From: NHSX
Assessment date: 7 January 2021
Reassessment date: 7 May 2021
Stage: beta
Result: met when reassessed
Service provider: Human Tissue Authority (HTA)
Service description
The HTA website acts as a repository of information. The website is being redeveloped to:
- Improve the user experience for the HTA website’s key audiences
- Be fully compliant with WCAG 2.1 AA accessibility standards
- Update the website CMS from Drupal 7 to Drupal 9 as Drupal 7 is reaching its end of life
- Reconsider the wider infrastructure to take advantage of cloud hosting and associated benefits
- Major content review, such as guidance, is out of scope for this project, though some content changes are being made and there are post-live plans for wider guidance reviews
Service users
This service is for both the public and professionals (licensees) working at the establishments the HTA regulates.
Report contents
- Understand users and their needs
- Solve a whole problem for users
- Provide a joined-up experience across all channels
- Make the service simple to use
- Make sure everyone can use the service
- Have a multidisciplinary team
- Use agile ways of working
- Iterate and improve frequently
- Create a secure service which protects users’ privacy
- Define what success looks like and publish performance data
- Choose the right tools and technology
- Make new source code open
- Use and contribute to open standards, common components and patterns
- Operate a reliable service
1. Understand users and their needs
Decision
The service did not meet point 1 of the Standard.
What the team has done well
The panel was impressed that:
- the team was able to describe their main user groups and some of their needs and contexts
- the team could describe user needs from phone as well as online channels
What the team needs to explore
Before their next assessment, the team needs to:
- write up user needs in the format ‘As a … I need to … so that ...’ and use these to direct research and testing
- test and validate changes in one to one research with members of the public and professionals who haven’t previously used the old or new service
- carry out research and document findings in line with the service manual, using open questioning as well as pre-set user accessibility testing (UAT) tasks
- log any research gaps and have a high-level plan for research and testing in public beta
Reassessment
Decision
The service met point 1 of the Standard.
What the team has done well
The panel was impressed that:
- the team had conducted user research to validate the changes they had been making to the site, with members of the public and professionals who hadn’t previously used the site
- the team had appropriately set up their moderated usability testing sessions, using both open questioning and pre-set tasks
2. Solve a whole problem for users
Decision
The service did not meet point 2 of the Standard.
What the team has done well
The panel was impressed that:
- the team had run through various scenarios with professional users
- the team had a good understanding of existing professional users and what their needs are
What the team needs to explore
Before their next assessment, the team needs to:
- test and validate changes with members of the public and professionals who haven’t previously used the old or new service
Reassessment
Decision
The service met point 2 of the Standard.
What the team has done well
The panel was impressed that:
- the team had tested and validated changes in one-to-one interviews with members of the public and professionals who hadn’t previously used the old or new service
What the team needs to explore
Before their next assessment, the team needs to:
- test some final minor changes - this testing should be booked and carried out as soon as is feasible
3. Provide a joined-up experience across all channels
Decision
The service met point 3 of the Standard.
What the team has done well
The panel was impressed that:
- the team gave the whole organisation regular updates about the redevelopment of the website and different areas of the HTA were able to provide input and advice
- the team had a good relationship with the call centre and had used insight from calls to identify the content that was needed
What the team needs to explore
Before their next assessment, the team needs to:
- demonstrate how the user is redirected to a different organisation, for example MHRA or NHS Blood and Transplant, if their query is not within the remit of HTA
4. Make the service simple to use
Decision
The service did not meet point 4 of the Standard.
What the team has done well
The panel was impressed that:
- the team had substantially reduced the use of frequently asked questions (FAQs)
- the design had key needs and tasks expressed as verbs on the homepage
- the group of professional users who tested the site in beta were able to complete key tasks
What the team needs to explore
Before their next assessment, the team needs to:
- test rigorously, and validate secondary navigation journeys, for example via the footer
- test different versions of key components such as the search bar; consider using gov.uk patterns for key components such as the footer and search bar
- test and validate whether the use of imagery helps users achieve their tasks
- test end-end journeys, for example, starting from external search, gov.uk or other relevant sites
The team should also further reduce or remove FAQs and amalgamate these into core page content, but given the scope and constraints of the project this could happen after the public beta goes live
Reassessment
Decision
The service met point 4 of the Standard.
What the team has done well
The panel was impressed that:
- the team had conducted end to end usability testing of the secondary navigation journeys within the site, particularly those directed from the footer
- the team had tested different versions of design components, and iterated based on user feedback
5. Make sure everyone can use the service
Decision
The service did not meet point 5 of the Standard.
What the team has done well
The panel was impressed that:
- the team had understood the varying needs and context of licensees and older public users who are clearing up their personal affairs
- the team had done research on mobile devices as well as desktop
What the team needs to explore
Before their next assessment, the team needs to:
- carry out research with users with assisted digital and accessibility needs and act on its findings
- carry out the accessibility audit and act on its findings
- draft an accessibility statement and be ready to publish this in public beta
- continue to test and validate changes on a range of devices
Reassessment
Decision
The service met point 5 of the Standard.
What the team has done well
The panel was impressed that:
- the team had worked really hard on ensuring the new site is accessible, including arranging an external accessibility audit and carrying out user research with users with assisted digital and accessibility needs
- the team’s ethos in building the site had affected the whole organisational culture of how accessibility needs are met
- the team had tested across a range of devices to ensure the site can work on them.
What the team needs to explore
Before their next assessment, the team needs to:
- continue to work in a joined up way across the HTA to ensure accessibility needs are met
6. Have a multidisciplinary team
Decision
The service met point 6 of the Standard.
What the team has done well
The panel was impressed that:
- the team was small but had a diverse range of skills and expertise, dedicated and engaged people working hard to deliver this service, and there was strong senior stakeholder support
- the team had ensured that everyone was involved with the progress of the new site, as the HTA is a small organisation
- the team had made four permanent staff able to make content changes, without the need for developer time
What the team needs to explore
Before their next assessment, the team needs to:
- ensure that there is a core permanent team that retains the knowledge and skills about the service, as well as training and upskilling additional people from within the organisation
7. Use agile ways of working
Decision
The service met point 7 of the Standard.
What the team has done well
The panel was impressed that:
- the team worked in an agile way in 2 week sprints with the traditional ceremonies, including show and tells for internal and external stakeholders
- the team had tested the service with senior stakeholders
- the team had a committed senior responsible officer (SRO) in place who champions the project
What the team needs to explore
Before their next assessment, the team needs to:
- continue to work in an agile way
- continue to ensure there is ongoing senior engagement and support
8. Iterate and improve frequently
Decision
The service did not meet point 8 of the Standard.
What the team has done well
The panel was impressed that:
- the team had carried out a round of user testing with professional users in private beta
What the team needs to explore
Before their next assessment, the team needs to:
- carry out additional user testing with members of the public and professionals unfamiliar with the service
- make sure that the service support agreement with the supplier allows for further improvements to be made to the website once the service is in public beta
- look at content duplication on the front page and test whether it’s needed
Reassessment
Decision
The service met point 8 of the Standard.
What the team has done well
The panel was impressed that:
- the team had carried out additional rounds of user testing with members of the public and professional users, including testing the content duplication on the front page
- the team had service support in place so can continue to iterate the site once it is in public beta
What the team needs to explore
Before their next assessment, the team needs to:
- ensure that the feedback form is live before going into public beta so that they are able to capture qualitative feedback directly from users - this should be easily accessible across the site so that it is straightforward for users to raise any issues
- review user feedback regularly and act on it
- consider carrying out more rounds of user testing if making changes to the site
- meet with NHSX again for a peer review and to discuss any additional changes made to the site - around 3 months into private beta
9. Create a secure service which protects users’ privacy
Decision
The service did not meet point 9 of the Standard.
What the team has done well
The panel was impressed that:
- minimal data is captured to provide access to a newsletter which is opt in. The team had undergone an initial data protection impact assessment (DPIA). The outcome of this was that a full DPIA is not needed
- automated security testing was in place, these scans include OWASP’s top 10 web application security risks
- the website will be connected to NCSC ACD WebCheck
What the team needs to explore
Before their next assessment, the team needs to:
- undergo a penetration test from a third party and address any issues that arise
Reassessment
Decision
The service met point 9 of the Standard.
What the team has done well
The panel was impressed that:
- penetration test had been completed and all high and medium level issues had been resolved, automated testing was in place and an independent penetration test is planned before the next assessment
10. Define what success looks like and publish performance data
Decision
The service did not meet point 10 of the Standard.
What the team has done well
The panel was impressed that:
- there were Google Analytics funnels set up for key journeys
- the team had considered some key goals, for example reduction in calls about body donation
- there was benchmarking in place from the discovery based on user feedback
- there was a collated monthly report which shows the nature of enquiries to the HTA
What the team needs to explore
Before their next assessment, the team needs to:
- set up a framework to define what success looks like
- establish a way to measure user satisfaction during public beta
Reassessment
Decision
The service met point 10 of the Standard.
What the team has done well
The panel was impressed that:
- the team had established a way to measure user satisfaction during public beta
- the team had carried out a benchmarking exercise and had created a framework to define what success looks like
11. Choose the right tools and technology
Decision
The service met point 11 of the Standard.
What the team has done well
The panel was impressed that:
- the team was making use of open source tools where possible
- the team had chosen the right technology stack to meet user needs
- the team had set up automated deployments eliminating downtime
- the team was making good use of their cloud infrastructure, having established automated scaling and utilising appropriate security tools
What the team needs to explore
Before their next assessment, the team needs to:
- continue to evaluate if their chosen technology stack is the best solution
12. Make new source code open
Decision
The service did not meet point 12 of the Standard.
What the team has done well
The panel was impressed that:
- the team was making use of open source tools including Drupal CMS
- the team had created reusable components for HTA
What the team needs to explore
Before their next assessment, the team needs to:
- host the code for the website in a public repository
Reassessment
Decision
The service met point 12 of the Standard.
What the team has done well
The panel was impressed that:
- the source code is now hosted on a public repository https://github.com/Human-Tissue-Authority/HTA-Website
13. Use and contribute to open standards, common components and patterns
Decision
The service met point 13 of the Standard.
What the team has done well
The panel was impressed that:
- the team had made use of open source software where possible
What the team needs to explore
Before their next assessment, the team needs to:
- set out a timeline for migrating reports from PDF to HTML
14. Operate a reliable service
Decision
The service met point 14 of the Standard.
What the team has done well
The panel was impressed that:
- the team had established clear requirements for the availability of the site and established an appropriate level of resilience providing an uptime of 99.95% while being cost effective
- backups are stored offsite and by utilising infrastructure as code a new environment for the site can be created quickly