Internet First policy and guidance

Internet First policy and guidance
NHS Digital updated 24 May 2019

• Internet First means that externally accessible health and social care digital services must be securely accessible over the public internet by default.
• This document will help health and social care organisations make their digital services accessible over the internet. It will help describe how to make them secure, scalable and where possible consistent.

The Internet First principles

1. Design and develop digital services to be securely accessible over the internet by default.
2. Where a digital service can be migrated or performed by a shared service presented over the internet, the application should be retired, and the functionality provided by the shared service.
3. Internet facing digital services should be designed to be shared and re-used.  They should avoid bespoke features that constrain re-use.
4. Existing digital services should be developed to be accessible over the internet at the earliest opportunity.  Near-term opportunities to achieve this within planned development lifecycles should be exploited to achieve early delivery over the internet.
5. Transforming digital services to be presented over the internet must not introduce additional risk to live services.
6. Data sensitivity analysis must be carried out prior to exposing digital services to the internet.
7. Investments in new and existing digital services must support universal access for consumers.
8. Users must be kept informed to ensure business continuity is maintained during migration to the internet.  In particular, application sub-component dependencies should be managed carefully where systems are integrated.
9. Ensure users are sufficiently prepared to access the digital services they need over the internet (for example have sufficient bandwidth, resilience and quality of service).