You are viewing an archive version of the PSNC website taken on 18th April 2013. This site is not updated, and may be out of date or relate to old NHS structures.
For updated and current information, please visit our new website at www.psnc.org.uk
Skip Navigation
PSNC Home Page
Advanced Search
.

Pharmaceutical Services Negotiating Committee

NHSmail

NHSmail iconNHSmail is a centrally funded and managed secure email service which has been approved by the NHS for exchanging patient data. On this section of the site, you'll find an overview of the service and some points to support local consideration of whether and how the service will be used.

Pharmacy Access to NHSmail

The Future of NHSmail

Benefits of NHSmail

Things to consider before using NHSmail

Frequently Asked Questions 

Note the information on this page applies to England, there are different NHS email solutions in the other home countries.

NHSmail and the NHS Re-organisation

From 1st April 2013, enabling access to NHSmail and administration of password re-sets will be the responsibility of NHS England through its specialised commissioning hubs. NHSmail accounts will be marked as a ‘Leaver’ by the existing NHSmail Local Organisation Administrator (LOA) within the PCT. The LOA in the Commissioning Board Hub will need to mark the relevant NHSmail accounts as ‘Joiners’ to ensure the account is moved into the correct organisation. This process will need to be completed within 30 days to avoid the account being deleted. It is not anticipated that users will need to take any action in relation to this. However, users will need to change their password once their account has been marked as a ‘Joiner’ and to do this, an N3 connection will be required. Guidance is being issued direct to users via their NHSmail accounts.


Pharmacy Access to NHSmail

Policy approval has been given for pharmacy staff to be issued with individual email accounts and for a pharmacy to request a generic dispensary account for their pharmacy. These can be requested from the relevant NHS England Area Team - Local Organisation Administrator (LOA). For support finding your LOA, contact the NHSmail national helpdesk on 0333 200 1133.

In the absence of a structured and integrated secure messaging system between pharmacies and other NHS providers, NHSmail has the potential to support clinical communication and offers a range of benefits, however, there are problems inherent in the current NHSmail arrangements that are creating barriers to pharmacy uptake and use of the service. This includes information governance and clinical governance concerns and issues linked to regulatory requirements on email communication that apply to certain businesses. Whilst there are procedural controls that could be put in place to manage risks that have been identified -  for many businesses, particularly larger companies, this isn't a viable option. 

Click on the link below to view the position statement from the CCA and AIMp on NHSmail.  

CCA/AIMp Position Statement on the Roll-out of NHSMail

There is on-going work to find technical solutions to address concerns. Discussions are constructive and positive. We are hopeful that solutions can be found so that the benefits of NHSmail can be properly realised by the NHS and all pharmacies.


The Future of NHSmail

The contract for the current national NHSmail service is due to expire soon. The NHS is giving consideration to what will replace it. More information about the re-procurement can be found on the HSCIC website.

At the same time, the Information Standards Board for Health and Social Care has issued advanced notification that it plans to develop a standard for ‘secure email’. The standard will define the minimum non-functional requirements for a secure email service suitable for the transmission of patient identifiable data. The standard will cover the storage and transmission of email but excludes security standards for document archives. It is possible that this will support non-NHS contracted email providers offering solutions for the secure transfer of NHS patient data.


NHSmail Benefits

The NHSmail service is available anywhere, over either the NHS N3 network or the open internet. The service can be viewed through a free web based client or alternatively pharmacies can choose to connect the service to a local email client they have purchased, for example Microsoft Outlook.

The key benefit of the service is its security, which means it can be used for transmission of patient information between health professionals. Examples of the types of information that can be transmitted through the service include patient MUR information and hospital discharge communications.

The service’s Fax and SMS functionality currently allows users to send faxes and SMS messages for free from their mailbox. This could be used to send reminders to patients to collect repeat medication. It is possible there will be a charge for using this functionality in the future.

All NHSmail users are listed in the service’s ‘Directory’ and it is possible to use this resource to find the contact details of other users. Users can be contacted individually or the service supports the creation of ‘dynamic distribution lists’ to communicate with groups, for example a group of all staff with accounts linked to a particular pharmacy or all pharmacies in an area. The service also allows users to set up personal address books for contacts that are not listed in the central NHS Directory.

A number of other NHS programmes use NHSmail accounts as a means of validating that an individual is working for the NHS or for an organisation contracted to the NHS, therefore it can help in the administration of other services for example obtaining an Athens password . NHSmail accounts can also be used to support smartcard password resets. However, these services can still be accessed without an NHSmail account.


Practical Considerations

There are a range of things that need to be considered when deciding whether to request an NHSmail account and in considering how the accounts should be used. The following issues to consider have been collated from feedback from pharmacists that have used the service.  

Points to consider linked to deciding whether an NHSmail account is required and what types of information the accounts should be used for:

  • Will the service be used to send/receive sensitive patient information? If not, using an existing pharmacy email account could be an alternative.
  • How often will the account be checked? Email can be a useful additional communication channel, but if the information being communicated to the pharmacy is time sensitive, the pharmacy would need to have procedures in place to ensure email was checked on a frequent basis. For certain communications, it may be more appropriate for alternative communication channels to be used, for example phoning the pharmacy.
  • NHSmail supports the sending of attachments. In some of the pilot sites, problems arose where attachments were sent to the pharmacy to view or edit, but the pharmacy didn’t have the necessary software on their computer to support this. As there is a risk that unapproved software could interfere with the operation of a PMR system or  invalidate a pharmacy's maintenance contract with their supplier, it is important to check with suppliers before loading software on to pharmacy computers.
  • Links to external websites: Many pharmacies have strict controls on what websites can be accessed from the pharmacy computer. In some cases staff can only access a list of sites that have been pre-approved by a company Head Office. If an email is sent to a pharmacy with references to web links, pharmacy staff may not be able to access these links.  
  • Which account will be used to receive different types of information - individual staff accounts or the pharmacy premises account? A key consideration is clinical governance, it is important that records of clinical communications are kept, for example to support defence against litigation in the event of an error being made. This links to internal pharmacy processes for storage/record keeping. For individual staff accounts, if that individual moves to another pharmacy, they will take their NHSmail account with them. 

Points to consider linked to managing NHSmail within the pharmacy:

  • Managing access rights: Who will have access to the premises account? What about locums? What processes are in place to ensure access rights are maintained when there are staff changes?
  • Storing information received: Storing records of clinical communications is important for clinical governance reasons. NHSmail is designed to support the transfer of information, not the storage of information. Each account has a storage allowance of 200MB. Whilst some information could be copied across to the notes in the patient’s pharmacy record, particular consideration will need to be given to how attached documents are stored (including arrangements for data back-up and appropriate access controls). The types of document management solutions seen in GP practices are not in common use in pharmacies.
  • Sending patient information: NHSmail is currently the only NHS approved method for exchanging patient data by email, but only if both sender and recipient use an NHSmail account or if sending to another government secure domain such as GSi (*.gsi.gov.uk) or CJX (*.police.uk or .pnn.police.uk). In addition to ensuring the recipient account is secure, it is important to check that the recipient is prepared to accept the information by email, check that information is being sent to the correct email address and indicate the sensitive nature of data in the header.
  • Information Governance: Appropriate information governance procedures need to be put in place if NHSmail is used to transfer sensitive information. Particular risk areas of note include the fact that NHSmail can be accessed anywhere, it is not possible to limit access rights to a particular location, for example from within a pharmacy. Also NHSmail can be linked to a wide range of mobile devices - if this option is used, provision needs to be made for the event that they are stolen or lost, for example a process to activate self-wipe capability. Ways that safeguards around the use of NHSmail could be integrated into existing IG resources required for compliance with the NHS Information Governance Toolkit include:
    • Outlining the expectations on staff use of NHSmail in the pharmacy confidentiality code of conduct (Requirement 214).
    • Outlining how personal information will be handled if  received by email, for example in the pharmacy’s safe haven procedures (Requirement 322).
    • Providing guidance on the use of NHSmail in the pharmacy’s data transfer procedures (Requirement 322).
    • Where the service is accessed from mobile devices, providing additional guidelines for staff on mobile computing (Requirement 318).
    • General guidance on the NHS Information Governance requirements can be found in the NHS IG section of this site.
  •  Regulatory Information in Business letters: A requirement was introduced by the Companies (Registrar, Languages and Trading Disclosures) Regulations 2006 for companies in the UK to include certain regulatory information (e.g. company registration number, place of registration and registered office address) in their ‘business letters’ (which includes emails). In October 2009, similar requirements were introduced for sole traders and partnerships (with special provision for partnerships of more than 20 persons) and Limited Liability Partnerships. Although individuals can set up personal ‘email signatures’ in NHSmail, there is no way at present, via the NHSmail service to set up an automatic footer/signature stamp so that a company can ensure all emails sent by their employees contain the necessary information. Failure to include the information required in the Regulations would be a breach of the Companies Act 1985, and could render companies liable to a substantial fine.
  • Password Re-newal: NHSmail passwords need to be changed every 3 months. Bear this in mind if connecting your account to external software, for example if linking NHSmail to your PMR system to automate generating text messages. Problems have arisen in this scenario where passwords have expired and the PMR has attempted to enter the old password on a number of occasions, locking the account.  

Frequently Asked Questions

Can pharmacy technicians be issued with NHSmail addresses?

Policy approval has been given for any NHS community pharmacy staff members that require one, to have access to an NHSmail account.

I don't have an NHSmail account. Is there any other way to send patient sensitive information by email? 

NHSmail is the only service approved for the email transmission of sensitive patient information. One option for pharmacies that do not use NHSmail is to transmit personal information as an encrypted attachment to a non-secure email. The NHS recommendation is for AES256 encryption to be employed. This standard is available when using applications such as PGP or WINZIP version 9 or above. With these products the data can be put into a Self Decrypting Archive (SDA). The sender should check beforehand that, the recipient also has WinZip and therefore will be able to de-crypt the attachment. The pass phrase for the archive must be of an appropriate length and complexity and to ensure the safety of data in transit the pass phrase should be communicated to the recipient separately from the encrypted data so that the intended recipient is the only one able to decrypt the data. As well as software requirements, consideration would also need to be given to staff training and the workload involved in creating, opening and decrypting an archive. Care would need to be taken to ensure no sensitive information is included in the email itself.

I have been told I need an NHSmail address to support smartcard unlocking in EPS Release 2. Is this correct?

No. If an incorrect pin has been entered more than 3 times, the smartcard is locked and needs to be 'unlocked' to be used.

Where a staff member has access to the online Smartcard Service Centre (SCSC) and has either an @nhs.net email account or mobile phone number listed in the Spine User Directory, the system can be used to support unlocking an individual’s smartcard remotely, without the need to visit the RA Office. If an individual does not have either a mobile phone or an @nhs.net email account, it may be possible to use the pharmacy landline if the following apply:

  • The telephone line accepts text to voice conversations (this is available through a number of telephone providers including BT and Virgin and modern VOIP telephone systems)
  • An auto-attendant is not in use (i.e. the message will go straight through to a human)
  • The telephone number has previously been listed on the Spine User Directory

To list a number in the Spine User Directory or to update a telephone number, contact the local RA.

A sponsor can also unlock smartcards if they have been given this authority by the RA, have access to a computer with 2 Smartcard readers attached and have access to the online card management system. More information about sponsors can be found in the smartcard section of this site. PSNC is recommending that for the initial implementation of EPS Release 2, to ensure ready access to sponsors, a representative in each pharmacy premises is given sponsorship responsibility, for example the pharmacist-in-charge or branch manager.


More Information


NHSmail Website


DOWNLOADS: Some documents are available in PDF format, you will require Adobe Acrobat Reader 5.0 or later for viewing which can be downloaded from the Adobe Website

DOWNLOADS: Some documents are available in ‘Microsoft Word’ format. If you do not have Microsoft Word, you can read these forms by downloading the free 'Word Viewer'. This program can be downloaded at the Microsoft website