The secure email standard

There are two ways to meet the secure email standard. Organisations must select one of these methods to comply.

1. Implement an already compliant service such as NHSmail or Office 365 for all staff at your organisation.
2. Demonstrate your own service is compliant with the secure email standard by following the secure email accreditation process.

Implement an already compliant service

NHSmail

Meet the organisation requirements of the standard by following the steps below.

1. Ensure there is a process in place to notify the NHSmail team upon becoming aware of any breach of security, including an actual, potential or attempted breach of, or threat to, the security policy and / or the security of the services or the systems used to provide the services.
2. Health and care organisations SHOULD set policies and procedures for the use of secure email using mobile devices and ensure the email service enforces them.
3. Health and care organisations SHOULD comply with the provisions of DCB0160: Clinical Risk Management: its Application in the Deployment and Use of Health IT Systems. 
4. Health and care organisations MUST set policies and procedures for staff who use the secure email service to ensure that they understand how to use it appropriately and safely, including how to send emails to insecure email systems such as those used by patients.
5. Migrate all users / staff to the NHSmail email service: To migrate all email users to NHSmail follow the migration guidance on the NHSmail support site.

Microsoft Office 365 (O365): Secure email configuration guide

Meet the organisation requirements of the standard by following the steps below.

1. Ensure there is a process in place to notify the NHSmail team upon becoming aware of any breach of security, including an actual, potential or attempted breach of, or threat to, the security policy and / or the security of the services or the systems used to provide the services.
2. Health and care organisations SHOULD set policies and procedures for the use of secure email using mobile devices and ensure the email service enforces them.
3. Health and care organisations SHOULD comply with the provisions of DCB0160: Clinical Risk Management: its Application in the Deployment and Use of Health IT Systems.
4. Health and care organisations MUST set policies and procedures for staff who use the secure email service to ensure that they understand how to use it appropriately and safely, including how to send emails to insecure email systems such as those used by patients.
5.  Register compliance with the NHSmail team:  
    Microsoft Office 365 (O365) accreditations must include confirmation that the email service has ben configured to securely communicate with NHSmail. The Microsoft Office 365: Secure email configuration guide has been co-produced with Microsoft, allowing instances of O365 to be enabled to securely route emails to and from NHSmail.

Google- G Suite 

Google is currently going through DCB1596 accreditation with its G Suite product, however at this time this has not been approved for use within Health & Social Care, and organisations should take the necessary steps and carry out a local risk assessment when sharing sensitive information with organisations using G Suite as their primary email service. 

Once Google have been accredited an updated conformance statement will be published on this site for organisations to consume and carry out their local accreditation when using G Suite. To help organisations with their risk assessment we have provided a link to the published sharing sensitive information guidance.
 

Exchange, hybrid or other email services

In addition to completing the organisation section of the standard, those hosting their own email services must submit assertions and evidence that they meet the ICT Service Provider elements of the standard. These will be reviewed by the NHS Digital Data Security Centre. 

The steps below illustrate the end to end accreditation process.

1. Submission of a signed self-accreditation statement, with evidence
2. Evidence checked by the NHS Digital Data Security Centre and NHSmail team
3. Rectification of findings and re-submission to the NHSmail team
4. DCB1596 met

The templates to accredit your email service to the secure email standard are listed below and should be returned with the required evidence to feedback@nhs.net.

DCB1596 Microsoft Office 365 Conformance Template
DCB1596 Self Accreditation Conformance Template
DCB1596 ICT Service Provider Template

Note: In the 'Health and Care Organisation' section of the templates, please provide the name and date of the policy or document covering each requirement and ensure the requisite approvals are in place.

The statements below confirm how NHSmail and Microsoft Office 365 meet their email security obligations:

DCB 1596 conformance statement for Microsoft Office 365
DCB 1596 conformance statement for NHSmail.  

Re-accreditation

Accreditations to the secure email standard last for one calendar year. After this period organisations are required to re-accredit.

The re-accreditation process will involve the organisation re-submitting evidence for review. In most instances this will be very similar to the information previously submitted.

Penetration test results and ISO27001 certificates must be within the last 12 months.

As accreditations come to the end of their term the NHSmail team will send out a reminder to each organisation. 

For any further queries regarding the secure email standard please contact feedback@nhs.net. You will receive a response within 5 working days.