In short
SASE for the NHS sits alongside the Health and Social Care Network (HSCN), not in place of it. NHS organisations buy HSCN connectivity from compliant HSCN suppliers, while SASE protects staff, internet and SaaS traffic, and SD-WAN manages a site's links. NHS England's internet first policy asks organisations to consider making digital services internet accessible, which is where SASE helps.
Get a quote for SASE for the NHS
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
How SASE fits with HSCN
The Health and Social Care Network (HSCN) (opens in a new tab) is the data network for health and care organisations in England, which replaced N3. NHS England describes it as providing "a reliable, efficient and flexible way for health and care organisations to access and exchange electronic information". According to its connection governance (opens in a new tab) page, HSCN is available to any organisation whose purpose in connecting is the delivery, facilitation or support of health or social care in England, and every organisation that uses it signs one HSCN Connection Agreement, however many sites it has.
SASE does a different job. HSCN connects you to national applications and to other health and care organisations; SASE applies security policy to people and traffic wherever they are:
| Need | HSCN | SASE | SD-WAN |
|---|---|---|---|
| Reach national NHS applications and other HSCN organisations | Yes, its core purpose | Can route private application traffic, but HSCN is the network for it | Steers traffic onto the HSCN link |
| Internet access from a site | Public (internet) and private services can come over a single HSCN connection, with the NHS Secure Boundary internet filtering service | Inspects internet and SaaS traffic that breaks out locally or from staff devices | Chooses which link carries internet traffic |
| Staff working off site | Not its role | ZTNA and web security on the device or in the cloud | Not its role |
| Several links at a site | Supplied by your HSCN supplier | Not its role | Balances and fails over between links by application |
The HSCN facts above are from NHS England's HSCN pages (opens in a new tab), checked 9 November 2026. For the zero trust side, including patient data and clinical systems, see ztna.org.uk's zero trust for healthcare (opens in a new tab) guide.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Internet first and why it matters for SASE
NHS England's internet first policy (opens in a new tab) says the internet first approach must be considered for digital services that need to be accessible outside your internal network, or that depend on a national private network, and that organisations should work with their suppliers to make those services internet accessible. It defines an internet-facing service broadly, as "any service accessed by anyone via any number of ports, protocols or services over the internet", and notes that suppliers, managed service providers and home workers can all be users of a service.
As more clinical and business applications become internet facing or move to SaaS, more of a health organisation's traffic never needs HSCN at all. That is where SASE helps: it gives staff, partners and suppliers per-application access to internet-facing services, and applies web, SaaS and firewall policy to the traffic, whether it leaves from a hospital site, a GP practice or a member of staff's home.
HSCN or internet breakout with SASE: which is more secure?
It is rarely one or the other. HSCN carries the traffic that has to stay on it, such as access to national applications, and internet traffic that leaves over HSCN passes through the NHS Secure Boundary internet filtering service, one of HSCN's central services. Local internet breakout sends some internet and SaaS traffic straight out from a site, and SASE supplies the inspection for that traffic instead.
Which is more secure depends on what each path is protected by and how consistently policy is applied:
- Routing internet traffic over HSCN keeps it behind NHS Secure Boundary. NHS England's internet access guidance (opens in a new tab) describes its deny lists, dynamic blocks and the process for requesting access to blocked resources.
- Breaking out locally with SASE puts web filtering, firewall and SaaS controls in your SASE platform, under your own policy and logging, and can reduce load on the HSCN link for SaaS-heavy sites.
- Staff off site are outside both unless the SASE agent or browser controls protect them.
The NCSC's guidance on deciding whether to tunnel internet traffic (opens in a new tab) is useful here: it says tunnelling all traffic should not be a default design choice and should follow your threat model, the products in use and your risk appetite. In practice, many health organisations keep national application traffic on HSCN and decide, application by application, which SaaS and internet traffic breaks out through SASE. Your HSCN supplier and your information governance lead should be part of that decision.
Is SASE for the NHS the right fit for you?
We will check it against your systems and requirements and recommend the right option.
SASE or SD-WAN for NHS sites?
SD-WAN and SASE answer different questions, so many NHS sites need both. NHS England's HSCN connectivity options (opens in a new tab) page shows sites from a single GP practice on broadband through to resilient Ethernet at large hospitals, including small sites that reach HSCN through a managed VPN overlay on internet broadband and backups over 4G.
- SD-WAN helps where a site has more than one link, such as an HSCN connection and a separate internet line, or a primary and backup. It steers each application onto the right link and fails over when one degrades.
- SASE adds the security for internet and SaaS traffic and extends it to staff who are not on site. Single-vendor SASE combines both in one platform; see single-vendor SASE.
| Site | Often a good fit | Why |
|---|---|---|
| GP practice or clinic on one line | Security Service Edge (SSE) on staff devices, with HSCN as supplied | Few links to manage; the gain is web and SaaS security and secure access for staff off site |
| Practice or clinic with HSCN plus a separate internet line | SD-WAN with SASE | SD-WAN chooses the link per application; SASE inspects traffic that breaks out locally |
| Multi-site trust, community services or a federation | Single-vendor or dual-vendor SASE with SD-WAN at each site | One policy across many sites and staff; SD-WAN handles resilience |
| Health technology supplier | Security Service Edge (SSE) with ZTNA for staff and support engineers | Per-application access to customer and internal systems from anywhere |
Talk to your HSCN supplier about how its service and any SD-WAN or SASE at the site fit together. Platforms we supply with SD-WAN in the same family include Cisco SASE (Cisco Secure Access (opens in a new tab) with Cisco SD-WAN or Meraki SD-WAN (opens in a new tab)), Check Point SASE, HPE Aruba Networking SASE and Barracuda SecureEdge. The general comparison is on SASE vs SD-WAN.
Buying SASE in a health organisation
HSCN connectivity is bought from compliant consumer network service providers (CN-SPs), either directly or through the Crown Commercial Service dynamic purchasing system that NHS England's new HSCN connections (opens in a new tab) page describes. SASE subscriptions are bought separately, under your organisation's own procurement rules. A sensible sequence:
- Map traffic by destination: national applications on HSCN, internet-facing clinical and business services, SaaS, and suppliers who connect in.
- Agree the breakout policy with your information governance lead and HSCN supplier: what stays on HSCN, what breaks out, and what inspection each path gets.
- Shortlist and trial. The NCSC recommends trials or proof-of-concept deployments (opens in a new tab) with realistic users, devices and applications before committing.
- Pilot at one site or with one staff group, then extend site by site.
- Retire legacy routes that bypass the new policy, which the NCSC lists among its ZTNA anti-patterns (opens in a new tab).
The wider public sector process is on public sector SASE, and the phased technical plan is on SASE implementation.
How Forever Systems helps health organisations
We can assess your current HSCN, internet and remote access set-up, map which traffic belongs where, and recommend SASE and SD-WAN options that work alongside your HSCN supplier's service. We can then quote, pilot and deploy the SASE platform and support it, with scope confirmed at quote and subscriptions billed monthly where that suits, terms confirmed at quote. Contact us to talk about SASE for your trust, practice or health technology business.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
Does SASE replace HSCN?
No. HSCN remains the network for national NHS applications and for exchanging information with other health and care organisations. SASE works alongside it, protecting staff, internet and SaaS traffic, especially traffic that breaks out locally or comes from staff working off site.
Is internet breakout with SASE more secure than routing internet traffic over HSCN?
Neither is automatically more secure. Internet traffic over HSCN passes through the NHS Secure Boundary filtering service; local breakout relies on the SASE platform's inspection and your own policy. Many organisations keep national traffic on HSCN and break out selected SaaS and internet traffic through SASE.
Should NHS sites use SASE or SD-WAN?
Often both. SD-WAN manages a site's links, such as an HSCN connection and a separate internet line, and fails over between them; SASE adds security for internet and SaaS traffic and for staff off site. Single-vendor SASE provides both in one platform.
What is NHS England's internet first policy?
It says organisations must consider an internet first approach for digital services that need to be accessible outside their internal network or depend on a national private network, and should work with suppliers to make those services internet accessible.
Who can connect to HSCN?
NHS England says HSCN is available to any organisation whose purpose in connecting is the delivery, facilitation or support of health or social care in England. Each organisation signs one HSCN Connection Agreement and buys connectivity from a compliant HSCN supplier.
Can health technology suppliers use SASE?
Yes. Suppliers often use Security Service Edge (SSE) with ZTNA to give their staff and support engineers per-application access to internal and customer systems. HSCN has a separate Connection Agreement type for IT service providers who connect to it.
Still have a question about SASE for the NHS?
Ask us and a member of our team will get back to you.