Supporting the transition of IT services at seven prisons, creating better functionality and security
Spectrum Community Health CIC is a social enterprise that delivers a range of community and offender healthcare services on behalf of the NHS, local authority public health services and other partners predominantly in the North of England.
It is a Community Interest Company - a form of social enterprise - and a not-for profit organisation with a head count of approximately 900. Any financial surpluses are ploughed back into community initiatives and projects that improve public health and wellbeing.
It provides health support services to 17 secure environments, 3 sexual health services and a number of community substance misuse health services across the North of England.
Our most recent work with Spectrum has seen us successfully complete two large scale projects:
- Supporting the transition of IT services at seven prisons in the North East after Spectrum won the management contract to run them;
- Migrating Spectrum’s on-premise IT infrastructure to a cloud-based Microsoft Office 365 solution providing improved functionality, security and integration across approximately 1,200 staff.
Taking agility to a whole new level
Spectrum was already providing pharmacy and GP services at seven prison sites in the North East of England as a sub contractor when it was awarded the full management contract in autumn 2019 following a successful tender process.
The go-live date for the new contract was April 1st 2020, the date on which we planned to begin our project on site. However, what first appeared to be a relatively straightforward project was soon to be derailed by the Covid-19 Pandemic.
The government’s first lockdown was announced on 23rd March 2020 – just eight days before we were due to start work on site.
Although Spectrum did take control of the prisons’ services on 1st April, our team did not gain access to any of the premises until June of that year.
Plan A became plan B, and then plan C. We had to be flexible – the aim was to keep everyone on seven sites working as normal without any downtime, which we successfully achieved by remotely taking over management of the network equipment and devices, beginning with the removal of the exisiting anti-virus solution and deploying a version managed by THIS.
We also deployed tools to enable us to successfully manage and support these servers moving forward until we could physically attend the sites.
We remotely connected to each site’s independent active directory environment, carrying out the required changes to allow us to manage and support each site independently - from being able to create and remove user accounts, setting up printers and implementing group policies to manage new desktop environments on all computers.
Our ability to remotely take control of the computer environment enabled Spectrum to concentrate on managing the continuity of patient care within the prisons, as the project also included all on-site healthcare staff being transferred to new employers in Spectrum. The ability to keep working as normal on their computers was vital to this.
We had changed tact many times but we had overcome the most unforeseen of obstacles.
Scope, design, build and deliver
Once we had access to the prison sites, we began by scoping the locations to see what was required – establishing information such as how how many physical devices were to be transferred, how many mailboxes, firewalls, security, communications, data governance and access, to name but a few elements.
Accomplishing this in a prison is more challenging than most locations. Gaining entry in the first place can be time-consuming, and we had to be escorted by prison officers – especially when moving among the prison population – as we scoped the many different offices and computers.
Among the considerations within this project was the need to retain recently-installed hardware that Spectrum had inherited, when we would often install new machines as part of the process. Other risks, challenges and contingencies we overcame include:
- Arranging for new equipment to be delivered and be available when required;
- The ability to re-image devices and the associated equipment to allow it to pass through security;
- Planning for the possibility of a prison having to go into lockdown for a security issue, with contingency plans to allow for this;
- Agreeing downtime with the healthcare teams while the network configuration was changed.
Once the new IT architecture and environment had been agreed and with access to the sites, we could begin the transition to a full-blown, THIS-supported infrastructure. This included the transition to Microsoft Office 365 where the users could access their new accounts and the new suite of applications that came with it.
Microsoft Office 365 – improved security and integration
Our role was to work with our stakeholders to transition the sites from Microsoft Office 2010 – within which users were restricted to Outlook, Word and Excel etc - to Microsoft Office 365 and its suite of applications that offer vastly improved functionality.
As you can see from the graphic below, Microsoft Office 365 includes applications such as Microsoft Teams, Sharepoint, Power BI and One Drive that enable greater collaborative working – exactly what Spectrum wanted.
Spectrum were also seeking the benefits of uprading from the on-premise Office 2010 – which was no longer being supported by Microsoft - to the cloud-based Office 365 to take advantage of the cloud’s greater flexibility (data storage can be scaled up and down) and easier access, removing the need to provide service support and security for the on-premise Office 2010 server.
Spectrum wanted to migrate its staff from an on-premise based email system – where the physical attributes of a dedicated IT infrastructure are based on the premises – to a cloud-based system –- using Office 365.
We were already managing and hosting the on-premise email solution together with other basic Office applications, which did not offer the security, nor the integration, required by Spectrum. Introducing the full Office 365 suite of applications provided Spectrum with the solution they were looking for.
The aim was to deliver the new functionality of Office 365 to users across multiple locations without them experiencing any downtime or service disruption – a project we had previously delivered on a similar scale for our host Trust, Calderdale and Huddersfield NHS Foundation Trust (CHFT).
Whilst Spectrum’s project demanded higher levels of security and spanned a larger geographical area than the CHFT project, our processes and expertise combined with thorough understanding of the client’s organisation, enabled us to scale up and ensure successful completion of the project.
Creating tailor-made security
To ensure Spectrum’s security needs were fully met, our subject matter experts (SMEs) worked with users and stakeholders to explore and tailor the best solutions, such as the most efficient way of lifting data off the on-premise system to the cloud, and how new security levels would work in practice.
The bespoke security solution was a secure, two-factor authentication password process with automated recognition of secure logins from a trusted location which is physically connected to the secure network environment.
Outside of this network environment, users must go through a standard two-factor authentication login, restricted to the UK, with the only exceptions being Spectrum authorised users, who might need to access emails abroad.
As staff based at prison sites aren’t permitted to carry their mobile phone to receive a passcode for two-factor authentication, we ensured each prison site was set to a trusted IP range, removing the need to receive a pass code.
The email transfer process was done by a managed out-of-hours migration of agreed mailboxes from the on-premise infrastructure to the Microsoft Office 365 cloud environment. This was completed in agreement with Spectrum’s working requirements and timescales for each part of the organsiation. A troubleshooting session followed each migration to rectify any issues that had been discovered before moving on to the next phase.
A solution was also required for prison sub-contractors, such as some healthcare services, whose staff needed to use their own versions of Office 365 whilst logged onto one of Spectrum’s devices. We worked closely with these parties to understand how their versions were licenced and to ensure Spectrum’s new system would accommodate them while maintaining the client’s high level of security required.
This particular element of the project is still being rolled out. However, it has provided invaluable lessons for future projects, particularly migrations in GP practices where there are duplicate organisations working at multiple sites.
What we achieved
- The transfer of all email accounts and systems in such a way Spectrum’s users didn’t experience any outages or downtime. This was done in a transitional, agreed way with as little impact on end-users as possible.
- Our experience acquired through previous on-premise to Office 365 migrations enabled us to tailor the project to the client’s specifications, meeting their needs in the process. Our long-running partnership with Spectrum meant we had extensive knowedlege of the organisation and how it worked.
- We worked through configurations and process mapping with Spectrum to support the organisation from a security perspective.
We have a three-year rolling contract with Spectrum that will continue for at least another three years thanks to the strong and evolving partnership we have forged with them. Our knowledge stretches back to Spectrum’s inception 10 years ago – we know how they work and what they are trying to achieve.
THIS and Spectrum work in a partnership methodology, which benefits both parties in that we understand their specific requirements and are able to provide advice and assurance that any challenge will be overcome.
Spectrum benefit from being able to rely on THIS to support their ever-changing, supported environment, and be able to react quickly to new developments and changes as and when they are required.
Spectrum’s relationship with THIS has always been a very positive one. Our growth has been significanct over our 10 year history and the “can-do” and proactive attitude adopted by THIS has contributed significantly to our successful delivery of services. We work in some of the most challenging environmemts with complex security considerations and the flexibility to support and develop workable solutions has always been provided by the experienced THIS teams.
Director of Finance Spectrum Community Health CIC