From: DHSC
Assessment date: 19 May 2022
Stage: beta
Result: met
Service provider: NHS Business Services Authority (NHSBSA)
Previous assessment reports
The umbrella immigration health surcharge service had two Covid-19 peer reviews. These reports are not published. The student reimbursement is a new journey with a different start page and has not previously been assessed.
Service description
Overseas Healthcare Services (OHS) is an arm’s length body of Department of Health and Social Care (DHSC) managing reciprocal healthcare. As a result of the leaving the European Union (EU) the Trade and Cooperation Agreement (TCA) between the EU and United Kingdom (UK), was agreed. The agreement stated that reciprocal healthcare rights would continue from 1 January 2021. Therefore, EU students studying in the UK maintained their right to access the NHS for immediately necessary treatment as a UK resident would by showing their European Health Insurance Card (EHIC). As the Swiss convention came into force in November 2021 students from Switzerland were included in the reimbursement scheme.
As freedom of movement came to an end from 1 January 2021 any EU or Swiss student who moved on or after this date must pay the UK immigration health surcharge (IHS) if they are coming to the UK for longer than 6 months. The TCA includes a right in such circumstances for the student to receive a reimbursement of the IHS if they meet the necessary criteria.
This assessment’s focus is on the IHS reimbursement scheme for EU and Swiss students.
Service users
This service is for:
- students from the EU and Switzerland
Report contents
- Understand users and their needs
- Solve a whole problem for users
- Provide a joined-up experience across all channels
- Make the service simple to use
- Make sure everyone can use the service
- Have a multidisciplinary team
- Use agile ways of working
- Iterate and improve frequently
- Create a secure service which protects users’ privacy
- Define what success looks like and publish performance data
- Choose the right tools and technology
- Make new source code open
- Use and contribute to open standards, common components and patterns
- Operate a reliable service
1. Understand users and their needs
Decision
The service met point 1 of the Standard.
What the team has done well
The panel was impressed that:
- the team has understood the different types of international student who might use the service: their various needs, motivations and concerns at the different stages of applying
- the team synthesised research findings into clear user needs, by phase, which will support any future service design and development team make decisions for modifications
- the team has a research plan for the coming months that is informed by real user behaviour from users of the service
What the team needs to explore
Before their next assessment, the team needs to:
- research with college administrators who might complete the application as a proxy for their students
- research with people who have applied, and who are going to renew their student visa, perhaps with a focus on awareness as well as previous process experience
2. Solve a whole problem for users
Decision
The service met point 2 of the Standard.
What the team has done well
The panel was impressed that:
- the team has introduced a survey to capture feedback of the service at different stages, from application to receiving the reimbursement
- the team is engaging with the international student houses at the universities with large populations of EU students to recruit for in-person research, now that there are not restrictions on travel
- the team has paid close attention to bringing the user on the journey with modified, specific instructions on acceptance, and rejection email notifications
What the team needs to explore
Before their next assessment, the team needs to:
- explore further, and test, ways of informing applicants before launch whether they should or should not apply, based on their work and medical expectations. At the moment the consequences of receiving reimbursement are a minor message compared to requirements to apply at all
- research with people with lower levels of digital inclusion as well as with people that have neurodiverse conditions such as anxiety and dyslexia to see how they read, understand and reflect on using the service
- create clearer guidance on what to do if applying for a dependent in addition to the applicant
3. Provide a joined-up experience across all channels
Decision
The service met point 3 of the Standard.
What the team has done well
The panel was impressed that:
- the team has produced a service which meets the policy requirements for reimbursement. It is efficient to apply, and well structured
- the team has been quick to respond to applicant calls to the Contact Centre to chase applications, and has made updates to improve the guidance and response letters
- the team has been able to influence the development of parts of the journey outside of their service, such as payments
What the team needs to explore
Before their next assessment, the team needs to:
- contextualise the service. Place the application for IHS reimbursement within a service journey of applying for a visa, starting a student life and renewing a visa
- understand how students know about the right to apply for a reimbursement, as ‘easily found and understood’ was a key goal, but was not presented fully at the assessment
4. Make the service simple to use
Decision
The service met point 4 of the Standard.
What the team has done well
The panel was impressed that:
- the team has created a service that works for users. It has a clear one page per task linear journey using the government design pattern
- the instructions on what you’ll need to apply online are comprehensive
What the team needs to explore
Before their next assessment, the team needs to:
- do another round of testing, including testing the path with rejection letters
- amend the confirmation letter to reduce the number of follow up calls to the contact centre
- explore the service experience of people who will make a phone application process
- test the use of the terms ‘applicant’ and ‘dependent'
5. Make sure everyone can use the service
Decision
The service met point 5 of the Standard.
What the team has done well
The panel was impressed that:
- the team has conducted user research and testing with users with accessibility needs
- the team is planning further rounds of testing with users with low digital skills
- the team has conducted testing and research into the back end system
What the team needs to explore
Before their next assessment, the team needs to:
- consider further testing with low digital literacy users
- test the non-digital pathway to understand the service experience
- consider testing the dependent’s user journey, which is as yet untested
6. Have a multidisciplinary team
Decision
The service met point 6 of the Standard.
What the team has done well
The panel was impressed that:
- the team collaborated well across organisations including other government departments
- the team had a User Researcher on board consistently throughout the delivery of the service
- the team is looking to turn any contractual roles in the team into permanent BSA roles
What the team needs to explore
Before their next assessment, the team needs to:
- ensure that they retain a user researcher during further development cycles
7. Use agile ways of working
Decision
The service met point 7 of the Standard.
What the team has done well
The panel was impressed that:
- the team is using scrum methodology
- the team ensured that there was appropriate governance and reporting in place to deliver the policy outcomes
8. Iterate and improve frequently
Decision
The service met point 8 of the Standard.
What the team has done well
The panel was impressed that:
- the team reviewed and collated all feedback data including from contact centres, and used that data to prioritise improvements in the service
- the team tested with a wide variety of users and have iterated based on that testing
What the team needs to explore
Before their next assessment, the team needs to:
- consider testing with users on other devices such as mobile phones or tablets
9. Create a secure service which protects users’ privacy
Decision
The service met point 9 of the Standard.
What the team has done well
The panel was impressed that:
- the team ensured the technical solution means that Service User (SU) data is secure at use, transit and storage via the use of https (protocol), TLS 1.2+, AWS 2021 Cipher pack, vulnerability, anti-virus scan, and so on. The team had an IT health check completed with risks addressed
- the team has guidance for cookies, followed to a greater extent
- the team has ensured the role based access control (RBAC) is implemented with multi factor authentication (MFA) and the use of assigned device to access system as security measure
- the team has implemented Technology Code of Practice (TCoP), National Cyber security Center (NCSC) and ISO27001 standards to enhance the protection of user privacy
- the team has implemented the mitigation of Open Web Application Security Project (OWASP) vulnerabilities
What the team needs to explore
Before their next assessment, the team needs to:
- think about the session timeout being 25 minutes when the NCSC recommended session handling timeout is 15 minutes. Read the Application Development Guidance on the NCSC website. Although this is outside the control of the project team, this should be considered for future releases
10. Define what success looks like and publish performance data
Decision
The service met point 10 of the Standard.
What the team has done well
The panel was impressed that:
- the team has identified appropriate key performance indicators (KPIs) for the service
- the team is developing a KPI dashboard
- the team is benchmarking their KPIs
What the team needs to explore
Before their next assessment, the team needs to:
- agree upon appropriate targets for their KPIs and how they will use them to improve service performance
11. Choose the right tools and technology
Decision
The service met point 11 of the Standard.
What the team has done well
The panel was impressed that:
- the team is making good choices of technology for the project such as the consistent use of Node.js for the frontend development and the reuse of Home Office forms as opposed to redevelopment of forms
- the team is using open standard tools used where possible. For example the use of DataDog for monitoring and alerting
- the team made two virtual private cloud availability zones which makes the recovery process seamless
What the team needs to explore
Before their next assessment, the team needs to:
- clarify on what infrastructure and activity Tenable IO is checking for security or vulnerability threat vectors
- consider producing a disaster recovery manual to guide the availability zones switch and collect any relevant metrics such as RPT (Recovery Point Objective) and RTO (Recovery Time Objective) for KPI measures
12. Make new source code open
Decision
The service met point 12 of the Standard.
What the team has done well
The panel was impressed that:
- the team used best practice for Continuous Integration and Continuous Deployment (CICD) has been implemented via GitLab and Runners
- the team used a code management process secured with permissions and MFA
- the teams code without security implications are in the open
What the team needs to explore
- collaborate with other project teams and find ways of sharing this practice
13. Use and contribute to open standards, common components and patterns
Decision
The service met point 13 of the Standard.
What the team has done well
The panel was impressed that:
- the team reused the Home Office form front-end
- the team reused common patterns and standards adopted by other government departments such as session time and cookies
What the team needs to explore
Before their next assessment, the team needs to:
- continue to share project patterns and standards with other government departments
- continue to collaborate with other government departments
14. Operate a reliable service
Decision
The service met point 14 of the Standard.
What the team has done well
The panel was impressed that:
- the team ensured that the service had zero to little downtime in live operation
- the team is using analytics to improve service performance
What the team needs to explore
Before their next assessment, the team needs to:
- advise on what the user journey would be if the service was to go down