Document filename: HSCIC SSD Bowel Cancer Screening System (BCSS) Directorate / Programme. Project. Systems and Service Delivery DOC-00013

Transcription

1 Document filename: HSCIC SSD Bowel Cancer Screening System (BCSS) Directorate / Programme Document Reference: Systems and Service Delivery DOC Project Project Manager N/A Status Final Owner Phil Moores Version 3.0 Bowel Cancer Screening System Author Phil Moores Version issue date 4/12/13 Service Level Agreement (SLA) between NHS Cancer Screening Programme and Health & Social Care Information Centre for the support of the Bowel Cancer Screening System Effective from: 01/04/13 To: 31/03/14

2 Amendment History Version Date Issued Author Change /05/07 P Moores First draft SLA 07/ /06/07 P Moores Final agreed at Project Board 07/06/ /07/08 P Moores First Draft SLA 08/ /04/09 P Moores First draft SLA 09/ /07/10 P Moores First draft SLA 10/ /03/11 P Moores /06/12 P Moores Annual Review and changes to Section 5 and 13. Annual Review and conformance to new CFH SSD format /08/12 P Moores Comments from internal Reviewers /09/12 P Moores Comments from P McCorry /08/13 P Moores Transfer of document to new HSCIC template and annual review /09/13 P Moores Change to Availability /12/13 P Moores Comments from P McCorry Reviewers Name Title Date Joan Foreman Head Product Development 24/09/13 Rob Hardisty Head Hosting and Infrastructure 24/09/13 Approvals Name Title Date Norman Raphael Head Service Delivery 04/12/13 Distribution Name Richard Winder Sean Walsh Phil McCorry Phil Moores Title Deputy Director NHS Cancer Screening Programme Director HSCIC System and Service Delivery Assistant Director NHS Cancer Screening Programme NHS CFH Service Delivery Manager Page 2 of 28

3 Contents 1 PARTIES TO THIS AGREEMENT AND AUTHORISATION PARTIES TO THIS AGREEMENT AUTHORISATION INTRODUCTION SUMMARY OF AGREEMENT VALIDITY AND REVIEW OF THIS AGREEMENT SERVICE SUPPORT AND SERVICE DELIVERY PROCESSES SERVICE DESCRIPTION AND SPECIFICATION SERVICE DESCRIPTION & SCOPE SERVICE OUT OF SCOPE ROLES AND RESPONSIBILITIES DATA PROCESSING DATA CONTROLLERS AND PROCESSORS SERVICE DESK HOSTING TRAINING SERVICE BUREAU SERVICE POPULATION INDEX SERVICE ADVERSE INCIDENT SERVICE PERFORMANCE TARGETS REPORTING SERVICE CONTINUITY AND AVAILABILITY AVAILABILITY CONTINUITY HOURS OF SUPPORT OPERATION UNSUPPORTED ACCESS SUPPORT ARRANGEMENTS INCIDENT RESPONSE AND RESOLUTION TIMES MAJOR INCIDENT INCIDENT RESOLUTION INCIDENT ESCALATION CHANGES & RELEASES CAPACITY PLANNING AND MANAGEMENT SECURITY PRINCIPLES AND ADMINISTRATION SERVICE COST AND CHARGING ARRANGEMENTS SERVICE COST INFRASTRUCTURE COSTS DEVELOPMENT COSTS ADDITIONAL SERVICE COSTS CHARGING AND FUNDING PROCESS MEETINGS, COMPLAINTS & ADMINISTRATION SERVICE MANAGEMENT REVIEW MEETINGS COMPLAINTS SLA ESCALATION AND ARBITRATION TERMINATION OF THE SERVICE CHANGES TO AGREEMENT APPENDIX A SUMMARY OF PERFORMANCE TARGETS APPENDIX B HSCIC SSD TRAINING SERVICES TERMS AND CONDITIONS...26 Page 3 of 28

4 . 1 Parties to this Agreement and Authorisation 1.1 Parties to this Agreement This Service Level Agreement consists of the following parties: NHS Cancer Screening Programme (Public Health England), and Health & Social Care Information Centre Systems and Service Delivery. 1.2 Authorisation Agreed on behalf of NHS Cancer Screening Programme Sign: Date: Print Name: Philip McCorry, Assistant Director (IT) NHS Cancer Screening Programme Agreed on behalf of Health & Social Care Information Centre Sign: Date: Print Name: Sean Walsh, HSCIC, Systems and Service Delivery Page 4 of 28

5 2 Introduction 2.1 Summary of Agreement This document is the Service Level Agreement between NHS Cancer Screening Programme and Health & Social Care Information Centre Systems and Service Delivery (HSCIC SSD) for the support and delivery of the Bowel Cancer Screening Service (BCSS). The Agreement defines the standards and levels of service to be provided and the responsibilities of both parties to enable the effective and efficient running of the service. This Agreement is to be managed and administered by both HSCIC SSD and the NHS Cancer Screening Programme. 2.2 Validity and Review of this Agreement This agreement is valid from 1 st April 2013 to 31 st March A structured review will take place annually to evaluate and prove the performance and appropriateness of the Agreement. Interim meetings may also be held to discuss the agreement. Any recommendations for changes (following these meetings) to the SLA will be reviewed, agreed and passed to the HSCIC Service Delivery Manager. 2.3 Service Support and Service Delivery Processes The processes to be used for Service Management will be in conformance with the requirements of ISO/IEC and will as far as practicable, utilise ITIL best practice. Page 5 of 28

6 3 Service Description and Specification 3.1 Service Description & Scope HSCIC is responsible for the provision of a fully managed service for the Bowel Cancer Screening System. The Service includes: Provision of a web-based data capture and processing Application; Provision of hardware and networks surrounding the central application, but not to the hubs or screening centres, accessing NHSnet as appropriate, to permit the operation of the Application; Provision of appropriate security arrangements, including delegated responsibility for end user access control. All security arrangements to be in line with the BCSS System Level security Policy. Provision of a contingency IT Infrastructure, as a standby and backup to the live IT infrastructure in the event of a disaster or major Incident; Provision of IT infrastructure for the Oracle Business Intelligence Enterprise Edition (OBIEE) reporting tool; Provision of a training IT Infrastructure and appropriate resources to ensure suitably qualified users; Provision of qualified technical resources to undertake application, operational and network support and development; Provision of a service desk for the receipt and processing of User Incidents; Provision of Bureau and authentication staff to ensure secure access control; Provision of Population Index checks to ensure demographic updates are replicated; Provision of qualified technical and management personnel to monitor, measure, report and administer the performance of the Service. 3.2 Service Out of Scope This section identifies the service and configuration out of scope. Hardware HSCIC does not provide support for the User s infrastructure, including hardware, network connections cables or printer sharing. HSCIC is not responsible for contacting third party suppliers in respect of hardware which has not been supplied through them. Software HSCIC is not responsible for contacting third party suppliers in respect of software which has not been supplied through them. The Agreement does not cover Incidents around extracting data from third party systems. Page 6 of 28

7 Networks External to HSCIC, Trust network management is a local service delivery responsibility. 3.3 Roles and Responsibilities NHS Cancer Screening Programme NHS Cancer Screening Programme will carry out the following roles and responsibilities: Party to this Agreement; Take ownership for the co-ordination of the overall Bowel Cancer Screening Programme; Data Controller; Take ownership for all user calls for advice and guidance on clinical and policy requests; Forecast Service delivery and associated capacity management with HSCIC; Undertake to review Service performance; Escalate live or potential issues and problems with Service delivery and performance; Undertake performance management of this Agreement with HSCIC, including operational reviews: Change Management, Service Review, Escalation; and Work with HSCIC and other appropriate bodies to co-ordinate and plan for national rollout of the Service HSCIC SSD Party to this Agreement; Data Processor; Assign a Service Delivery Manager to be responsible for day-to-day Service delivery; Own the relationship with internal and external dependent third party suppliers, including undertaking performance management and review in accordance with agreed contracts and other recognised documentation; Administer the IT Infrastructure, and manage it in accordance with appropriate internal and external dependent third party suppliers; Be responsible for provision and maintenance of appropriate security arrangements, including delegated responsibility for end user access control. All security arrangements to be in line with the BCSS System Level Security Policy; Undertake performance management of this Agreement, including operational reviews: Service Review, Escalation; Report regular performance to the NHS Cancer Screening Programme; To provide Service Desk Staff to receive telephone calls and process s during the Support Hours; Page 7 of 28

8 Service Delivery personnel will be available to manage calls during Support Hours; To ensure that appropriate service delivery staff are available to support all products during Support hours; Oracle database administration maintenance; Technical staff to monitor and review log files Monday to Friday excluding English bank holidays and proactively identify software and capacity issues thus ensuring optimum performance of the service; To allocate calls with an initial priority via discussion between the Service Desk and the user; Service Delivery personnel will provide an initial response to the call (by telephone or ). Response rates will be measured from the point the user first logs the call with the Service Desk; To deal with calls raised with the Service Desk in line with the priorities and response/resolution targets indicated below, ensuring that regular progress reports are provided to the caller as appropriate to the nature of the call, and documented in a call log; To ensure that a call remains open until a satisfactory resolution has been reached in agreement with the User. In the event that a significant number (i.e., 3) of attempts have been made to contact the User without acknowledgement or response, the log will be closed. The user will then be contacted via to inform them of the closure of the call; Where a support call requires further work to lead to a full resolution (e.g., software fix or upgrade required), where circumstances permit, Service Delivery Personnel will provide temporary solutions to enable normal operations to resume as soon as possible; To provide communication on all call resolutions by telephone or ; To provide representation at specific User Groups, as required, to improve liaison and ensure closer working relationships; To ensure that no member of staff makes unauthorised access to a computer or makes unauthorised changes to programs or data therein; To ensure that all staff working on the programme are fully briefed in their responsibilities under and comply with the provisions of the Data Protection Act (1998) as it relates to the process of information relating to individual people covering the obtaining, use, storage or disclosure of such information; To ensure all staff working on the programme are fully briefed in their responsibilities in respect of the local IM & T Security Policy and operated under the good practice included therein, especially the provisions relating to computer viruses; To recover application access or data from backups in the event that such action is required as a result of activity by Service Delivery personnel; Page 8 of 28

9 In the investigation of incidents, advice may be offered on the root cause of the problem should it lie outside of the application software, although the responsibility for fixing this remains with the User; Work with NHS Cancer Screening Programme and other appropriate bodies to support national rollout of the service including: o o o o o Participation in site visits for additional support in exception; Participation in communication road shows; Proactively encouraging installation/connectivity; Provision of a bureau service to ensure users and organisations are setup on the system; and Provision of Service Desk for IT queries. To provide formal user system training; To provide a training instance including training accounts of the system for formal training courses; To provide a population index service to ensure that all cohort data is accurate and where demographic details have changed due to GP practice updates that this is reflected in BCSS; To provide an annual demographic data comparison between BCSS and NHAIS comparing subject s NHS Number, GP Practice, date of birth and postcode User Responsibilities To raise all requests for support services with the Service Desk by telephone on or via (Exeter.helpdesk@hscic.gov.uk); The following information will be requested by the Service Desk: o o o o o Name of individual; Name of organisation; Telephone number of individual; address of individual; and Details of Incident. To be responsible for any loss or corruption of data or malfunction of the live system caused by the use of privileged administrator access by a member of the Customer s staff. The rectification of such loss or corruption falls outside the core support agreement with HSCIC SSD and will result in additional charges. The need for such activity will be through the escalation process detailed in this SLA; To ensure that Bureau service is notified of any changes to the organisation and personnel; To ensure that new members of staff receive appropriate and relevant training prior to using the system; Page 9 of 28

10 To ensure that all necessary licensing arrangements are in place for 3 rd party software in use on customer s site; To ensure that recommended versions of browser software are loaded within three months. Support services may be reduced where versions of browser software are not on the recommended list; and Where and when appropriate, to contact local IT support personnel in the first instance for the analysis and determination of IT failures or interruptions in using/accessing the Service, in particular, for localised hardware and network Incidents. 3.4 Data Processing data controllers and processors The following information defines the roles and responsibilities around data ownership and control in relation to this service. There are two distinct roles in relation to personal data; that of the data controller and that of data processor. The data controller (NHS Cancer Screening Programme) determines the purpose for and manner in which personal data is processed. They have responsibility for compliance with the Data Protection Act 1998 including the protection principles, for responding to subject access requests and directing their data processor. The data processor (HSCIC SSD) processes personal data on behalf of and as directed by the data controller. Processing data means obtaining, holding or recording data, carrying out disclosure, retrieval, consultation, organisation or erasure of data on behalf of the data controller. HSCIC SSD is responsible for ensuring adequate physical and logical security arrangements for the data in storage and in transmission. HSCIC SSD also provides the framework for access control under direction from NHS Cancer Screening Programme (the data controller). 3.5 Service Desk The Service Desk service will be carried out from HSCIC SSD offices and will undertake call handling, incident escalation and user communication activities. Users are to report all calls to the Service Desk. Confirmation that a call is logged in accordance with this agreement is the Service Desk reference number. Users should advise the Service Desk of any access constraints, such as restricted times of availability. Calls reported by user to other entities, such as local technical support are not supported by this SLA. Page 10 of 28

11 3.6 Hosting The hosting of the service will be carried out from HSCIC SSD offices with the intention to move to dedicated data centres based in Plymouth and Gloucester. New infrastructure e.g. letter servers will be installed in Plymouth and Gloucester. 3.7 Training Service The HSCIC SSD Training Service will provide a programme of BCSS training events to meet customer demand. Demand for courses is expected to fluctuate and HSCIC SSD Training Service will always endeavour to satisfy demand. The Training service will carry out the following functions; Course administration including recording expressions of interest, regular assessment of demand, correspondence with delegates, invoicing of sites etc; Provision of the formal training environments, including account setup, data integrity and refreshing; Delivery of training events for Hub and Screening centre staff; Creation and maintenance of courseware for all courses and online Cancer Administrator and Pathologist courses; Full terms and conditions for HSCIC SSD Training Service are at Appendix B. A training environment for use by the National Cancer Screening Programme will also be maintained in order that business workflow training can be provided. The database will be setup such that there will be roll back / roll forward facilities to simulate the full screening timeline. 3.8 Bureau Service The HSCIC SSD Bureau Service will provide the facility for the creation and upkeep of users, organisations and signatures on the system. The system will only be changed when correctly authorised Data User and Collection forms (DUC and DCF) are received. The service also provides the facility for: User communications to be produced and distributed in accordance with the appropriate audience based on the user roles matrix; Administration of the GP communications service between Hubs and GP practices. 3.9 Population Index Service The HSCIC SSD Population Index service is provided to resolve any data validation issues identified with the cohort which feeds the service. This will eliminate any duplication, confusion and demographic issues identified in the cohort before being Page 11 of 28

12 passed to the service. Daily checking and error handling in order to resolve any data validation with the English NHAIS sites will be provided by SSD staff who will liaise with appropriate bodies as necessary including Hubs Adverse Incident Service The HSCIC SSD Adverse Incidents (AVI) service is provided for users by a web based application. The URL will be supplied so that incidents may be reported using an on-line document which when completed is submitted. The submission will be registered on the AVI Incident database. Each incident will be forwarded to a pre-defined distribution list Performance Targets This Agreement includes a number of performance targets for the provision, delivery and measurement of service performance and are summarised in Appendix A Reporting The following data and information will be presented by HSCIC SSD to the NHS Cancer Screening Programme for each User Group and Program Board. The source of the information will be from the HSCIC SSD standard service management system: Standard Data and Information Performance Targets, per category, as specified within this Agreement and summarised at Appendix A; Trend analysis of calls; Forecast of training; Analysis of Service Desk Incidents. Page 12 of 28

13 4 Service Continuity and Availability 4.1 Availability The hours of service operation, for user access, are between the hours of 08:00 and 21:30 Monday to Saturday. Critical business periods are 8am to 9pm Monday to Saturday. Service response times are typically 5 seconds and are measured from the HSCIC SSD server to the HSCIC SSD site boundary. End to end availability of the service is from the HSCIC SSD server to the HSCIC SSD site boundary i.e. at the point of N3 access. Maximum planned downtime is 4 hours per month. Total monthly service availability is 98% measured over hours of service operation. Single allowable planned downtime period is 2 hours. HSCIC can also perform maintenance at any time outside of the hours of service operation without prior notice. HSCIC may need to apply application changes on the system. Such situations will be minimised and are not expected to exceed one per 3 month period, and in these case 8 weeks written notice will be provided. In exceptional circumstances HSCIC may need to perform maintenance on the service for an extended period such as an entire weekend to perform critical upgrade or infrastructure maintenance. Such situations will be minimised and are not expected to exceed one per 6 month period, and in these case 3 months written notice will be provided. 4.2 Continuity The service is designed to have a warm failover from the primary to the standby environments in the event of a component failure. The standby infrastructure is subject to all processes and performance targets within this agreement where the live infrastructure is replaced or subsumed. Backups Recovery point objective i.e. the amount of data loss the service can tolerate. There is the possibility for up to 30 minutes data loss. Recovery time objective i.e. the time taken to recover the service. The service is designed to be switched to the standby infrastructure in the event of a component failure which will take up to 4 hours. Planned maintenance periods will be outside of the critical business periods except for emergency maintenance work. The SDM will provide 2 weeks notice of any planned downtime in agreement with NHS Cancer screening Programme. 4.3 Hours of Support Operation The core hours of operational support will be between 08:00 and 17:00 Monday to Friday, excluding Public Holidays. Page 13 of 28

14 4.4 Unsupported Access Unsupported access to the service will be between the hours of 17:00 and 21:30 Monday to Friday and 08:00 to 21:30 hours on Saturday. The service will be available to users but not guaranteed as it is outside of Support hours. An extension to Support hours can be negotiated at additional cost as described in section 6.4 Page 14 of 28

15 5 Support Arrangements 5.1 Incident Response and Resolution times All incidents will be categorised and allocated a priority with agreement of the user at the time of logging the incident. The incident category is assigned by the Service Desk based on information imparted by the user. The incident category may be requested or challenged by the user; in which case the incident will be categorised according to the wishes of the customer. This deviation to normal logging would be recorded in the incident log. If the support team subsequently believes that a different category should be used they will negotiate with the user accordingly. All incidents are dealt with in order of category allocation, 1 being the highest order of priority. The incident categorisation, and target response and resolution timescales are as detailed in the table below: Category Heading Target Response Timescale Target Resolution Timescale Example Definition 1 Major 30 Minutes 1 day Problems causing significant business impact or affecting all users of a key module or major function of the system. Significant business impact is where subject/patient may be affected and or a critical system task can not be achieved and no work around is available or data loss could result in an Adverse incident. 2 Intermediate 2 Hours 2 days Problems causing limited business impact, the unavailability of a key module / major function or where a manual or technical work around is available. 3 Minor 3 Hours 5 days Problems causing low business impact, inconvenience, minor disruption or restricting performance. 4 Non-urgent 4 Hours As agreed Any other incident relating to the general use of BCSS and, causing slight irritation. Cosmetic general enquiries, or for information. Page 15 of 28

16 5.2 Major Incident When a major incident is recognised and is within scope of this SLA a Major Incident Manager shall be assigned who will liaise with support staff, third parties and senior management. The Service Delivery Manager or deputy will liaise with the customer of the service and shall ensure that resources are focussed and the situation is effectively managed in a way that minimises disruption to the user. 5.3 Incident Resolution The closure of an incident record will occur once the User has confirmed satisfactory resolution. In the event that a significant number (i.e., 3) of attempts have been made to contact the User without acknowledgement or response, the log will be closed. The user will then be contacted via to inform them of the closure of the call; 5.4 Incident Escalation Incident escalation is the process of communicating information on an Incident, or other live operational service issue for the purpose of raising its profile, and requesting senior management attention and/or intervention. If the customer is not happy with the progress of an incident they may; Contact the Service Desk requesting escalation of an incident or; Contact the Service Delivery Manager 5.5 Changes & Releases Issue Notices (IN) can be raised by any user, and may also be routinely raised by HSCIC SSD as the result of a support call. IN s are received by the Issue Review Board (IRB) process controlled by NHS Cancer Screening Programme, and are evaluated and prioritised for appropriate action. The appropriate action may often result in a Change Request to HSCIC SSD. If approved each Change Request is added to the HSCIC SSD work programme in accordance with the priority and agreed with the NHS Cancer Screening Programme. It may on occasions be necessary to implement urgent updates outside of the schedule to handle emergency change situations. This will be carried out at the discretion of HSCIC SSD in consultation with the customer as appropriate. The release of Changes to the IT Infrastructure shall be planned, tested, packaged, and implemented to a structured plan. Changes will be released on demand of the NHS Cancer Screening Programme. Emergency changes will be released immediately. Acceptance criteria for the release shall be agreed with NHS Cancer Screening Programme in advance. All planned releases of hardware and software change will include the following attributes: Page 16 of 28

17 Checking of live configuration by accessing the Configuration Management databases and definitive software library (as appropriate); Completion of Product Assurance processes, including provision of an environment on the operating system allowing end-to-end testing, where appropriate; Documenting of development activity progress and determination and recording of Issue Logs where appropriate; Creation of a test plan to include the environment required for testing, the process to verify releases are acceptable, and the success criteria; Determination of impact of the release on the live Service configuration, including affected Users ability to use the Service; Assessment of the potential resource requirements and financial commitments to undertake and complete the release; A release note detailing the changes will be produced and issued to users; and Updates to all documentation and on line help screens will be undertaken. 5.6 Capacity Planning and Management Capacity Planning and Management is concerned with ensuring the right resources (both physical and human) are in the right place, at the right time, to deliver the Service in support of this Agreement. The following specific housekeeping and routine maintenance activities will take place: Regular checking of database - weekly. Following checking, extend table space, storage allocation and roll-back segments; Writing of backup scripts; Daily checking of log files to verify backups are processed; Daily backup, with restoration to include restore up to the point of last cold backup; Following crash or corruption, restore and recover database from backups; The system will receive a remote geographic backup for the purposes of standby. The database will be synchronised for a warm standby. Ensure the training instances are available and prepared before the commencement of each formal course. 5.7 Security Principles and Administration HSCIC SSD BCSS Bureau Service team will have delegated responsibility for the administration and issuing of User identifiers and passwords for the service. A written request (Data User Certification) for access to the Application shall only be accepted if received from a valid NHS Caldicott Guardian. The BCSS Bureau Service team will verify the NHS Caldicott Guardian signature against current records and create a User ID and password using the Open Exeter system, with the required access rights and privileges. The Bureau will inform either the trainers who will issue the details of the User s ID and password at the successful completion of a course, or the user if no formal training is required. Page 17 of 28

18 Any disputes or issues relating to approval of access will be referred to NHS CSP national office. HSCIC SSD BCSS Bureau Service team will undertake six monthly reviews of current BCSS end users and will supply NHS CSP with a full list of users at each annual review in order to support a joint review of current users. Page 18 of 28

19 6 Service Cost and Charging Arrangements 6.1 Service Cost The cost of the Service provided by HSCIC SSD to the NHS Cancer Screening Programme for the financial year 2013/14 will be: 2,408,940 The cost elements for the service (financial year 2013/14) are identified as follows: Oracle, LINUX and UNIX Database Administration: 72,360; Helpdesk, 2 nd, 3 rd Line Support: 134,000; Bureau and Training Support (to meet upgrade programme): 29,480; Hardware maintenance and software licences: 24,440; OBIEE Infrastructure Leasing: 15,000 Leasing of proportion of live infrastructure: 19,200 Hosting of proportion of live infrastructure: 13,125 Development of Adverse Incident service: 10,000 Support of Adverse Incident service: 2,000 Development charges for contractor staff: 793,335 Development charges for permanent staff: 1,296,000 Total Value of SLA 2,408,940. The supplier will provide 2 wte for authentication, Population Index, Service Desk, 2 nd and 3 rd line support. It is expected that this level of resource can handle 250 incidents per month and 500 users in accordance with the targets defined in this agreement An increasing trend of service events or users that exceeds the 300 incidents or 500 users threshold will trigger a review of the resources assigned with the objective of preplanning additional resources with a necessary increase in charges or taking other action to reduce the call levels or users. 6.2 Infrastructure Costs The infrastructure for the OBIEE live and development environments will be leased from HSCIC SSD at an annual charge of 15,000 per annum. A proportion of the live infrastructure was replaced this year and has been procured on a 5 year leaseback arrangement with the NHS Cancer screening Programme this includes a dedicated BCSS letters server. The remaining live infrastructure will be replaced over coming years and will again be procured on a lease back arrangement with the NHS Cancer Screening Programme. These charges do not include any additional hosting charges that may occur when HSCIC SSD move to data centres located at Land Registry sites. If additional hosting charges are identified they will be dealt with in line with section 6.4 below. It is anticipated that an additional environment will be required when the KC Returns go live. This will incur an additional annual charge which would be charged on a prorate basis if introduced mid FY. If an additional environment is identified it will be dealt with in line with section 6.4 below. Page 19 of 28

20 6.3 Development Costs The BCSS system has a continual improvement process which requires changes to code and functionality these are usually raised as changes through section 5.5 but may, if significant, be specifically commissioned. Charges for this work will be raised on a quarterly basis with the NHS Cancer Screening Programme. 6.4 Additional Service Costs Where additional service costs are anticipated or likely to be incurred over-and-above the obligations and cost set out in 6.1, the following process will apply, either reactively or proactively, according to operational circumstances: NHS Cancer Screening Programme The nature of the service to be delivered is documented as a request in an appropriate format and submitted to the Service Delivery Manager, including: o Description of service required; o Reason for service requirement; o Timescales service required within; o Benefits of service to be provided; o Budgetary parameters and tolerance for service to be provided; o Whether service change is permanent or temporary. HSCIC SSD will acknowledge the request and confirm the delivery of the service, together with appropriate actual or estimated costs, and timescales. The Parties will decide the outcome of the request and implement/reject as and when appropriate. HSCIC SSD Identification The nature of the service to be delivered is documented as a request in an appropriate format by the Service Delivery Manager and submitted to the NHS Cancer Screening Programme, including: o IT Infrastructure configuration item affected; o Reason/Justification for service requirement; o Timescales service to be delivered within; o Benefits of service to be provided; o Estimated additional service cost; o Recommendations on permanent or temporary service change; o Timescales financial agreement required within. The NHS Cancer Screening Programme, will acknowledge the request and confirm satisfaction or otherwise with its outline, together with providing, or otherwise, the necessary financial authorisation. The Parties will decide the timetable for the request to be implemented/rejected as and when appropriate. Page 20 of 28

21 If the delivery of additional services affects or causes to affect the achievement of Performance Target(s) within this Agreement, prior identification or exclusion of the Target(s) will be discussed and agreed by the Parties. 6.5 Charging and Funding Process Invoices, with the exception of development resources, will be issued annually by HSCIC SSD. All charges quoted in this agreement are exclusive of Value Added Tax. Page 21 of 28

22 7 Meetings, Complaints & Administration 7.1 Service Management Review Meetings The Service Review Meeting will be the formal meeting to monitor, review and manage the performance of the Parties responsibilities within this Agreement. Service Management reviews will be held at least once a year. The principle aim of the meeting is to agree service scope, review performance and discuss any future business requirements and needs and agree an action plan going forward. 7.2 Complaints Complaint Circumstance Where a customer or user is not satisfied with the service or support provided by HSCIC SSD through the usual channels of the Service Desk or escalation to the responsible Service Delivery Manager he/she has the option of raising a formal complaint Complaint Format Complaints should be written and submitted as an or letter, outlining the situation and the basis of the complaint Complaint Recipient Complaints can be submitted by to the National Service Delivery Manager Norman.raphael@hscic.gov.uk Or by post to Norman Raphael National Service Delivery Manager Hexagon House Pynes Hill Exeter Devon EX2 5SE Complaint Acknowledgment An acknowledgement will be returned within 2 working days of receipt of the complaint using the same media as the original complaint (i.e. by or post) Complaint Resolution Systems and Service Delivery will seek to resolve the complaint to the satisfaction of the complainant within 20 working days of the receipt of the complaint. Page 22 of 28

23 7.2.6 Complaint Escalation If the complainant is unhappy with how the complaint has been dealt with, the complainant may escalate the issue to the HSCIC SSD Director, Sean Walsh at the above address or by to: 7.3 SLA Escalation and Arbitration The performance of this Agreement will ultimately be administered and governed by the authorised signatories. If it is necessary to escalate any aspect of either Party s obligations or performance under this Agreement, an escalation route is available as means of arbitration and to achieve a mutually acceptable solution or decision. The escalation route should only be used as a means to highlight or raise the profile of a particular service delivery issue, should all other opportunities fail. At the point where it is agreed between the signatories that a decision or solution to a service issue cannot be resolved within normal means, details of the issue should be escalated to their immediate line managers, dependent upon the nature and context of the issue. It will be the responsibility of the signatory to achieve and reach a satisfactory conclusion to the issue and communicate, as appropriate, to personnel involved in the delivery of this Service. 7.4 Termination of the Service If either party wishes to terminate (either early or planned) or transfer the service a minimum of 6 months notice shall be notified to the respective party. If either party wishes to discuss an early end of the service or transfer of the service, they will be required to raise this formally with the HSCIC SSD Service Delivery Manager for discussion at the service review or via an ad-hoc meeting if required earlier. 7.5 Changes to Agreement Changes to this Agreement can be proposed at any time, in writing, by either Party with a minimum of 1 month s notice. Major changes to this Agreement will be proposed and discussed at the Service Management review, with a decision made at the time on its approval or rejection. The content of proposed changes to this Agreement will be as follows: Submitter details, etc; General description of the change, and the area/section of the Agreement affected; Brief benefits of the change; Actions required to effect the change, together with roles and responsibilities; Impact of change on any historic data and information analyses, e.g., change of performance targets, and existing processes and procedures; and Page 23 of 28

24 The estimated (if possible) financial impact of the change, e.g., on Service cost, or effort to administer the Agreement. The process for identifying and agreeing additional Service costs is specified within section 6.3 (Additional Service Costs). Page 24 of 28

25 8 Appendix A Summary of Performance Targets The following table is a summary of all performance targets referenced within this Agreement. The period of performance measurement will be quarterly. ID Description Target 1 Total service availability during hours of service operation 98% 2 Period of downtime (Change window) Maximum of 5 working days per annum 3 Service Desk call response 90% within 20 seconds of connection 4 Incident response 98% within target timescale 5 Incident diagnosis and resolution 90% within target timescale 6 Acceptability of backup disks (following invocation and recovery where appropriate data is required) 99% when accessed 7 Daily or weekly backups of data 99% first time success 8 Restoration of full production service to failover infrastructure 9 User identification and Password administration 10 Production and publication of reports for meetings Within 4 hours 95% issued within 10 working days of receipt At least 5 working days prior to notified meetings Page 25 of 28

26 9 Appendix B HSCIC SSD Training Services Terms and Conditions Expressing interest in attending a training course Enquiries must be registered through HSCIC SSD Training Services via nhais.training@hscic.gov.uk. Failure to use this route may result in a delay in responding and dealing with the enquiry. If a suitable course is not readily available, details are entered onto a waiting list. Developing and promoting a programme of training events HSCIC SSD Training Services will maintain a register of interest on a waiting list, which will be regularly reviewed in order to target training events, considering both demand, and business priorities. Events are promoted either directly with contacts detailed on the waiting list, or through a targeted communication to the appropriate customer base for the course. Booking Procedure Courses must be booked by completing the HSCIC SSD Training Services booking form, which will be supplied as necessary. Unless otherwise stated, courses are subject to a maximum number of 8 delegates. Course Fees Fees will be confirmed on request, and include all courseware, refreshments during course breaks and a buffet lunch. For multiple bookings on the same event (i.e. the same date, same venue), discounts are available, hence it is beneficial to plan your training needs carefully in order to take advantage of the potential savings. Note1: for onsite courses HSCIC SSD Training Services is not responsible for arranging refreshments / buffet lunch, this is the responsibility of the hosting organisation. Note2: multiple booking discounts are only available for public courses at HSCIC SSD Training venues. Course Cancellation Courses require a minimum of 4 delegates to operate; otherwise delegates will be transferred to an alternative course. HSCIC SSD Training Services must be informed of cancellations via nhais.training@hscic.gov.uk, providing at least two weeks notification. A cancellation charge of 100% of the fee will be levied for all cancellations made two weeks or less before the event. No charge will be made for a change of delegate; however for changes made shortly before a course we cannot guarantee the delegate will receive the course documentation in time. Page 26 of 28

27 Accommodation Delegates attending courses are responsible for their own accommodation and travel arrangements and resulting costs. Delegates will be provided with a map and a list of accommodation known to us in the area (where the venue is an HSCIC SSD Training Services location). HSCIC SSD Training Services takes no responsibility for any accommodation booking made by delegates. Copyright The copyright of all course material and publicity material is invested in the Crown, except where copyright is held by another third party. Course Content Course content will be as stated in HSCIC SSD Training Services course outlines. Any changes will be as a result of a controlled change process separately defined in Service Level Agreements. For bespoke courses, content is agreed separately with the customer. Course Dates and Venues Course dates will be negotiated between HSCIC SSD Training Services and designated customer contacts, according to demand and business priority. HSCIC SSD Training Service events will operate Tuesday-Thursday, excluding bank holidays. Public courses Public courses are offered nationally, and are based on a standard course outline and content. Public courses HSCIC SSD Training Services venue Public courses will largely take place at HSCIC SSD Training Services venues, at Exeter, Redditch or Newcastle. HSCIC SSD Training Services considers it reasonable to expect delegates to travel to these venues, given their national coverage. Public courses Customer premises Public courses can be provided at alternative venues mutually agreed between the customer and HSCIC SSD Training Services; however certain conditions must be met: All efforts to agree a reasonable, viable solution to meet customer requirements at HSCIC SSD Training Services locations have been made by both parties, A minimum of 4 delegates are able to attend the course, Page 27 of 28

28 The hosting organisation arrange the venue and equipment according to conditions dictated by HSCIC SSD Training Services, accommodating up to 8 delegates and 2 trainers, The hosting organisation permits delegates from other organisations to attend, Dates are agreed with HSCIC SSD Training Services and are subject to trainer availability, Bespoke courses Bespoke courses can be arranged, which will be agreed and costed according to requirement. Data Protection Details of all client bookings are maintained on a computer system. These details will not be made available to any other organisations for any purposes. If a delegate wishes to see a copy of the details we hold about them these can be provided on request subject to verification of identity. Training Facilities HSCIC SSD Training Services courses provided at HSCIC venues are planned to ensure that adequate facilities are provided, the health and safety of both trainers and delegates is of paramount importance. For courses provided at alternative, non HSCIC venues, the organiser of the venue is responsible for providing adequate facilities. Should a trainer or facilitator feel that requirements are not met (for example, with regards to Health and Safety); HSCIC SSD Training Services reserves the right to terminate an event and recover costs. Page 28 of 28