UIM)                                                                                         back to top

Are there any plans to send automated emails to users? For example telling users they have pending requests.
No. Users need to view worklists regularly. This was considered when building UIM but was not felt necessary.

Who will be UIM pilots?
NHS Hampshire, West Hertfordshire PCT and East and North Hertfordshire PCTs (first of type), NHS Surrey and NHS Hull.

Can you change the access rights for one person in UIM?
Yes via the allocation of the person to more than one access control position - but not at the individual level. Each person can be allocated to one or more access control positions. Each of these positions has associated access rights which will be inherited by the individuals linked to them. If there is a specific requirement for an individual to have access rights other than those granted by the position(s) they are linked to then a new position can be created which defines the extra access rights.

How does the photo ID appear in UIM, is it loaded into ESR?
You can load the photo at various stages (eg, at request, request creation, granting) but the photo is needed at the point of granting by RA Agent.  The photo is loaded and stored in UIM, not ESR, but is accessible in ESR on the person form.

Can you report on recording of ID documents for quality assurance purposes?
Yes - you can record information in UIM. An extension to ad hoc reporting will be requested as a new requirement for the 2009B release. Will also consider how information is recorded in ESR and transmitted to UIM in a new user or reopen request.

Can you reopen a person in UIM (not just an organisation person)?
Yes.

Can NI numbers be added to Duplicate Search results?
This will be requested as a new requirement.

Is there anything to help trusts clean up UIM prior to link to ESR? Also exception on NI numbers?
Provided missing NI number reports to the NHS, via SHAs, in early June

When is roll-out timetabled for UIM?
End of 2009 roll-out will begin.  Pilots will be testing the technical processes and functions, and will help to build up implementation guidance for wider roll-out.

There is no prescribed schedule; it is up to individual organisations as to when they roll-out, but some activities need to be completed before roll-out can begin.

Do organisations need to add UIM to every ESR user’s desktop?
No. UIM is web-based, so staff just need access to the internet and the UIM web address.

Is there a report you can run to tell you what a sponsor has approved?
Yes in ERS

Does UIM require Java and how do we handle different versions required for other systems?
No.

How is UIM to be deployed technically?
By URL, it is web based system

Will UIM work with IA10?
UIM will function with all IA versions but to fully leverage terms and conditions management NHS CRS users PC’s need to be upgraded to IA version 12 or later.

Can you use UIM without positions?
It is not recommended.

Who uploads photos into UIM?
RA Agents.

In relation to staff being suspended or on maternity leave are there any plans to link the person status field to talk to the UIM system so that the person’s record in UIM could be frozen?
This happens from ESR.

What is the role of sponsors?
Sponsors approve requests relating to the access of users to NHS CRS. In UIM there will be five functions a sponsor can carry out as follows (listed from top to bottom):
B0002 - Approve RA Requests (Sponsorship Rights: approves definition of positions)
B0272 - Approve RA Requests (Advanced: sponsor of sponsors)
B1300 - Approve RA Requests - This is the current NHS CRS Sponsor (e.g. manager to approve individual access for their staff)
B0267 - Approve RA Requests (Registration Only)
B0263 - Unlock Smartcard

Does self service imply additional training needed for remote users?
No

Is there any limit on the number of positions which can be defined?
No - this is a local decision. Any number of ESR positions can be set in workstructures and similarity for access control positions in UIM. It is expected that only a few 10s of access control positions will be needed but that each of these will be mapped to many ESR positions. Note however that only 1 access control position can be linked to an ESR position.

How do you find out who has what level of access?
You can find this out by running a positions report.

How do individual users get specific access rights (additional activities over and above allocated positions)? For example, admin person requiring clinical access to update notes on behalf of a doctor
The user will need a new position.

Can Terms & Conditions be updated locally?
When new Terms and Conditions are updated, local organisations can decide whether or not to apply locally. Additionally, information can be added.

Why don’t the national team mandate new terms and conditions and automatically prevent access if not accepted?
All current users will have signed up to Terms and Conditions RA01, there is a potential for clinical risk.

Is there a report to find out who has not accepted Terms and Conditions?
Yes, this is a new standard report.

Can positions be uploaded from the NRD?
Yes, as a request.

What control do users have over definition of positions?
Local governance regarding who gets access.

How do you issue restricted attributes via an ESR Position?
Once approved and granted in UIM - the movement of the position in ESR is possible

Do 'closed roles' appear on UIM as they currently do in ESR?
No. Positions need to be linked one at a time in ESR. This allows for the organisation to manage a staged rollout across the organisation and to ensure that adequate checks are put in place as each position is linked to ensure that the correct access rights are granted.

Must CRS users have a UIM position?
They should be associated with a UIM position to get appropriate access.

How do you grant access rights for a person working across multiple NHS organisations? (eg a community midwife working across five GP practices)
A position can include more than one organisational profile.

How do you grant or update access for someone returning to work, for example following 12 months maternity leave?
In UIM - re-open the person, if closed, and associate with the relevant position.

Could the same person raise request for access in ESR and grant access in UIM?
Yes. A user can raise a request in ESR and Grant in UIM. However the sponsor and the person granting the position must be different, for example if the sponsor allocated at the organisational workstructure level raises the request (and de facto approves it) they cannot Grant it.