From: NHSX
Assessment date: 11 June 2021
Reassessment date: 13 January 2022
Stage: Alpha
Result: met at reassessment
Service provider: NHSE/I
Service description
The FutureNHS platform enables its users to rapidly form and grow online communities to respond quickly to the changing health and care landscape. Most recently it has supported its members to collaborate at scale during the COVID-19 pandemic and the implementation of the Long-Term Plan.
Platform users can join or create workspaces and communities to connect with others, learn and share using the forum, file and page building features that are provided with each workspace.
The service team supports the platform users by providing training on how best to use the platform and a helpdesk to rapidly respond to user needs.
Service users
The service is for everyone working in the health and care community. Users are broken down by the following user profiles depending on why they use the platform. Users can however occupy multiple roles
- Workspace/Group Managers
- Owner
- Administrator
- Editor
- Promoter
- Team member
- Workspace/Group Members
- Consumer
- Contributor
- Advocator
Report contents
- Understand users and their needs
- Solve a whole problem for users
- Provide a joined-up experience across all channels
- Make the service simple to use
- Make sure everyone can use the service
- Have a multidisciplinary team
- Use agile ways of working
- Iterate and improve frequently
- Create a secure service which protects users’ privacy
- Define what success looks like and publish performance data
- Choose the right tools and technology
- Make new source code open
- Use and contribute to open standards, common components and patterns
- Operate a reliable service
1. Understand users and their needs
Decision
The service did not meet point 1 of the Standard.
Mitigating factors: it is the panel’s understanding that the discovery work conducted started during the pandemic and was very tactical. It largely focused on the existing service “superusers”, for example workspace managers of large national programmes. The discovery work leveraged subject matter expertise.
What the team has done well
The panel was impressed that:
- the alpha team dedicated a small amount of time and energy initially to do a mini-discovery. Alpha testing started to expand who the team tested with, for example 1-2 non-users. We would recommend that this continues and expands towards diversifying their participants and testers
What the team needs to explore
Before the reassessment, the team needs to:
- continue with the direction started in alpha and conduct more foundational user research to understand their current and future users
- think of user groups and various different categories to segment their user base, for example admin versus front line staff, desk based versus mobile, local versus national, large groups versus small groups. This will help map common and specific needs to each different group and prioritise certain testing, such as hypothesis and features, over others
- use categories of users to plan who to speak with and why, testing their riskiest hypothesis and assumptions with the right group of people building confidence in their features implementation. The team has focused most of their user research with their existing “superusers”, increasing the chances of confirming their biases and assumptions instead of challenging them
- identify and leverage alternative strategies to recruit participants, strengthening different voices from various edges of the NHS, for example underrepresented groups and minorities
- do more work in understanding the users and their needs. Map this against specific design decisions and prioritised features, making it more explicit how the solution meets the prioritised and selected user needs
Before their next assessment, the team needs to:
- write their needs without including solutions, focus on the underlying need so that features can be mapped and tested against how they meet those needs
- do more accessibility testing and also test specifically with seldom heard voices and groups of users that might be at risk of exclusion from the collaboration platform
- test their assumptions about barriers to entry for brand reasons with various user groups and evaluate the effort of diverging from the pattern against evidenced and quantified risks
Reassessment
Decision
The service met point 1 of the Standard.
What the team has done well
The panel was impressed that:
- the team has used quantitative and qualitative methods to carry out more primary research, which they have used to identify foundational needs and user segments based on needs and behaviours, rather than professional role
- the team has used a range of networks and surveys to search for users with self-identified accessibility and inclusion needs, and has plans to work with charities to find users with specific accessibility needs
- the team is sharing personas and typologies across NHSE/I so that common user needs can be identified, and is also sharing research on Github
What the team needs to explore
Before their next assessment, the team needs to:
- carry out research and testing on a mix of mobile and desktop devices
- carry out research and testing with people with accessibility needs and who use assistive technology. The current work with people who self-declare their access needs or digital literacy level is useful, but do not rely on this
- explore the needs of the content consumer persona in more depth
2. Solve a whole problem for users
Decision
The service did not meet point 2 of the Standard.
What the team has done well
The panel was impressed that:
- the service is designed to enable working across organisational boundaries
- the team is working in the open so that people outside the immediate team can see what is happening
What the team needs to explore
Before the reassessment, the team needs to:
- communicate more explicitly what is the main problem that the service will solve for users, evidenced by findings from the user research conducted
- be able to demonstrate, from user research and analytics, that they have scoped the service according to how users think
Reassessment
Decision
The service met point 2 of the Standard.
What the team has done well
The panel was impressed that:
- a high number of interviews have been undertaken to get a wide variety of views
- analytics have been used to inform decisions
- user goals and pain points have been considered
What the team needs to explore
Before their next assessment, the team needs to:
- decide explicitly the main problem that the new service will solve for users and test in beta. Base the beta research and testing plan around this proposition. Doing this will involve parking some needs or features but will result in more confidence in the core elements at the end of private beta
- ensure that the planned minimum viable product (MVP) addresses primary user needs and doesn’t try to go too far. A Phase 2 stage could then be considered to add on anything that users will need in the future
3. Provide a joined-up experience across all channels
Decision
The service met point 3 of the Standard.
What the team has done well
The panel was impressed that:
- the team is working with Microsoft to integrate better with office systems and are considering ways in which they can integrate other NHS systems, for example dashboards
- the team is drawing on insight from help desk support queries
What the team needs to explore
Before their next assessment, the team needs to:
- have a clear understanding of what users need by way of integration with other systems
4. Make the service simple to use
The service met point 4 of the Standard.
What the team has done well
The panel was impressed that:
- the team has identified and prototyped improvements to 2 areas of the platform: registration and discovering groups
- the team is considering how they might make the service easier to use and more accessible by cutting back on flexibility in customisable design
5. Make sure everyone can use the service
Decision
The service did not meet point 5 of the Standard.
What the team has done well
The panel was impressed that:
- the team is carrying out manual and automated accessibility testing and is aware of some accessibility issues, for example with JavaScript
- the team has plans to test with users with access needs
- the team is considering how to best market the service
What the team needs to explore
Before the reassessment, the team needs to:
- have a clearer understanding of which users risk being excluded and why, and how they can address their needs
Before their next assessment, the team needs to:
- test the service with people with access needs including people who use screen readers, people with a range of disabilities, and people who may lack digital skills - ideally including some users with access needs in every round of research
- be able to demonstrate that they are not excluding any users who may want to use the service
- consider how they can go beyond word of mouth communication to make sure that the platform is available to everyone who could benefit from it
Reassessment
Decision
The service met point 5 of the Standard.
What the team has done well
The panel was impressed that:
- user testing has been conducted to evaluate risky assumptions from earlier in development. As a result of this research the team have decided to move back closer in line with the NHS design system
- the team is engaging with communities who have various access needs, seeking their feedback and creating a space for conversations about the accessibility of the product’s design
- an accessibility consultant is involved throughout the process and reviews designs at draft stage before development, in addition to ensuring WCAG compliance later in iteration
What the team needs to explore
Before their next assessment, the team needs to:
- create a clear migration plan
- ensure minimum viable product (MVP) is clearly defined
- continue to develop in line with the NHS design system and make sure that any deviations from official patterns are justified by well evidenced user research
- evaluate the effectiveness of communications about the new platform to maximise awareness of the service among target user groups
6. Have a multidisciplinary team
Decision
The service met point 6 of the Standard.
What the team has done well
The panel was impressed that:
- there is a good range of skills
- the correct skills are in place for product needs
- there is good communication in place for external providers
What the team needs to explore
Before their next assessment, the team needs to:
- consider bringing in content design resources to make sure that content is easy to understand and is consistent with GOV.UK and NHS content style guidelines
- bring in accessibility expertise, if not in the team, then working with the team. Accessibility needs to be baked in from the start, not something that is tested afterwards and retrospectively applied
7. Use agile ways of working
Decision
The service met point 7 of the Standard.
What the team has done well
The panel was impressed that:
- a wide variety of the right roles are in place
- suitable justification was given for using an external vendor
- the sprints were a suitable length
- the team had scrum ceremonies in place
- the team is striving for improvement in delivery
- there is good engagement with external product teams and stakeholders
- consideration has been given to what roles might be needed moving into private beta
- clear goals are being set
What the team needs to explore
Before their next assessment, the team needs to:
- assess what the support for the new product might look like
- ensure that suitable support documentation is given to the Infrastructure teams mentioned along with clear service level agreements (SLAs)
8. Iterate and improve frequently
Decision
The service met point 8 of the Standard.
What the team has done well
The panel was impressed that:
- the team is aware of improvement opportunities and has open conversations
- scrum appears to be used to good effect
What the team needs to explore
Before their next assessment, the team needs to:
- deliver on their intention to engage with infrastructure
- ensure any support package is reviewed on an ongoing basis
- iterate their user research approach in line with these report recommendations
- iterate analytics to try different approaches and reporting
9. Create a secure service which protects users’ privacy
Decision
The service did not meet point 9 of the Standard.
What the team has done well
The panel was impressed that:
- there is an awareness of security requirements
- the team understands the sensitivity around the data the service will hold on the users
- the team has identified potential threats for the service and data stored
What the team needs to explore
Before the reassessment, the team needs to:
- ensure consent is presented in a clear way to users if their data is to be shared across different workspaces
- show evidence of consideration of general data protection regulations (GDPR)
Before their next assessment, the team needs to:
- complete their data protection impact assessment (DPIA) and ensure resources are available to act upon its recommendations
- continue the work started in alpha evaluating potential threats and risks including anti-personas, to the service and testing those and their mitigation plans, in beta
- look at moderation and usage of products to ensure personal information and patient data is not published either inadvertently or intentionally
- work to ensure the preferred solution (OKTA) aligns with the department strategy on identity management
Reassessment
Decision
The service met point 9 of the Standard.
What the team has done well
The panel was impressed that:
- there is an awareness of security requirements
- the team understands the sensitivity around the data the service will hold on the users
- the team has identified potential threats for the service and data stored
- the team is aware of GDPR regulation and need for compliance
- the team is aware of the need to monitor and remove inappropriate content and have process in place to delete such content
- the team has verbal approval for system level security policy (SLSP)
- the team has completed a DPIA and will receive approval once formal approval for SLSP is received
- the team is aware of access management challenges and in particular challenges around removal of access to individuals who have left the organisation
- the team has observed that the use of OKTA is mandated by NHS England
What the team needs to explore
Before their next assessment, the team needs to:
- continue the work on access management and migrate to single sign on (SSO) before public beta
10. Define what success looks like and publish performance data
Decision
The service met point 10 of the Standard.
What the team has done well
The panel was impressed that:
- some consideration of analytics had been undertaken and tools explored
What the team needs to explore
Before their next assessment, the team needs to:
- consult with colleagues in NHS Digital regards the tools used for analytics
- perform further user research to define what a user would define as successful
- ensure that data will give insight into the full range of user journeys
- demonstrate they have an ongoing roadmap for performance analysis
- consider how they will use the insights generated from analysing the key performance indicators to continue to iterate and improve the service
11. Choose the right tools and technology
Decision
The service did not meet point 11 of the Standard.
What the team has done well
The panel was impressed that:
- the team has designed a modular and self-hosting architecture in the Azure cloud, choosing a scale-up approach
- the team has explored different languages, frameworks and services. different environments, ensuring the non-production environment has no access to real data
- the service route to live environments will be built identically
- the team has adopted an off-the-shelf open source software for the majority of the components, developing the remaining that were not available
What the team needs to explore
Before the reassessment, the team needs to:
- ensure any technology chosen can be monitored, supported and maintained
- engage with the relevant NHS technical design authority is recommended and technology choices are approved
- ensure the service can potentially accommodate the 1.5m users. Look at scalability, security, performance and resilience as these areas would not be met by the base design as the team has acknowledged
Before their next assessment, the team needs to:
- ensure end-to-end testing is achieved across all different components of the service, testing all integration points
- define a migration plan from the existing platform, understanding which workspaces and users are to be migrated by when, and how both platforms (existing and new) would operate in parallel. Define which data reconciliation activities might be needed as there will be data sources coming from both services
- ensure automated testing and deployment is achieved in beta
- define and test an offline plan
- define and test a disaster recovery plan and build redundancy into their deployments, including restoring data from the backups
Reassessment
Decision
The service met point 11 of the Standard.
What the team has done well
The panel was impressed that:
- the team has designed a modular and self-hosting architecture in the Azure cloud, choosing a scale-out approach
- the team has explored different languages, frameworks and services. different environments, ensuring the non-production environment has no access to real data
- the service route to live environments will be built identically
- the team has adopted an off-the-shelf open-source software for the majority of the components, developing the remaining that were not available
- the team is using continuous integration and continuous deployment (CI/CD) from integration and testing phases to delivery and deployment
- the team has a very good grasp of challenges around migrating from existing platforms to the new platform and are tailoring the approach based on content, content usage and users
- the team is aware of challenges of both platforms running in parallel, a strangler pattern will be used to shrink current platforms content and usage
What the team needs to explore
Before their next assessment, the team needs to:
- define data reconciliation patterns needed during parallel running of the service
12. Make new source code open
Decision
The service met point 12 of the Standard.
What the team has done well
The panel was impressed that:
- the prototype code has been published on GitHub
What the team needs to explore
Before their next assessment, the team needs to:
- continue to make open and reusable new source code and keep it updated unless it must be kept closed
- watch carefully that they are not making things open source for the sake of it. Support can be compromised by taking this approach
13. Use and contribute to open standards, common components and patterns
Decision
The service met point 13 of the Standard.
What the team has done well
The panel was impressed that:
- the team is engaging with the NHS digital service manual and design system, the Leadership Academy, and GOV.UK Slack channel, for example, and looking for opportunities to collaborate and contribute to common components and patterns
What the team needs to explore
Before their next assessment, the team needs to:
- look at standardising their service using GOV.UK and NHS.UK as a standard
- explore what changes are needed to comply with government accessibility guidelines
- work closely to NHS design system components and patterns (or GDS ones such as Notify) or be able to explain, with user research evidence, where they have diverged from the design system and why
- explore whether any architecture components might potentially be reused from other government services to avoid duplication
- consider making contributions to relevant libraries and frameworks if relevant
- test with health and social care users their assumptions about the use of NHS design and FutureNHS branding and only diverge if they can demonstrate clear evidence and quantifiable risk
14. Operate a reliable service
Decision
The service did not meet point 14 of the Standard.
What the team has done well
The panel was impressed that:
- consideration was given to what resilience might look like, for example additional Azure hosting nodes
- the team has worked on how to make deployment secure and what mitigations might be needed
- the team has documented the service ensuring it is accessible and up to date
What the team needs to explore
Before the reassessment, the team needs to:
- explore what infrastructure might be required when service requires scaling to high numbers of users
- do research into what the maximum number of users might look like
- ensure any support contract covers a proactive approach to resilience, not just problems
- formalise a plan monitoring and alerting that will be shared with and approved by the wider NHS relevant technical support teams and agree SLAs to operate the service in a sustainable way
Before their next assessment, the team needs to:
- provide a plan to ensure that the service will remain available should a hosting service suffer an outage. This would include understanding how the service will be supported in and out of regular hours and fielding queries
- perform regular penetration and load testing to check how secure the system is and how well it can cope with demand
- ensure relevant documentation is accessible and up to date as they have done until now
- carry out quality assurance testing as part of the ongoing service development
- develop a plan describing how the service will be supported
Reassessment
Decision
The service met point 14 of the Standard.
What the team has done well
The panel was impressed that:
- the team is using a scale out architecture, enabling organic growth
- the team is aware of disaster recovery (DR) and have designed a manual process to recover the service in the event of any failure
What the team needs to explore
Before their next assessment, the team needs to:
- have a firm de-commission plan for current platform before public beta testing
- investigate cost and value of automated DR process