Transfer data securely

Summary

The security of data in the NHS, especially patient data, is crucial. NHS Digital provides a number of services that enable data to be transferred securely between health and care services, and individuals.

NHSmail users can register to securely transfer files up to 1GB in size using the Secure File Transfer (SFT) service. NHS Digital business teams can use the Secure Electronic File Transfer (SEFT) to transfer data securely to and from any external organisation.

Secure Electronic File Transfer

Secure Electronic File Transfer (SEFT) works by providing a secure wrapper around any file, regardless of its size, structure or data content. SEFT provides data security during transmission (by using a 256-bit AES encryption mechanism). The data are held in secure containers at NHS Digital and only people who are authorised to process the data are allowed access.

SEFT can only be accessed by registered and approved users. We will invite relevant people to register for the service, and send you log-in details.

Read our quick help guide for further information on using SEFT.

Alternatively, contact the SEFT team for more information.

Secure File Transfer Service

Files are loaded over the HSCN (formerly N3 network) via a web browser using Secure Socket Layer (SSL) encryption, where they are stored in an encrypted database for a maximum of three days. During this 3 day window the file can be downloaded by its intended recipient via their web browser, again using SSL encryption.

As a further precaution the files are automatically deleted after 3 days.

Getting started

Before using the Secure File Transfer system (SFT) to send files:

  • make sure that you have a NHSmail account
  • register with the service 
  • the people you are sending data to also need NHSmail accounts and need to register with the SFT

Once you have done this, you can immediately start to use the SFT.

If you are manually typing the SFT address into your web browser, double check that you have typed https: and not http: at the start of the web address. Senders and recipients must have access to the HSCN (formerly N3 network).

Sending files with SFT

  1. Connect to the SFT website.
  2. Enter your email address and the PIN that you received during registration. If you forget your PIN, contact the Exeter helpdesk on 0300 303 4034.
  3. Enter the email addresses of the people you are sending the files to. You can send to 10 people at a time.
  4. Enter a password to protect the file. If you provided mobile phone numbers, the SFT will text the password to those numbers.
  5. You can add a comment that the SFT will send to the recipients. You can also ask to be notified when the file is downloaded. You can also ask the SFT to delete the file sooner.
  6. Tick the box that says you understand the terms and conditions, and click on the “Check Steps 1-3” box.
  7. Upload the file that you wish to send. You can send compressed or encrypted files or archives (and password protected ZIP files). You cannot currently send a file larger than 1GB (~1000MB).
  8. Send the file.
  9. You may need to send the password you used to the recipients if you did not ask the SFT to do this for you. You need to do this in a secure way. If you are unsure how to do this, contact your Information Governance Manager.

Files uploaded to the SFT will automatically be deleted after 3 days. If the recipients do not download the files before this, you will need to resend them. You can ask the SFT to delete the files sooner.

Downloading files from the SFT

  1. The SFT will send an email to the recipients you provided with a link to click on and instructions.
  2. The recipients enter their PIN (from their registration) and the file password you specified (The SFT might have sent this as a text message).
  3. They can then download and save the file.

Contact details

For more information about the Secure File Transfer service, call the Exeter helpdesk on 0300 303 4034 or email exeter.helpdesk@nhs.net.

Further information