Connecting your medical app or website to the NHS : The N3 Network

Many ideas for apps and websites we deal with are based around some interaction with the NHS but integrating with NHS services and facilities isn’t always straight forward. One of the barriers to entry is the NHS N3 network. N3 is the broadband network for the NHS which connects all NHS locations and over a million employees. It connects hospitals, GP surgeries, pharmacies and many other service providers to securely facilitate sharing of healthcare data including sensitive patient records.

If your app, website or service needs to interact with NHS data then you may well need to be connected to the N3 network. As specialist providers of health related apps and websites, Genetic Digital’s customers often fall in to this category with web services we develop (which are often the backend of an app) requiring access. However, just to muddy the waters somewhat, N3 connectivity isn’t always mandatory (which can be true for non Patient Identifiable Data only); some NHS trusts have a more relaxed approach than others depending on their internal IT policies and configuration.

So who needs an N3 connection? There are no hard and fast rules but, broadly speaking, if you want to exchange data with an NHS trust (or trusts), especially sensitive data such as patient records, then you’ll need to be on N3. Even if it’s not a requirement if you are offering an on-premise solution, it’s often a commercial advantage if you can offer it. Given two competing services, an NHS trust could well choose one that offers services via N3 over one that doesn’t.

One point worth noting is only traffic from England can flow over the N3 connection so you can’t manage the service from an Indian call centre for example or push or pull patient data from Scotland, Wales or any other country. Knowing where your data resides is vital in applying for your accreditation to connect to N3.

How do you go about connecting to the N3 network? It’s a multi-step process with the first being deciding who you will contact to request access. For this, there are two options, one is to deal with the HSCIC direct (the N3 service provider) and the other is to deal with an N3 commercial aggregator. Dealing direct the process tends to take longer and commercial aggregators are organisations who have been granted power by the HSCIC to vet, assess and grant end user access requests to N3. This latter route is often much quicker and enables you to work with experienced staff who can offer direct support to help complete the required documentation.

Once a request is made there are then two parts of a pre-assessment questionnaire that need completing:

  • The HIGCAP – an eight question form asking about the nature of the connection, name of the company making the request, contact details, ISO certification status etc.
  • You then need to get a sponsor to complete their portion of the form – a sponsor is a responsible individual within an NHS organisation who will vouch for your connection application, for example, a senior manager with knowledge of your project.

After the above two are completed they are assessed for pre-approval. Once pre-approved you move on to:

  • The LCA – Local Connection Architecture questionnaire – this is a comprehensive break down of why the N3 is required – what the connection is for, the type of data etc.

If using a commercial aggregator, a meeting or conference call is usually had to discuss the LCA and help complete it. Once completed to the satisfaction of the provider, N3 approval is granted and a connection is setup.

Once an N3 connection is setup, the end user (our client for example) is obliged to complete the IG Toolkit. This is a process similar to ISO27001 certification which ensures procedures and policies are in place to prevent misuse or negligence of the N3 connection and associated service. They have until the end of March to complete it, so, if access is granted on the 30th March they have 1 day to complete it, if access is granted on 1st April they have a full year. Yes, this is odd. Because of this, completion is not strictly enforced and can (and does) take longer to complete. However, ultimately it needs to be done annually.

What type of connection would I need? For our customers, the need is most often for hosting a server which can connect to N3. Commercial aggregators such as Redcentric own their own data centres with a direct connection to the N3 backbone.  Once approved, our clients can host their servers, either physical or virtual cloud based, in the data centre and their app or web visitor traffic flows in over the public internet and out over the N3. To ensure integrity of the N3 service, you are obliged to utilise a managed firewall that monitors and filters all traffic that crosses over the N3 boundary.

If your service is connected outside of a data centre, in a pharmacy for example, then, in addition to the N3 connection and firewall, you would need to purchase a broadband connection from the commercial aggregator at rates comparable to standard DSL providers.

What about the costs? There are no direct costs associated with obtaining an N3 connection but, like all network connections, there are ongoing costs for using it. There is a minimum 3 year contract and costs increase depending on the speed required. Connections are sold in increments of 1Mb/s which, despite sounding slow (a domestic high speed broadband connection is upwards of 50Mb/s), when dealing with low traffic levels and small packets of text data often used in apps, the basic 1Mb/s can sometimes suffice. Additionally, there are costs for the firewall, hosting in the data centre if necessary and costs for an external DSL connection if required. In all likelihood there would also be consultancy costs associated with completing the IG Toolkit.

In summary, there are commercial benefits to having an N3 connection available to your service and in many instances it will be a necessity. But it comes at a price, both financial and administrative so the decision to apply shouldn’t be taken lightly and should be based on your specific needs, requirements and business opportunities.

Thanks to Redcentric for their expert N3 knowledge that helped shape this article.