Frequently asked questions
PERL FAQs
Who is the data controller for the videos?
BIOS
Does BIOS have a data processing agreement with Vimeo or is there a standard one you could share?
BIOS do not have a data processing agreement in place with Vimeo.
Is there a data sharing agreement in place between Trusts and BIOS?
BIOS have produced a sharing agreement which can be shared with each of the trusts for approval.
Is there a regular penetration test for security? Do you have evidence of this occurring?
Yes, evidence can be provided of the last penetration test that was performed on 23/12/2022.
Would the students be using personal devices to access the videos?
Yes. Most live-streamed patient assessments will be projected directly into a university lecture theatre and will be controlled by the lecturer in charge. Students will have access to the PERL from their personal device and there may be instances where students are allowed to join a live-streamed session from their own device; however, there have been no breaches to date, and the following mitigations are in place to ensure risk is kept to a minimum:
- Students receive data security training from the university.
- Students complete the online data security assessment and must pass this before they can attend clinical placements or gain personal access to the PERL or live-streamed sessions.
- Students receive a standard protocol on how they should conduct themselves during a live-streamed session and whilst accessing the PERL.
- Students must sign a disclaimer to acknowledge the terms and conditions of this access.
- Universities sign a disclaimer to confirm they will manage and maintain student access to live-streamed sessions and the PERL.
- Before accessing the PERL a disclaimer is presented to the end user to remind them of the terms and conditions they have signed up to.
BIOS Portal password – what is the minimum character requirement for members to access the BIOS portal?
10 Characters and the password will be reset yearly.
Do you have a Cyber essentials certificate?
No, we do not have this.
Do BIOS store data on servers or a cloud?
The servers are with WPEngine. The physical servers are their’s, as this is a cloud service.
Is data within PERL encrypted to the NHS Standards at rest and in transit minimum of 256bit?
Yes, 256bit is the SSL standard for use on the PERL.
Is the PERL encrypted?
Yes, the site has SSL.
Are PERL users able to download and share videos?
No, videos on PERL can only be streamed, they cannot be downloaded. Also, a disclaimer is presented to the end user every time they access the PERL to remind them of the terms and conditions of use.
How is patient consent managed if the videos are pseudonymised?
Patient consent is maintained by the trust, however in our pseudonymised process, details of the time, date, hospital, clinical tutor name is recorded and a VideoID is generated to replace the filename of the patient video. This videoID is noted on the printed consent documentation maintained by the trust and a copy of the videoID and consent is provided to the patient. This will enable the patient to withdraw their consent at any point of the process. If the VideoId is not known by the patient, then BIOS will contact the trust to help them identify the patient’s video.
The BIOS website has a dedicated form set up for patients to withdraw their consent.
HoloLens
Does the HoloLens2 have built in encryption?
Yes, HoloLens 2 enables BitLocker Device Encryption (BDE) by default to protect data from any unauthorised physical access to the device. Always evolving to meet the needs of the future, Microsoft continues to invest and enhance this technology.
BDE is a data protection feature that employs AES-XTS-256 encryption on all volumes in the state-separated layout of the device. BDE provides device-level encryption in a state-separated layout. BitLocker Device Encryption is enabled automatically on operating system and fixed data volumes and cannot be turned off, even by IT administrators, so that the device is always protected.
Can the videos be encrypted on the HoloLens?
Yes, HoloLens 2 enables Bitlocker Device Encryption (BDE) by default to protect data from any unauthorized physical access to the device. Always evolving to meet the needs of the future, Microsoft continues to invest and enhance this technology.
For further information please see Encryption and Data Protection | Microsoft Docs
How easily can the HoloLens2 be cleaned?
Can the HoloLens be worn under a visor?
Yes, the HoloLens has been used successfully under a visor.
What account should the Hololens2 be set up with?
The Hololens2 can be set up with a personal Microsoft account. This provides the security features of biometric (iris), PIN, and password authentication. It also enables BitLocker Device Encryption (BDE) to protect the device from unauthorised access. The department can create a free Microsoft account here. BIOS recommends setting up a generic account for shared access by multiple clinical tutors. Once set up, BIOS should be informed of the email address to procure a 365 license.
Alternatively, your local IT department may require that the Hololens be set up on the trust’s Microsoft Azure account. This process could take longer, depending on IT’s capacity to complete the setup. Additionally, BIOS will need to coordinate with IT to arrange funding for the 365 licenses on the trust-managed account, enabling live streaming via Microsoft Teams.
Below are quotes taken from Microsoft. The highest level of security is for the Hololens2 to be setup on the trusts Microsoft Platform, see option 1 below. The device would then inherit the local trusts security requirements of the environment in which it operates:
| Identity type | Accounts per device | Authentication options |
|---|---|---|
| Microsoft Entra ID | 63 |
|
| Microsoft Account (MSA) | 1 |
|
| Local account | 1 |
|
| Shared Microsoft Entra ID | 1 |
|
Can HoloLens data be deleted if the device were to break?
By default, the HoloLens 2 devices are encrypted so if the device breaks and the hard drive was inaccessible then the data is also inaccessible. Repairing the device would likely involve wiping the data and re-building the device from factory default with no data on it and with the repair organisation (Microsoft) never having any access to that data.
Additionally, if a device were stolen it would be the same scenario. The device would be inaccessible and so would any data on the device.
Who retains ownership of the HoloLens?
The HoloLens is provided as an indefinite loan to the Trust, under the condition that it is regularly used. A minimum level of usage is expected, such as offering frequent recorded or live video consultations during term time.
Who is responsible for repairing the HoloLens if it is accidentally damaged?
Local IT support should be contacted initially. If the device cannot be repaired locally, BIOS will seek repairs through its insurance coverage.
Who is responsible if the HoloLens is lost or stolen?
The Trust must immediately report any lost or stolen devices to BIOS, who will then raise the incident with their insurance provider.
Who handles software issues with the HoloLens?
Software issues should first be addressed by Local IT (e.g., resetting the device).
What is considered a secure location for storing the HoloLens?
The device must be stored behind two locked doors – such as in a locked filing cabinet within a locked room.
Who monitors the use of the HoloLens?
BIOS will monitor the number of uploads to the Placement Expansion Resource Area (PERL), while universities will track the number of live-streamed sessions offered regularly.
What happens if the HoloLens is not used for an extended period?
If there is a demand for the HoloLens from another Trust and the current device has not been used for 3 months (with consideration of any extenuating circumstances), BIOS reserves the right to recall the device for reassignment. Delivery costs for reassignment will be covered by BIOS.
Under a RemoteAssist licence, where will videos be stored?
If your clinical leads are logging into RemoteAssist with their nhs.net accounts, then your data and access is under full control of NHS Digital. So, in the case you outlined it would be stored in the nhs.net Microsoft Stream service (just like Teams meeting recordings when you are logged into your nhs.net accounts are)
It is worth mentioning that NHSD are still working on their support for allowing organisations to connect HoloLens devices into the Central NHS tenant.