From: NHSX
Assessment date: 30 September 2021
Stage: Alpha
Result: Conditional met
Service provider: NHSBSA
Condition of meeting the standard: The assessment is met on the condition that a service designer joins the team as quickly as possible.
Service description
The NHS Bursary service provides primary funding to trainee doctors and dentists enrolled on eligible programmes in England, Scotland, Wales, or Northern Ireland.
Medical and dental students can apply for an NHS bursary in the later years of their course. If they are studying a:
- five or six-year undergraduate course - they can apply from their fifth year of study
- three or four-year graduate entry course – they can apply from their second year of study
Students currently use the end-of-life Bursary Online Support System (BOSS). However, from March 2022 they will apply using the new solution.
Service users
This service is for:
- Primary users:
- Students - 12,000 NHS Bursary students per year
- HEI/ University staff - 1,100 HEI users per year
- Secondary users:
- Members of a student’s household (parents, partners)
- Third party providers (childcare providers, disability support)
- Internal users
- NHSBSA data processors
- NHSBSA Finance (Integra)
- Work Force Management (WFM)
- NHSBSA Contact centre staff
- Other NHSBSA IT Departments
Report contents
- Understand users and their needs
- Solve a whole problem for users
- Provide a joined-up experience across all channels
- Make the service simple to use
- Make sure everyone can use the service
- Have a multidisciplinary team
- Use agile ways of working
- Iterate and improve frequently
- Create a secure service which protects users’ privacy
- Define what success looks like and publish performance data
- Choose the right tools and technology
- Make new source code open
- Use and contribute to open standards, common components and patterns
- Operate a reliable service
1. Understand users and their needs
Decision
The service met point 1 of the Standard.
What the team has done well
The panel was impressed that:
- by conducting a substantial amount of research using relevant and appropriate methods, the team showed deep knowledge of their users and the issues that users face in applying for the bursary
- the team have generated proto personas and persona filters or lenses to represent the full range of users of the service, highlighting: roles, pain points and digital proficiency
- the team developed a comprehensive list of user needs categorised as epic and primary needs, secondary needs and potential needs
- user research and testing is influencing iteration of the early designs (such as the example shown around user understanding of secondment status)
What the team needs to explore
Before their next assessment, the team needs to:
- develop a comprehensive plan to conduct more research and testing with the non-applicant user groups (for example HEI, NHSBSA, student supporters and third-party providers)
- conduct user research with the persona filter groups to ensure the service meets their needs (for example English as a Second Language (Alternative) user group)
- identify and test the parts of the service which have been influenced by the existing service NHS Learning Support Fund
2. Solve a whole problem for users
Decision
The service met point 2 of the Standard.
What the team has done well
The panel was impressed that:
- the team carefully considered and documented their riskiest assumptions, seeking to validate them by conducting user research
- the team have engaged with Student Finance England (SFE) to consider ways to inform users of the way their student finance transitions from SFE to the NHS bursary service
What the team needs to explore
Before their next assessment, the team needs to:
- use service blueprints to map out the end-to-end service “front to back” to ensure the service backstage meets the needs of operational users (HEI, NHSBSA)
- consider and act on the feedback from the NHS Learning Support Fund beta workshop - particularly where components from that service have been reused for this work
- use dedicated Service Design and Interaction Design roles to help to empower the team to challenge policy / incoming requirements to help build a stronger overall service for end users
3. Provide a joined-up experience across all channels
Decision
The service met point 3 of the Standard.
What the team has done well
The panel was impressed that:
- the team have a good understanding of the end-to-end student journey, using customer journey mapping to highlight where the service intersects with the user
- the team has made it easy to find contact details if the user needs any additional support when using the service
What the team needs to explore
Before their next assessment, the team needs to:
- bring in a dedicated Service Designer to:
- centralise and expand on the pockets of journey mapping and blueprinting work individuals in the team have already undertaken
- help the team map user entrance points, dropout points and support needs.
- inform any future aspirations from the programme to combine multiple systems into a single ecosystem
- demonstrate an understanding of how the service interacts with NHSBSA operational staff and HEI staff and design the backstage journeys for those who are integral to the administration of the service
4. Make the service simple to use
Decision
The service met point 4 of the Standard.
What the team has done well
The panel was impressed that:
- the front end development team have good working knowledge of accessibility standards and are actively working with with the NHS Digital design toolkit
- the team’s user researcher has produced strong user mapping and personas to inform the design work
- the team have produced several documents and boards mapping the services wider context, entrance and exit points
What the team needs to explore
Before their next assessment, the team needs to:
- bring in a senior level Interaction Designer as soon as possible to:
- work closely with the front end developers to produce a user journey interaction map that visualises all use cases, scenarios and user pathways
- help the team design from this big picture view down to the user interface modules
5. Make sure everyone can use the service
Decision
The service met point 5 of the Standard.
What the team has done well
The panel was impressed that:
- the team had comprehensive user personas work to draw upon developed by the user researcher
- the front end development team have good working knowledge of accessibility standards and are actively working with with the NHS Digital design toolkit
What the team needs to explore
Before their next assessment, the team needs to:
- implement a strong user feedback loop and iteration cycle into the delivery process.
- prototype and usability test content and design work before it’s passed forwards into the main build
6. Have a multidisciplinary team
Decision
The service met point 6 of the Standard.
What the team has done well
The panel was impressed that:
- there is a hybrid multidisciplinary team in place, including embedded policy expertise
- all team members have been involved in user research sessions
- the team works collaboratively and openly - they gave a good example about resolving the choice between two different processes by utilising user testing
What the team needs to explore
Before their next assessment, the team needs to:
- recruit a senior interaction designer as soon as possible (see recommendations in section 2 and 4 for more context)
- recruit a Service Designer as soon as possible (see recommendations in section 2 and 3 for more context)
- consider whether the team has enough Content Design coverage and work with the NHSBSA’s content practice lead to carry out a review
7. Use agile ways of working
Decision
The service met point 7 of the Standard.
What the team has done well
The panel was impressed that:
- the team are developing this service using agile methodologies and have appropriate agile ceremonies in place, including retrospectives, to maintain project momentum and learn and develop as a team
- the team presents some show and tells to stakeholders and the wider organisation, and has a good relationship with the comms team to ensure information about the work being done can be shared across appropriate channels
- there is a project board in place meaning issues can be escalated quickly to the SRO and other senior management
What the team needs to explore
Before their next assessment, the team needs to:
- embed regular show and tells - ideally every 2 weeks - and ensure the SRO attends
- continue to use agile ways of working
8. Iterate and improve frequently
Decision
The service met point 8 of the Standard.
What the team has done well
The panel was impressed that:
- the team has carried out a large amount of user interviews and user testing and have changed and iterated the service based on this research
- the service has Google Analytics win place which the team will monitor and use to influence future iterations
What the team needs to explore
Before their next assessment, the team needs to:
- continue to research and test with users to define future iterations
9. Create a secure service which protects users’ privacy
Decision
The service met point 9 of the Standard.
What the team has done well
The panel was impressed that:
- the team is following the least privilege principle, so that users can only access data relevant to performing their role, ensuring the service is fully audited.
- user’s login information (username and password) are encrypted in the database.
- the team has ensured no real data can be accessed outside the production environment.
- files both at rest in the database and in transit to the payment platform Integra are encrypted.
- customer reports sent to DHSC are sent by DHSC secure exchange server.
What the team needs to explore
Before their next assessment, the team needs to:
- explore how flexible and future proof their preferred id solution is. They must explore what other options are available within the NHS (NHS Login, OpenID connect), work with their digital identity team and see whether it would offer a more robust solution as the service evolves, in particular providing a single sign-on service for all bursary services.
- multi factor authentication (MFA) should be implemented to strengthen the user access experience.
- complete their Data Protection Impact Assessment and ensure resources are available to act upon its recommendations.
- continue the work started in Alpha evaluating potential threats, fraud vectors and risks to the service and testing those, and their mitigation plans, in Beta
10. Define what success looks like and publish performance data
Decision
The service met point 10 of the Standard.
What the team has done well
The panel was impressed that:
- the team have existing KPIs in place based on experience of the current system
- there is an admin screen that displays pre-defined metrics reports
- the team created a dashboard to be used jointly with DHSC with relevant service information (insights, student movements, and so on). This dashboard is no longer in use
What the team needs to explore
Before their next assessment, the team needs to:
- be aware of the four mandatory KPIs and make sure they are collecting the data to measure these
- make sure they are sharing relevant performance data with stakeholders and the best way to do so (API for example)
- re-engage with DHSC exploring how the dashboard could be reused and improved
- re-evaluate current KPIs in use in the existing service and explore whether they are still relevant and whether new ones should be introduced to better reflect what the new service can achieve
11. Choose the right tools and technology
Decision
The service met point 11 of the Standard.
What the team has done well
The panel was impressed that:
- the service architecture is modular and scalable using Postgres and AWS
- team is using various tools such as Eclipse, Git, CI, Jenkins tools, BrowserStack tool, JMeter tool, Wave Tool
- team is using Jira and Confluence for the collaboration
- automated testing and deployment is achieved
What the team needs to explore
Before their next assessment, the team needs to:
- DHSC communication to be established to explore which options could be developed or improved to send data
- test how often data replication is needed and what impact it will have on the service availability and performance. Test restoring data from those backups.
- define and test an offline plan
- define and test a disaster recovery plan and build redundancy into their deployments, including restoring data from the backups
- explore the need for any potential API to share relevant information with stakeholders
- ensure relevant documentation is accessible and up-to-date
12. Make new source code open
Decision
The service did not meet point 12 of the Standard.
What the team needs to explore
Before their next assessment, the team needs to:
- team must define a strategy to make source code open in a public repository
13. Use and contribute to open standards, common components and patterns
Decision
The service met point 13 of the Standard.
What the team has done well
The panel was impressed that:
- the team is adhering to the common design patterns of NHS
- the team is sharing the same tech stack with the NHS Learning Support Fund
- the team is using common government products such as GOV.UK Notify
What the team needs to explore
Before their next assessment, the team needs to:
- explore whether any architecture components might potentially be reused from other government services to avoid duplication
- ensure the development team has the right expertise with the technology choices made in Alpha and those to be made in Beta so the service can be fully supported and improved
- consider making contributions to relevant libraries/frameworks if possible
14. Operate a reliable service
Decision
The service met point 14 of the Standard.
What the team has done well
The panel was impressed that:
- the team are monitoring service performance using Google Analytics
- the team has worked on how to make deployment secure and what mitigations might be needed
What the team needs to explore
Before their next assessment, the team needs to:
- use the performance data from the legacy service to agree performance and KPIs for the new service. The utilisation of benchmarking for the legacy system will enable the team to demonstrate the reliability and increased performance of the new service
- the team needs to ensure there is appropriate benchmarking in place based on the performance of the current service
- formalise a plan for monitoring and alerting that will be shared with and approved by the wider NHS relevant technical support teams and agree SLAs to operate the service in a sustainable way
- regular penetration and load testing should be anticipated to check how secure the system is and how well it can cope with demand
- carry out quality assurance testing as part of the ongoing service development.
- develop a plan describing how the service will be supported. This would include understanding how the service will be supported in and out of regular hours and fielding queries
- the team should consider what would happen if the service goes down out of hours and how to mitigate the resulting issues to support users