REMOTE USER ACCESS & HOME WORKING POLICY HR29. Date of Board Approval: March 2012

Transcription

1 REMOTE USER ACCESS & HOME WORKING POLICY HR29 Applies to: All employees Date of Board Approval: March 2012 Review Date: March 2015

2 1 INTRODUCTION The purpose of this Policy is to document the Authority s approach to the management of its Wide Area Network (WAN), remote access to its information systems as well as to document the system access levels of the various remote user types. This document supports the Authority s commitment to flexible working and sets out the basis on which it will support employees working at home. The Authority will seek to accommodate changes in individual circumstances as best it can, based on the prevailing situation in relation the availability of space in offices and other resource issues. The Authority s commitment to home working brings about a number of advantages from both a management and staff perspective: Employees: Have increased discretion in their management of their work and personal time. Will have savings on travelling time and costs. Have the ability to work with fewer distractions. May be able to work more flexible hours. Working part-time may be able to work additional hours and earn more salary. May be able to work for longer before retiring. For the Authority: Retention of valued and skilled staff for whom the ability to work at home is a valued option. Ability to recruit staff who would only be interested in a post with a home working element. A reasonable adjustment/adaptation to support an employee to return to work or support an employee with a disability. Well motivated employees who feel that they work for an organisation that is prepared to be flexible and which trusts them. A method of addressing limited office space to meet Department of Health and government space restrictions Potentially improved productivity because of fewer distractions. Whilst delivering the above the Authority s IT Department, in partnership with the SIRO and Information Asset Owners (IAOs), will deliver: Secure and resilient remote access to the Authority s Information. Preserve the integrity, availability and confidentiality of the Authority s information and information systems. 1

3 Manage the risk of serious loss, loss of stakeholder confidence or other serious business impacts which may result from failures in security. Ensure that IAOs, with the support of the SIRO, take ownership and effectively manage the risks associated with remote access to their information systems. 2 EQUALITY IMPACT ASSESSMENT As part of its development, this policy and its impact on equality have been reviewed in consultation with trade union and other employee representatives in line with the Authority s Equal Opportunities Policy and the Public Sector Equality Duty. The purpose of the assessment is to minimise and if possible remove any disproportionate impact on employees and service users in relation to the protected characteristics: race, sex, disability, age, sexual orientation, religious or other belief, marriage and civil partnership, gender reassignment and pregnancy and maternity. This policy actively encourages and supports home working, which makes access to work easier for those with caring responsibilities and people with disabilities. 3 GOOD CORPORATE CITIZEN As part of its development, this policy was reviewed in line with the Authority s Good Corporate Citizen Action Plan. Home working helps organisations to reduce their impact on the environment and to improve the quality of life for employees. This policy seeks to create a safe environment for employees to work at home, thereby assisting the Authority in meeting its obligations as a good corporate citizen. 4 SCOPE This Policy covers all Authority employees regardless of work location. 5 DEFINITIONS Remote Access technology that enables staff in geographically dispersed locations to connect to Authority IT systems WAN Wide Area Network. This consists of Authority staff accessing systems remotely, Panel firms and other third parties with access to the Authority s Extranet, and all Authority contacts using the Authority s Document Transfer System (DTS). SIRO - Senior Information Risk Owner. Responsible for the overall management of information risks and for reporting on the management of such risks to the Board. IAG Intelligent Application Gateway. This is the IT system used to manage most remote connections to Authority systems. ISO The Information Security Officer is the Custodian of all information and is responsible for the management of the IT systems and physical mechanisms used in the transmission, storing and processing of information. 2

4 IAO Information Asst Owner. These are senior employees or departmental heads with responsibility for the security and management of information contained within Authority business systems, (See ITFA02 - Guidance for Working with Confidential or Sensitive Information). RAG (Red, Amber Green) An Authority post s RAG status denotes its level of home working: o Red - denotes a post in which the employee will be guaranteed a desk in the office, usually a specific desk; this employee may be able to work at home on an occasional basis, subject to management agreement. o Amber denotes a post in which the employee will often be in the office and will almost certainly be guaranteed a desk; this employee will be able to work at home some of the time, but will not have a specific desk at work. o Green - denotes a post in which the employee will not always be able to be allocated a work station. Colleagues with a red or amber status will have desk priority over these employees. Green status workers may work at home all or most of the time and come to the office only for team and other meetings. Such employees will not have a specific desk at work. 6 RESPONSIBILITIES IT & Facilities Are responsible for the maintenance, support and upkeep of all Authority supplied equipment installed in employees homes. Are responsible for the maintenance, support, security and systems that make up the Authority s WAN services. Are responsible for the provision of online and other risk assessments and training in relation to safe and secure home working, as well as guidance and support on health and safety matters for line managers. Are responsible for arranging for the safe and secure transport of equipment to and from the employee's home where this cannot be done by the employee. Are responsible for onsite and desktop IT support; this includes providing support and advice to external parties where necessary. Are responsible for the delivery of electrical testing of remote working equipment. More details on IT/Facilities responsibilities can be found in ITFA01 IT & Facilities Procedures Manual as well as ITFA04 - Health and Safety Policy. Will carry out random audits of home workers laptops etc. to ensure compliance with Authority policy; (please see ITFA07 - Workstation Audit Protocol). Line Managers Are responsible for the health and safety of their staff whilst working remotely and on Authority premises. Will determine the feasibility of home working for their team members in consultation with the individual and the IT and Facilities team before ultimately 3

5 seeking approval from the relevant IAO. This will include consideration of health and safety, business impacts, costs and information security to ensure that any risks are appropriately assessed and mitigated before any new or adjusted arrangements are agreed. Confirm the arrangements with their team members in writing in line with the template in the appendix. Must ensure that all records, including risk assessments, relating to home working are kept on the employee's personal file, other than online assessments which will be stored on a central database. Where an assessment highlights a risk which cannot be appropriately mitigated, the line manager should seek advice from the relevant person e.g. Health & Safety Officer, SIRO. Must seek the approval of their IAO before confirming a job role as suitable for home working. Must make contact with home working staff with reasonable frequency to allow any health and safety and other work-related issues to be communicated and discussed. Will clarify the hours of work to their home working staff and whether these are required on specific days, and/or times of the days so that they are contactable and services are maintained. Will seek to ensure that staff are not working excessive hours and are taking their full holiday entitlement. Must ensure that the learning needs of home workers are identified and addressed as part of the regular KSF review process to enable them to work effectively. Are responsible for delivering business related consumables, including pens and paper, for employees when ordered. Risk Management Will provide guidance and support in completing risk assessments (other than those solely related to health and safety and IT issues, where advice will be provided by IT/Facilities) to line managers as required. Provide advice and guidance where there are concerns about information governance issues related to home or other remote working. Human Resources Will provide guidance and support to line managers where employees are affected by home working, changes in working hours, additional travelling costs, high cost area supplement payments etc. Finance Will notify HM Revenue and Customs of any home working arrangements and clarify and agree the tax and National Insurance position based on the arrangements in place and confirm arrangements directly with the employee. 4

6 All Remote Working Authority staff Are responsible for ensuring that they comply with all Authority policies and procedures. Must ensure that they have read and understood the Authority s Remote User s Guide, which is available on the intranet, seeking clarification if required. Are required to complete risk assessments and training as requested by the Authority, acting on any recommendations made or lessons learned as necessary. In the meantime, any health and safety or security concerns must be reported immediately via the appropriate route. Must ensure that any confidential information is locked away when not in use or suitably destroyed and that their premises are kept secure at all times. Allow Authority staff or appointed contractors reasonable access, subject to prior arrangement, to their home to install, test and repair equipment, carry out risk assessments etc. as necessary. Must allow access to Authority employees and contractors, subject to prior arrangement, for the collection of all Authority equipment when it is no longer required for work purposes, including on leaving the employment of the Authority. Must allow access to Authority employees for the purposes of Authority business, subject to prior arrangement; face to face business meetings with third parties are not to be held in employee s homes. Must ensure that all equipment owned by the Authority is kept secure, including in transit. Must ensure that they have a safe and suitable environment in which they can focus on work. This would normally be a separate room or an area set aside which is not used for other purposes when employees are working on Authority business. Staff should ensure that they can work free from disruption, e.g. by having adequate care arrangements in place for dependants who may be at home during working hours. Are responsible for regulating their own working time and taking breaks as appropriate. Must clearly indicate their whereabouts and contact details in their Outlook calendar when not in the office. In addition, their office phone number should be diverted in accordance with arrangements in place, once this facility is available. Must book a desk before coming into the office if Amber or Green RAG status. Must keep desks in the office clear of personal belongings and work items when not using them; these should be stored within the designated storage areas when not in use. Must ensure that Authority supplied equipment is only used for Authority business. Must not plug any non-authority equipment, such as personal printers, scanners or keyboards, into an Authority laptop or other computer 5

7 7 HEALTH AND SAFETY The Health and Safety at Work Act 1974 states that an employer shall ensure, so far as is reasonably practicable, the health, safety and welfare at work of all employees. This includes home workers. Most regulations made under the Act apply equally to home workers as those working in a workplace e.g. those concerning the use of display screen equipment and manual handling. The Act also places obligations on home workers themselves to do their work in such a way as to ensure that they and any other person, including members of the household, or the public, will not be exposed to risks to their health and safety. Equipment used by home workers (whether owned by the Authority or provided by the home worker) must be safe to use and not give rise to any risks to health and safety. It should be maintained in an efficient working order and in good repair. The Authority is not responsible for the safety or maintenance of employees premises or domestic electricity and gas supplies. 8 CHANGES TO NORMAL PLACE OF WORK Employees who work at home 100% of the time are eligible to claim the cost of travelling to Authority premises for meetings and travel in working time, because their normal place of work is their home. However, for those where home working is a change of their normal place of work, the rate of high cost area supplement applicable to their home (inner London, outer London or fringe) will be become payable; any reduction as a result of this would be not protected in line with the Change Management policy, unless the change was being required by the Authority; If the change was as a result of a request by you, you would not be able to change your mind at a later stage. Employees working at home 100% of the time who subsequently move house to a location where a lower rate of high costs area supplement applies will not be eligible for pay protection as this would be a matter of individual choice. If you work partly at home and partly at the office, your work base would remain at the office and you would not be able to claim expenses or time for travelling to and from the office, but any high cost area supplement would remain. Employees who work at home are responsible for advising their manager as soon as possible if they are planning to move house, so that unnecessary expenditure can be avoided and arrangements can be made for the installation and transportation of equipment and resources. 6

8 9 INSURANCE, BUSINESS RATES AND UTILITIES Any home working would normally make part of the property used liable to a business rate, if the work materially detracts from the use of the dwelling for domestic purposes. All employees working at home, whether on a permanent, part-time or occasional basis, are advised to check their individual circumstances with their local council. In the event that an additional charge is incurred, the Authority will reimburse the excess costs on production of original documents confirming the details. Home workers should ensure that they notify their building, contents, motor and any other relevant insurer of their home working arrangements and seek reimbursement with original documents where an increase in insurance premium is levied. Authority equipment remains covered under the Authority s Property Expenses Scheme. The Authority does not reimburse additional charges for utility bills for employees working at home. Some mortgage and rental agreements do not allow for the home premises to be used for work purposes of any type. In some circumstances, working from home can result in eviction. It is the responsibility of the employee to check their circumstances with their landlord or mortgage provider. The Authority will not accept any responsibility for an employee who suffers any detriment, loss or legal action as a result of not obtaining the necessary permissions from their insurer, mortgage lender, landlord or local authority. 10 SYSTEM AVAILABILITY The Authority s information systems are available both in the office and remotely, between 7am and 7pm Monday to Friday. Systems may also be available between 7pm and 7am and at weekends but may be taken offline by technical staff for maintenance, backup or system repair. Wherever possible prior notice will be given to employees if systems are to be unavailable. System responses times may also be slower during these times whilst backup processes are in operation. 11 STANDARD EQUIPMENT FOR REMOTE USERS Based on the identified staff member s job role, the Authority will supply a standard set of equipment for home use for employees in posts rated as amber or green if they are working at home for more than one day a week. The Authority acknowledges that in some circumstances staff may already have some of this equipment and where it is possible and does not create any technical or Health and Safety issues, this may be used; the equipment available is: 7

9 Mandatory Laptop only one laptop will be provided, which will need to be transported between home and office as required Business Line Docking Station Keyboard and Mouse Carry case/bag Monitor Optional and available as required Telephone Desk Chair Printer Document Shredder Smoke detector Power extension Desk lamp Lockable cabinet Other equipment identified as necessary by a risk assessment Some employees working at home are supplied with scanners, depending on their role and the Authority will consider requests from employees working at home for items of equipment not on this list. RELATED POLICIES ITFA01 IT & Facilities Procedures Manual ITFA02 Guidance for Working with Sensitive and Confidential Information ITFA05 Information Security and Data Storage Policy ITFA07 Workstation Audit Protocol ITFA21 Guidance for using Encrypted USB Storage Devices and Attachments RM02 Information Governance Strategy RM05 Incident Reporting Policy and Procedure HR01 Equal Opportunities Policy HR22 Flexible working HR28 Stress management and working time 8

10 Dear HOME WORKING Home working agreement Appendix I am writing to confirm the arrangements for your home working. This letter represents a change to your terms and conditions of employment with the Authority with effect from. If your circumstances change and you wish to amend these arrangements, the Authority will seek to accommodate your request, based on the circumstances prevailing at the time. If you wish to request a change, you should talk to me in the first instance. Pay and normal place of work Your salary will be unaffected by your home working arrangement, as your normal place of work will be. [OR] As you are working at home 100% of the time, your normal place of work is now insert employee s home address. (This means that High cost area supplement is no longer payable/is payable at the outer London/fringe rate. The existing payment is/is not protected for up to three years in line with the Authority s Change Management Policy.) Job duties While working at home, you will develop a strategy to cope with the potentially conflicting demands of work and home life and endeavour to work in an organised and disciplined fashion. Hours of work On days you are working at home, you are required to be available to speak to me and colleagues on the telephone. Rest breaks You are required to ensure that you take adequate rest breaks: where work continues for a period of more than six hours, you must take a break during the working day of at least 20 minutes and stop work during that break; a daily rest break of at least 11 continuous hours; i.e. the time period between stopping work one day and beginning work the next day must not be less than 11 hours; and 9

11 Sickness at least one complete day each week when no work is done. If you are sick and unable to work, you must telephone me as soon as possible, indicating the nature of the illness and how long you expect to be unable to work. The Authority s normal sick pay arrangements will apply in these circumstances. Visits to the Authority s premises You are required to attend the Authority s premises at least once a month/once a week for team meetings, training, one-to-one meetings, KSF review meetings and other events necessary for the performance of your duties. The times of such visits will be agreed in advance. This paragraph should be amended as necessary for individual roles. As your normal place of work remains our premises, your travelling time to our offices will be in your own time and you will not be able to claim reimbursement of travelling expenses. [OR] As your normal place of work is your home, you may travel to our premises in working time and reclaim expenses incurred. You may also be required to travel to other locations for work. Visits to the employee's home The Authority reserves the right to visit you at home at agreed times for work-related purposes, including health and safety matters. It is a condition of this home working agreement that you agree to accept such visits in your home. Such visits will be for the purposes of: delivering and collecting work; providing a channel for reporting; performance monitoring and feedback; general discussions about work-related matters; ensuring health, safety and security; and any other work-related purposes. This list is not exhaustive or exclusive. Equipment and materials 10

12 The Authority will provide and maintain all necessary equipment, and materials for you to work at home. It is your duty to ensure that proper care is taken of these equipment and materials. Details of the equipment provided are given in the Home Working Policy. You should not connect personal equipment to your Authority laptop or other computer. On termination of your employment for any reason, the Authority will have the right to visit your home at an agreed time and retrieve all equipment, furniture and documents belonging to the Authority. Telephone and internet accounts The Authority will pay directly the costs of connection fees for all telephone and internet connections in the employee's home. Stationery and postage You should order stationery from the facilities team. Items for posting should be printed and despatched from Authority offices. The Authority will not normally reimburse expenditure for stationery and postage for an employee working at home and will only do so with the prior agreement of your manager. Security You must carry out your work for the Authority in a room used only for that purpose during your working time. This may include a room used by another person for working from home at the same time as you. You must not allow members of your family, fellow residents or third parties who are not employed by the Authority to access or use Authority equipment, documents or information. You must also agree not to smoke in the room where the work is carried out. You are responsible for keeping all documents and information associated with Authority business secure at all times. Specifically, you are under a duty to: keep filing cabinets and drawers locked when they are not being used; keep all documentation belonging to the Authority under lock and key at all times except when in use; and set up, use and keep secure unique passwords in line with the Authority s procedures for maintaining data security. The computer and other equipment provided by the Authority must be used only for work-related purposes and must not be used by any other member of your family or other residents or guests, other than other Authority employees, at any time or for any purpose. 11

13 Health and safety The Authority is obliged under health and safety legislation to ensure the health and safety of home workers in the same way as it is for office-based staff. The Authority will therefore take appropriate steps to ensure that: all equipment and systems of work in your home are safe; all articles and substances are safely handled and stored; an analysis of your workstation is conducted; information and training on the safe use of equipment, including display screen equipment, is provided to you; and risk assessments are carried out in respect of the work that you are carrying out. You have a duty to ensure, insofar as is reasonably practicable, that you work in a safe manner and follows all health and safety instructions issued by the Authority from time to time. Insurance and business rates You are responsible for checking that all home and contents insurance policies provide adequate cover for the fact that you work at home and for confirming whether business rates are applicable with your local authority. If there is any uplift in the business rates or premium for any of these home insurance policies specifically on account of the work for the Authority, the Authority will meet the appropriate extra premium upon provision by you of the appropriate documentation and receipts. Home address As a home worker, you have an obligation to advise your manager as soon as possible if you are planning to move home, to allow for the installation and transportation of necessary equipment and facilities and to save any unnecessary installation and expenditure at your existing home. All the other terms and conditions of your employment with the Authority remain the same. Please sign and date the enclosed copy of this letter and return it to me to confirm your agreement to these arrangements. Please let me know if you have any questions about the arrangements. Yours sincerely 12

14 Name and post title of manager I confirm my agreement to the arrangements set out in this letter and understand that they amend the terms and conditions of my employment with the Authority. I have read the Authority s Remote User s Guide. Signed: Date: Name of employee 13