Guidance for GP practices when procuring or changing telephony providers

Purpose: This guidance helps GP practices identify the technical, assurance and network requirements they should confirm before procuring or changing telephony providers.

Supplier assurance

• The provider must hold appropriate assurance, such as ISO 27001 or Cyber Essentials Plus accreditation.
• Any supplier service or vendor requiring access from ICB-supported computers will be subject to Technical Assessment Group (TAG) review.

Network requirements

• The provider must supply and support a separate dedicated internet connection for physical handsets, including any required firewall and access switches.
• Dedicated wall ports must be provided for physical handsets. Port splitters using existing network ports are not acceptable.

Device access rules

• Physical handsets must not connect to the ICB-provided network. The ICB will deploy controls to deny access for unauthorised devices.
• Softphones installed on ICB-supported computers may be granted internet access to the supplier service, subject to TAG review.

Important note on costs and network assumptions

Practices should not select a provider solely on the basis of headline cost. Some providers may assume they can use the ICB IT network, which is not permitted. Costs may increase significantly if dedicated services are later required to support the telephony solution.

Further advice

Practices should contact their local GP IT service desk before progressing procurement or supplier engagement if they need advice on these requirements.