1. Improved Support for Collaboration Collaboration Toolkit
Prepared for Capital Ambition by Private Public Ltd

2. How to use this toolkit
The Collaboration Toolkit represents the combined result of our work in defining and developing improvements to inter-agency collaboration.
The intention is that you can quickly get to the information and solutions you need without stepping through a complex and unwieldy report.
You can get started straight away by clicking on the Homepage. Each relevant section is hyperlinked – and further links should take you to the information you need.
For information on the scope of this Toolkit click here.
For any questions or to suggest updates, contact

3. Toolkit scope
Improving interactions between agencies that can be easily streamlined
Improving links between existing secure and contact directories, including Health and Local Government
Extending information sharing solutions to encompass other organisations, including Schools, Care Homes and other Third Party Providers
Deploying collaboration tools that save time and promote joint working
Between Local Authorities and within Local and Regional Partnerships
LAs
Health
Schools
3rd sector
Cent Gov
Police CJ
Primary focus
Secondary focus
Out of scope

4. Identifying key information flows
Breakdown of High Risk flows in example London Borough
Service area
Category
Type of info
Partners
Flows
Children & families
Looked after children, child protection, children’s social care
Child protection register, case information and assessments
Met police, PCT, YOT, schools, probation, voluntary sector, courts, housing
40%
Housing & Community care
Adult social care, housing, temp accomm and homeless assessment
Case information, personal data including rent deposits, security issues
Multi-agency teams inc police, probation, PCT, MHT, + housing associations, hostels, external OOH team, removals companies
Corporate services (e.g. Legal, finance)
HR data, adoptions and fostering
HR data, meeting agendas
External suppliers, Audit Commission, various inc parents
10%
Environment & culture
Health, safety and licensing
Licensee info and enforcement info
Police, central gov agencies

5. Collaboration Toolkit – Homepage
Home org
Partner organisations
Local Authority
Health
Central Gov
Police
Criminal Justice
Schools
Private / 3rd sector / citizens
Example interactions
Housing – temp acc
Hospital discharge
Benefits - DWP
Child protection
Youth Justice
Looked after children
Care homes
Case transfers (children)
Trading Standards
Form 78 – CTN report
Probation
CAF
External solicitors
Guidance and recommended solutions
General guidance - sharing sensitive information
Secure transfer across government networks
Secure transfer outside government networks
Sharing contacts & availability – London Shared Directory

6. LA - LA: Housing and temp accommodation
Description
Borough housing department wishes to send information to a neighbouring borough about the movement of a homeless household to new temporary accommodation
Example of current practice
Problems
Need to maintain a separate log-on in parallel with other secure services
Information usually needs to be extracted from local systems
Alternative
This remains a good option for security and simplicity but also worth looking at section here secure transfer across government networks
Information uploaded to NOTIFY website
Alert sent to relevant neighbouring borough contact
Contact is able to log on to NOTIFY and view information

7. LA - LA: Case transfers (children & families)
Description
Case transferred to a new authority and previous case worker wishes to send across assessment information
Example of current practice
Problems
Additional administration burden – printing and re-scanning
Risk that fax not collected by correct recipient
Need to maintain fax machines on site
Alternative
Look at alternative options for sending securely by electronic means - see secure transfer across government networks
File printed and faxed to secure location
Received by second authority
Scanned and uploaded to case management solution

8. LA - Health: Hospital discharge
Description
PCT initiates hospital discharge process by sending names and NHS numbers to the hospital discharge team at the local authority
Example of current practice
Problems
Attachment often sent insecurely by open
Fax often sent to unsecure room at LA
Admin overhead typing information into local systems
Alternative
Send names and attachments securely - see secure transfer across government networks
Persuade clinical staff to enter details online and send securely.
PCT sends names and NHS numbers as an attachment
Section 2 or 5 forms handwritten and sent as fax
LA team receives and enters into relevant system

9. LA - Health: Child protection plan
Description
Staff member in children’s services sends Child Protection Register to local hospital
Example of current practice
Problems
Admin overhead from duplicate entry and sending
Rarely any confirmation of receipt / Fax room may be insecure
If sent by secure can be difficult to find right recipient on appropriate shift
Alternative
London Child Protection Plan Search Solution currently being piloted in Haringey – contact
See also secure transfer across government networks
Consider increased use of shared / generic mailboxes for
Print out excel spreadsheet
Fax or courier to hospital
Manual input into local systems

10. LA – Central Gov: Benefits and DWP
Description
Revs and bens staff sending information to DWP
Example of current practice
Problems
Proliferation of non-standard secure transfer systems
Alternative
None proposed – DTA is currently mandated by DWP
Sent using DWP’s secure encryption server DTA (Data Transfer Appliance)
Sent using GCmail (service owned by DWP) or

11. LA – Central Gov: Trading Standards
Description
Trading standards staff in the local authority send info including personal details of company directors to HMRC – with reference to the Licensing and Consumer Credit Act
Example of current practice
Problems
Admin overhead – keeping extra mail account for single purpose
Only available to limited numbers of staff
Alternative
Using GCmail or other corporate solution - see secure transfer across government networks
Staff register for separate GSI addresses
Staff log on to GSI accounts and send information
Info received securely by HMRC

12. LA - Police: Child protection
Description
Social worker in children’s services needs to send case information to the police Child Abuse Investigation Team (SCD5)
Example of current practice
Problems
Not all users have CJSM accounts
Boroughs do not have Protective Marking Schema (as in Met)
Limited use of group mailboxes
Alternative
Wider use of CJSM or alternative secure solution - see secure transfer across government networks
Set up group mailboxes, Define rules on what can be sent – see communications and training
Social worker finds colleague with CJSM account
Info sent to named contact at Met using .pnn address
Info sent by fax or other means
Info received at Met or

13. LA - Police: Merlin form 78s
Description
Police system automatically sends form 78 Come to Notice reports to borough child protection teams
Example of current practice
Problems
Difficult to filter or prioritise mail – if using CJSM webmail
Danger of losing reports if borough moves to using GCmail
Police contacts unfamiliar with Government Connect
Alternative
Upgrade Merlin to enable sending to GCmail addresses
Different implementation of CJSM / GCmail to enable better mail management – see secure transfer across government networks
Refer contacts to partner specific material
Merlin generates fax or secure using CJSM
Borough staff receive via CJSM

14. LA – Criminal Justice: Youth Justice Board
Description
Borough Youth Offending Team (YOT) follows yellow envelope process to record assessment information about a young person and transfer it to the YJB’s secure accommodation system.
Example of current practice
Problems
Different implementations of CJSM
Admin involved in exporting and re-importing info in the correct format
Alternative
YJB rolling out ‘Connectivity’ to enable direct (secure) link from YOT case management systems
For more ad-hoc traffic the borough may make a corporate decision to move to GCmail from CJSM - see secure transfer across government networks
YOT exports info from local case management system
Sent as an attachment using CJSM
Received by YJB
Assessment info entered into local systems

15. LA – Criminal Justice: Probation
Description
Exchange of Child Protection Plans with probation and other agencies as part of the Multi-Agency Public Protection Arrangements (MAPPA)
Example of current practice
Problems
Not all users have CJSM accounts
Boroughs do not have Protective Marking Schema (e.g. Restricted marking as used in Criminal Justice)
Limited use of group mailboxes
Alternative
Recorded delivery or fax to a ‘secure location’
Different implementation options for CJSM / GCmail - see secure transfer across government networks
Social worker logs into CJSM or GCmail or asks colleague
Info sent to named contact in probation
Info sent by fax or other means
Info received at probation or

16. LA - Schools: Looked After Children
Description
A teacher wants to send a school report relating to a Looked after child to the child’s social worker
Example of current practice
Problems
Administration of accounts
Teacher needs to check webmail account
Unwieldy address (e.g.
Use of unsatisfactory alternatives such as encrypted zip files
Alternative
Use the LGfL service USO-FX to host files securely and send alerts to recipients. Will become universal from April See
See also secure transfer outside government networks
Teacher requests LA webmail account
Signs protocol and usage doc
LA helpdesk sets up account and adds users
Teacher sends report as attachment using LA webmail

17. LA – Schools: CAF Description
Practitioner exchanging information relating to a common assessment of a young person
Example of current practice
Problems
Time and administration in following secure fax or mail process
Lack of understanding of WinZip, not having required software
WinZip files may not be received successfully by borough staff
Alternative
See previous slide and the excellent guidance on CAF under Appendix 4 at:-
Practitioner faxes securely
Double sealed in envelope
Compressed using WinZip
Received / decrypted by recipient or or

18. LA - Private / 3rd Sector: Care homes
Description
Social worker in children’s services wants to place a specialist placement for a child and may need to communicate sensitive care assessment details to more than thirty care homes
Example of current practice
Problems
Time and workload issues in phoning all care providers
Difficult to fully anonymise complex care needs
Sending via WinZip may require new software or training for care home and may be blocked en route
Alternative
See secure transfer outside government networks
Social worker phones all care homes individually
Tries to anonymise data and send via standard
Care home receives and responds on availability or

19. LA – Private / 3rd Sector: Solicitors
Description
Contracts sent to/from corporate legal, or trading standards data relating to criminal proceedings
Example of current practice
Problems
Confidential information going in the clear
Secure webspaces require pre-registration of partner org
Extra admin dealing with hard copies
Alternative
Recorded delivery or fax to a ‘secure location’
See secure transfer outside government networks
Sent using standard
Uploaded to shared webspace (e.g. Huddle)
Send by recorded mail or courier
Solicitors receive or download or or

20. Summary of issues with current practice
Comms & Process
User awareness of options
Time wasted printing and retyping hard copy info
No Protective Marking Schema
Lack of team or group mailboxes
Difficult finding the right recipient No confirmation of receipt
Existing solutions
Maintaining fax machines
Multiple logons for multiple systems
High risk info sent in the clear
Limited access to existing secure systems
Unwieldy secure addresses
Inability to prioritise Files blocked or not received (encrypted zip)

21. Sharing sensitive information
The seventh principle of the Data Protection Act states:-
“Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data”
There are therefore two equally important aspects to sharing sensitive data:-.
Finding the right technical solution and ensuring it is fit for purpose for enabling:-
Secure transfer across government networks
Secure transfer outside government networks
Ensuring organisational awareness – via communications and training for staff and partner organisations

22. Communications and training: staff and partner organisations
Five step plan 1
Audit information flows 2
Confirm benefits with services & partners 5
Plan and conduct training 4
Source partner specific material 3
Draft or update corporate policy

23. Communications and training: staff and partner organisations
Five step plan (continued) 1
Audit information flows
Produce or update your list of high risk information flows 2
Check benefits with services & partners
Ensure all parties understand how training and increased info security will benefit customers 3
Draft or update corporate policy
See key content items on next page – and ensure it is updated for any new systems – e.g. Gcmail 4
Source partner specific material
For example local intranet or internet resources - e.g. 5
Plan and conduct training
Usually no more than an hour – and should also include partner orgs

24. Draft or update corporate policy
Communications and training: staff and partner organisations
3) Draft or update corporate policy and guidance
There are no common guidelines laid down but ICO advice recommends a security policy is in place to cover risk of loss of sensitive information. Also, documents such as the ‘Pan-London Information Sharing Principles of Good Practice and Proforma’ or the ‘North East London Information Sharing Protocol’ all emphasise the need to specify how sensitive information will be securely exchanged.
Having a corporate policy makes it much easier for practitioners to comply with local agreements. Key points covered by London boroughs within corporate guidance include:-
Draft or update corporate policy
Assess the risk if info goes astray
Mitigate risks as far as possible
Keep a record of what you send
Ask for receipt from recipient
Don’t send more info than you need
Only send encrypted docs
Don’t use fax if you can avoid it
Encrypt memory sticks or CDs
Treat non-secure mail as ‘post card’
Encrypt memory sticks or CDs
Consider using group mailboxes
In doubt? Consider risk of not sharing

25. Source partner specific material
Communications and training: staff and partner organisations
4) Source partner specific material
Some organisations make their own e-learning material available more widely – e.g. Schools at
You may also find it useful to pinpoint information for partner staff to reference. For example the Met’s internal guidance at:- :
Source partner specific material
Or the NHSmail
help pages which
explain which domains are secure

26. Secure transfer across government networks
Sharing sensitive information - Solutions Secure transfer across government networks
If available, the first choice should always be a jointly accessible online application or database (e.g. Case management tools, ContactPoint).
In order of preference the next best options for local authority staff looking to transfer info to health, central gov, police, criminal justice or other local authorities are:-
Secure transfer across government networks 1
GCmail
Clearly branded local government solution 2
CJSM
Low cost and wide usage but CJ focused 3
Partner system
Option to apply for accounts on partner systems – e.g. NHSmail, GSI
Note: for large files (>10Mb), you will need to follow local guidelines on encryption and use of memory sticks / DVD / CD
Click here for diagram showing government network connections

27. Sharing sensitive information - Solutions Secure transfer across government networks
Network diagram - GC
Diagram courtesy of Gov Connect

28. Click here for Implementation Options
Sharing sensitive information - Solutions Secure transfer across government networks
1) GCmail
This is the mail service provided by the Government Connect secure network for all local authorities in England. Similar to the GSI as used by central government, it allows local authority staff to have a secure address separate to their usual .
PROS
CONS
Clear local government identity
New service – limited take up at present and partners may not be familiar
Simple address
Depending on your system – there may be a licence charge for additional mailboxes
Support from central GC team
Must undergo training before use
Click here for Implementation Options

29. Click here for Implementation Options
Sharing sensitive information - Solutions Secure transfer across government networks
2) CJSM – Criminal Justice Secure
CJSM has been used by Youth Offending Teams for the last 3-4 years, and has recently seen take up increase in other service areas – especially child protection where the Metropolitan police recently introduced new guidelines on data security. Staff will either have an address or address depending on the local implementation.
PROS
CONS
Already in use and understood by many partners – especially police
Criminal Justice branding off putting if not using for related reason
Server solution can enable anyone in authority to be mailed by adding ‘cjsm.net’ to address
Additional users may incur a cost long term from OCJR
Can be difficult to understand concept of adding ‘cjsm.net’ to existing addresses.
Click here for Implementation Options

30. Sharing sensitive information - Solutions Secure transfer across government networks
3) Partner system – e.g. NHSmail, GSI
Several trading standards departments in local authorities have already set up GSI addresses to allow communication with central government departments, giving staff an address.
It is also possible for staff in social care to request NHSmail addresses – i.e. and log on using webmail.
PROS
CONS
Partners see you as if on same network
Not a corporate solution – different departments will be registered for different external mail services
No set up or support cost for local authority
Relies on support from central government or NHS teams
With NHSmail, no brand identity for individual orgs – all

31. GCmail implementation options
Sharing sensitive information - Solutions Secure transfer across government networks
1) GCmail – Implementation options
There are two fundamentally different ways in which authorities have implemented Gcmail – with major differences for the end user – meaning that service areas must be involved in the decision making process:-
Completely separate service to standard
The user logs onto a completely separate webmail service (usually Outlook based) in order to send and receive secure mail using their ‘gcsx.gov.uk’ address. This clearly differentiates secure mail and allays any fears about compliance with the GC Code of Connection. (e.g. LB Barking & Dagenham)
Integrated with standard
Implemented as a separate mailbox within your current Outlook installation. As implemented in Torbay, with the support of the central GC team, when you go to send a mail, a pop up box appears asking whether you want to send it Unclassified or Secure. If Secure then it is sent from your ‘.gcsx.gov.uk’ address over the GCSX network.
GCmail implementation options

32. CJSM implementation options
Sharing sensitive information - Solutions Secure transfer across government networks
2) CJSM – Implementation options
Every borough YOT has made a decision three years ago on how to implement CJSM, but there is still the option to change if circumstances require:-
Secure webmail service – separate from standard mail
Users log on to a secure internet based service and are blocked from sending messages to insecure recipients. Depending on local ICT support – Outlook on individual machines can be configured to check and send mail as a separate account. (e.g. Brent, Ealing)
Integrated with standard
If the authority has installed a CJSM server, then you will be able to send and receive secure mail from your usual inbox – providing you use the ‘cjsm.net’ extension on outgoing mail – and senders do the same with your address (e.g. Havering, Newham)
CJSM implementation options

33. Secure transfer outside government networks
Sharing sensitive information - Solutions Secure transfer outside government networks
After extensive discussion and research, we have concluded that there are two equally valid practical options for communication with external partners:- A
Third party encryption tools
Can encrypt both content and attachments – partners can read and reply via a web interface B
Secure web spaces or extranets
Allows files or attachments to be uploaded securely and alerts sent to recipients to log on and respond
Secure transfer outside government networks
Note: despite widespread usage, we have not included WinZip or similar tools in this list. For security reasons, encrypted zip files are often blocked at firewalls and therefore not guaranteed to reach recipients. Along with issues over version incompatibility, we cannot recommend this as a preferred tool.
Click here for a quick comparison of solutions vs key requirements

34. Third party email encryption tools
Sharing sensitive information – Requirements Secure transfer outside government networks
Third party encryption tools
Secure webspace
Secure Zip
Local install
Corporate install
Remote server
Remote Server
Local Server
Anyone can receive?
Yes No
Integrates with existing ?
Simple for senders and recipients?
Handles large files?
Possible to expand as pan-London solution?
Files transfer freely without security issue?
Easy to send to large numbers of recipients?
This is not intended to be a comprehensive list – but just to give an indication of some of the pros and cons of existing solutions.
Besides encrypted attachments – you could also include password protected spreadsheets and similar work arounds.
We’ve combined CJSM webmail and NHSmail in one column as both are currently available to local authorities and both currently use the internet as a transport mechanism with an Exchange server offsite.
We have excluded person to person secure (e.g. Hytec demo to the LC steering group) as we have not seen any current requirement for this level of secuirty. 34

35. Third party email encryption tools
Sharing sensitive information - Solutions Secure transfer outside government networks
Third party encryption tools
It is only practical to send an encrypted if the recipient organisation is able to read without any installing any additional local software. All of the products we have examined offer an web interface for external recipients to log on, and retrieve and reply to secure messages.
We have not recommended any specific products – but have identified two key different delivery models, with many variations underneath:-
Third party encryption tools A1
Local install
Installed on every machine – with sent from the desktop over internet via link from Outlook (Software as a Service model) A2
Corporate solution
Installed on corporate server – with no need to set up on individual machines

36. Email and file attachments
Sharing sensitive information - Solutions Secure transfer outside government networks
A1) Third party encryption tools: Local install
Provider
Secure web server
Local install
Org A
and file attachments
Sender
Org B
Corp data centre
Effective path
Recipient
Corp data centre

37. Sharing sensitive information - Solutions Secure transfer outside government networks
A1) Third party encryption tools: Local install
In a similar way to WinZip, you can install a piece of software on you local machine that allows you to encrypt local mail, and recipients to read your mail and any attachments by logging on to a secure website using their own chosen password. Products include: Voltage Secur , ZixCorp ZixMail, Websense Hosted
PROS
CONS
No need to phone up and give password as with secure zip files
Like WinZip, needs to be installed corporately or on individual user machines
Unlike Winzip – your attachment does not run the risk of being blocked for security
Offers the possibility of discount via pan- London procurement and branding
No need for local web server at borough – or any software at recipient side

38. Sharing sensitive information - Solutions Secure transfer outside government networks
A2) Third party encryption tools: Corporate solution
Provider
Secure web server
Org A
Sender
Corporate solution
Option 1
Org B
Locally hosted web server
Effective path
Recipient
Option 2
Corp data centre

39. Sharing sensitive information - Solutions Secure transfer outside government networks
A2) Third party encryption tools: Corporate solution
Borough installs solution on local server and is able to automatically route securely to particular recipients – for example by maintaining a local administered list of domains for preferred partners. Recipients log on to a server web server hosted remotely (Option 1) or on the borough premises (Option 2). Products include PGP Universal Gateway, ZixVPM, Voltage Secur Gateway, MessageLabs, Websense, IronMail
PROS
CONS
No need to phone up and give password as with secure zip files
Admin involved in maintaining rules for routing mail securely
No need for local install
Difficult to create shared London solution if hosted on individual servers
Invisible for borough end users
For thousands of users, usually works out cheaper than Local Install

40. Secure webspaces or extranets
Sharing sensitive information - Solutions Secure transfer outside government networks
B) Secure webspaces or extranets
Secure web server hosted by local authority (e.g. Sharepoint) or as a remote service (e.g. Huddle)
Secure webspaces or extranets
File up/down loaded securely
Alert that file is available
Org A
Org C
Org B

41. Sharing sensitive information - Solutions Secure transfer outside government networks
B) Secure webspaces or extranets
A potentially simple solution that has become more practical as it becomes easier to manage security. New tools allow users to allow particular users access to particular spaces, and send alerts when new files are uploaded. Increasingly used for collaboration between Central Government departments.
PROS
CONS
No need for any local installation – unless choosing to host your own webspace
Admin involved in managing user access
Able to use space to store calendars and other joint working information
Not a solution for encrypting info in day to day s – only valid for files
Straightforward to create jointly branded London solution
Already in use by many authorities

42. Sharing contacts and availability London Shared Directory
Solution
Problem
Professionals working in cross-sector partnerships have difficulty identifying the right contacts and arranging joint meetings in order to share information
London Shared Directory – a database hosted by NHS Tower Hamlets that enables free/busy and contact info to be shared on a daily basis over N3
Objective
Create low cost London-wide shared directory for health and local government that enables staff to share up-to-date calendar and contact information
Benefits
More efficient information sharing between health & local authority organisations and more time spent serving patients and residents

43. London Shared Directory – Reasons to join
Low cost of entry – two to three days work from external consultant and minimal local project management
Supported - until at least October 2010 – thanks to funding from Capital Ambition
Tried and trusted – five trusts and one local authority are already connected in the North East London Care Community
Unique solution – with no national or other regional alternative planned
Professionals need it – for existing users this has become an essential part of integrated working

44. London Shared Directory - FAQ
Who can join?
Health and local authorities including London Borough, PCTs, MHTs and acute trusts
NHS Tower Hamlets, LB Newham, Homerton NHS Trust, East London NHS Foundation Trust, NHS Newham Acute & PCT
Who is using it already?
The first step is to get in contact with the project team (see contact page). We can then advise further on the basic requirements and the process for connection.
We recommend joining at the same time as other local partner organisations so you can share calendar and contact info from day one.
How do I join?
This depends on local expertise. In practice the key costs will be any local project resource and the cost of external configuration, estimated at 2-3 days work. There is no ongoing charge and central support is in place until October 2010
How much does it cost?
There are plans for a project Phase 2 to enable further collaboration (e.g. Unified Comms or roaming profiles). We are not aware of any other plans for a similar shared directory on a regional or national basis
Are there plans for future collaboration?
Who is the service provider?
The current service provider is Eurodata Systems – they provide ongoing support and can connect new joiners – depending on local skills and knowledge

45. London Shared Directory - Contacts
Nick Tjaardstra, Private Public Ltd
Project Lead
Niall Canavan, NHS Tower Hamlets
Senior Responsible Owner, Board Member
Brian Dunleavy, Eurodata Systems
Lead Technical Contact