New government telecare guidance: assessing connectivity resilience

The Department of Health and Social Care has published four linked pieces of telecare guidance: commissioning guidelines for personal alarms, grouped living alarm devices and Alarm Receiving Centres, alongside guidance for housing providers managing the digital switchover. 

The publications are intended to help commissioners and procurement teams specify digital telecare services that are safe, resilient and reliable. They cover digital standards and interoperability, connectivity and resilience, service management, supplier assurance, cyber security, data protection and access to operational information. The commissioning requirements are non-statutory and can be adapted to the circumstances of each service. 

https://www.gov.uk/government/collections/telecare-commissioning-guidelines 

The commissioning guidelines also identify the TSA’s Quality Standards Framework as an example of an existing assurance scheme that commissioners can consider as part of their wider procurement and assurance arrangements.  

The technical requirements should therefore be considered alongside established measures covering service quality, safety, governance and operational performance. This combined approach reflects the changing role of connectivity in digital telecare. It is no longer simply the means of connecting an alarm device, but part of the end-to-end service that carries an alarm from a person’s home to the organisation responsible for responding. 

Assessing that service requires commissioners to look beyond the number of available networks. They also need to understand how independent the connectivity paths are, how each path is secured, what happens when one fails and whether the complete route from the device to the Alarm Receiving Centre can be monitored and supported. 

The guidance asks suppliers to explain how alarm devices will achieve reliable connectivity across the mobile networks available in the commissioner’s area. This makes the number of accessible networks relevant, but commissioners should also examine the infrastructure and service dependencies behind them. 

A conventional roaming SIM can increase the mobile networks available to a device and improve the likelihood of finding usable radio coverage at a particular location. However, the availability of several radio networks does not by itself demonstrate independence across the wider service. 

Access to multiple mobile networks improves the opportunity to obtain usable radio coverage. DualCore adds resilience through an alternative connectivity profile and mobile-core path, allowing the service to switch when the active connection becomes unavailable. Commissioners should consider network availability, switching behaviour and managed routing together when assessing the proposed service. 

Commissioners should therefore ask how many networks a device can access, but their assessment should also go further: 

• How do the alternative connections support continuity if the active connection becomes unavailable?  
• Do the primary and alternative paths use independent connectivity profiles and mobile cores? 
• What detects a loss of service? 
• Where is the decision to switch made? 
• Does switching happen automatically? 
• Is the alternative path protected and monitored to the same standard? 
• How is service restored to the preferred path after the fault has cleared? 

The central principle is straightforward: 

Access to multiple mobile networks supports radio availability. An alternative mobile-core path, reliable switching and managed routing provide additional resilience when the active connection becomes unavailable. 

There is no single connectivity architecture that will be appropriate for every personal alarm, grouped scheme or telecare estate. Device design, radio coverage, broadband availability, power arrangements, ARC capability and the consequences of failure all need to be considered. 

The guidance identifies several options for improving connectivity resilience, including fixed broadband with mobile backup, two SIMs using different mobile network operators, eSIM and resilient SIM technologies such as rSIM. CSL recommends assessing each option against the failures it is intended to address, the independence of its alternative routes and the way switching is initiated and managed.

CSL supports DualCore® resilience through both rSIM® and compatible DualSIM solutions. Both approaches provide separately provisioned connectivity profiles with alternative mobile-core paths, but differ in where connectivity is monitored and switching is managed.

With DualSIM, two separately provisioned SIM connections are installed in a compatible telecare device. The device monitors connectivity and manages switching to the alternative connection when the defined failure conditions are detected.

With rSIM, two independently provisioned connectivity profiles are provided on a single SIM. Each profile can access multiple radio networks, while SIM-resident logic monitors connectivity and can switch autonomously to the alternative profile when a configured failure condition is detected. This switching does not depend on the alarm device or a remote management platform detecting the failure and initiating the change.

For either solution, commissioners should assess the radio networks available through each connection, the independence of the connectivity profiles and mobile-core paths, the switching behaviour, managed routing, security controls and operational information provided. The appropriate approach will depend on the device design, deployment environment and service requirements.

The guidance identifies eSIM as a potential resilience option. eSIM supports the remote provisioning and management of connectivity profiles. Its contribution to resilience depends on the profiles available, the switching mechanism and the infrastructure supporting each connection. 

Where an implementation uses two single-network profiles, commissioners should assess whether access to only two radio networks provides sufficient availability for the service and deployment environment. They should also consider the resilience of the wider connectivity architecture, including the number of radio networks available through each profile, the independence of the underlying mobile-core paths and the switching mechanism between them. Commissioners should establish how a profile change is triggered, whether switching depends on a reachable management platform and how quickly the alternative profile can restore service.

eSIM can support planned connectivity changes throughout the device lifecycle. For recovery during a live connectivity failure, however, the proposed implementation should demonstrate that an available alternative profile can be activated within the service’s required recovery time.

Where supported by the alarm device and ARC, combining fixed broadband and cellular connectivity provides diversity across access technologies. Commissioners should assess both routes as part of the complete service design, including any shared upstream infrastructure. The fixed broadband connection, associated router and local network should be securely configured and supported by appropriate access controls and power backup. Both routes should maintain the agreed endpoint security, be monitored where supported and be tested for failover and recovery. 

For suitable grouped living and site-based systems, CSL can support an architecture in which fixed broadband provides the primary connection and managed cellular connectivity provides an alternative route to the monitoring centre. Both paths are secured via a private route to the ARC. The precise architecture, protocol support, switching behaviour and compatibility with the selected ARC should be confirmed for each deployment.

Standards-based endpoint security and managed connectivity perform complementary roles. TLS protects IP signalling and SRTP protects IP voice between compatible alarm devices and Alarm Receiving Centres. Private APN and VPN connectivity can add a managed data transport layer, supporting controlled routing and access to ARC services. 

The proposed architecture should support these endpoint protections across fixed and mobile data connections, alongside compatible device provisioning and migration between ARCs. Any separate voice arrangements used for backup or backwards compatibility should be clearly identified. 

Effective connection management requires visibility of where a fault has occurred. 

An alarm may have radio signal but no working route through the mobile core. A device may be connected while passing no meaningful data. Following failover, operational visibility helps providers understand why the alternative path is active and manage restoration of the preferred connection. 

For commissioners, resilience should therefore include access to information that can establish: 

• whether the alarm device is connected; 
• which connectivity profile or path is active; 
• whether traffic is passing successfully across the monitored connection; 
• when switching occurred; 
• why a path became unavailable, where that information can be determined; 
• whether the alternative path operated as intended; 
• whether the ARC received the communication, where confirmation is available from the alarm or ARC; 
• and whether the preferred service has subsequently been restored. 

This end-to-end visibility supports troubleshooting, reduces the risk of connectivity faults being misdiagnosed as device failures and gives providers evidence that the designed resilience is functioning in service. 

CSL combines managed connectivity with monitoring and fault investigation across the connectivity service. This helps providers identify which route is active, understand switching events and distinguish connectivity issues from faults elsewhere in the alarm service. 

The scope of monitoring should be defined clearly for each deployment. Commissioners should establish which parts of the path CSL can observe, which information comes from the alarm device or ARC, how faults are reported and what data can be exported for service management and assurance. 

The new guidance provides a valuable foundation. CSL recommends building on it by asking suppliers to evidence the complete resilience and security model behind their service.

1. Require suppliers to distinguish network access from path resilience

Bidders should identify every mobile network, SIM or connectivity profile, connectivity provider and mobile core used to deliver the service.  They should explain how the proposed architecture maintains connectivity during the failure scenarios covered by the service design. 

Access to several radio networks must not, by itself, be presented as evidence of several independent connectivity paths. 

2. Require bidders to identify the failures their solution addresses

Bidders should describe the expected service behaviour following: 

• loss of local radio coverage; 
• failure of the active mobile core; 
• loss of a connectivity or roaming platform; 
• loss of the primary fixed connection; 
• failure of the alarm device or local power; 
• and loss of the destination ARC or receiving service. 

The response should explain which failures trigger switching, how connectivity is restored and which service continuity measures are provided by the device, connectivity service or ARC. 

3. Require a documented switching and recovery process

Bidders should state which component monitors the connection, the conditions that trigger switching and whether the process depends on the device, SIM, router, network or an external platform. 

The response should explain how the service confirms that the alternative path is working and how it returns to the preferred route once the original service has been restored. 

4. Apply the agreed security controls to every route

Bidders should explain how security is maintained across both primary and alternative connections, including the endpoint protection, authentication, routing and access controls applied to each path. The response should also show how standards-based security and managed connectivity work together to support interoperability, controlled access to ARC services and operational visibility. 

5. Require evidence of controlled access to the ARC

Bidders should explain how their proposed architecture limits unnecessary public internet exposure, how connections to ARC services are authenticated and which destinations alarm devices are permitted to reach. 

The response should cover remote access, network segmentation and the controls applied to both primary and alternative connectivity paths.  These controls should complement the required endpoint encryption of IP signalling and IP voice, with any separate backup or backwards-compatible voice arrangements clearly identified. 

6. Specify the operational data and fault reporting required

Bidders should describe how availability is measured across the service, including the route between the alarm and ARC. They should state how connectivity faults and switching events are identified, reported and escalated. 

Commissioners should require access to exportable connectivity and performance data sufficient to support fault diagnosis, service reporting and restoration. Signal strength alone should not be treated as evidence that the complete service is available. 

7. Require testing of failover and recovery

Bidders should provide a test plan covering loss of the primary connection, switching to the alternative path and restoration of the preferred service. 

Testing should confirm that the alarm reaches the intended ARC, the agreed security controls remain in place, switching events are visible and the service returns to its expected operating state. 

The specification should define when these tests will be repeated during the contract and what evidence will be provided to the commissioner. 

Connectivity resilience should not be assessed in isolation from the quality and governance of the wider telecare service. The DHSC guidance identifies TSA’s Quality Standards Framework as one example of an assurance scheme that commissioners can consider as part of a broader procurement and assurance approach. 

CSL recommends asking bidders to support the technical design with evidence of service management, business continuity, testing, fault escalation and continuous improvement. This helps commissioners assess how the proposed architecture will be operated and assured in live service. 

Taken together, the government guidance gives commissioners a framework for assessing digital telecare connectivity, interoperability, supplier management, security and operational information. CSL recommends using that framework to examine the complete route from the alarm device to the ARC, including the available networks, underlying infrastructure, switching mechanism, security controls and operational data. 

Access to several mobile networks provides an important foundation for service availability. Greater resilience comes from combining that access with an alternative connectivity path, reliable switching, consistent security controls and the visibility needed to monitor, support and restore the service. 

CSL supports resilient telecare connectivity through rSIM® and compatible DualSIM solutions. rSIM uses two separately provisioned connectivity profiles on a single SIM, designed to provide alternative mobile-core paths, with SIM-resident monitoring and autonomous switching when a configured failure condition is detected. With DualSIM, the compatible device monitors and manages two separately provisioned SIM connections with independent core networks.

Within CSL’s managed connectivity architecture, private APN and VPN connectivity can add a protected, managed data transport layer. This complements the TLS protection of IP signalling and SRTP protection of IP voice implemented by compatible alarm devices and Alarm Receiving Centres. The proposed design should support interoperability, controlled ARC access, appropriate routing and operational visibility, with any separate voice arrangements clearly identified. 

The appropriate architecture will depend on the device, deployment environment and end-to-end risk assessment.  

The objective should remain the same in every case: 

Give every critical alarm a secure, monitored route to the people responsible for responding, with an alternative path designed around the relevant service risks. 

Speak to CSL about resilient managed connectivity for personal alarms, grouped living schemes and wider digital telecare services, including rSIM® and CSL DualSIM®.