IGSOP02 Standard Operating Procedure (SOP)

IGSOP02

Standard Operating Procedure for Email Communication with Patients/Clients and their Families/Carers

Page 1 of 27

Version:

V3

Ratified by:

Technology Programme Board (TPB)

Date ratified:

14/04/2022

Job Title of author:

IG and IT Projects Manager

Reviewed by Committee or Expert Group

TPB

Related procedural documents

IGPOL65 Transferring of Personal Information

Review date:

14/04/2025

It is the responsibility of users to ensure that you are using the most up to date document template – ie obtained via the intranet.

In developing/reviewing this procedure Provide Community has had regard to the principles of the NHS Constitution.

Page 2 of 27

Version Control Sheet Version V1

Date June 2017

Author IG& IT Projects Manager

V2

June 2019

IG & IT Projects Manager

Update to new template and amended expiry date to review date

January 2022

IG and IT Projects manager

Update to a new template and review

V3

Page 3 of 27

Status Ratified

Comment

PAGE 4

Contents 1.

Introduction ........................................................................................................... 5

2.

Purpose ................................................................................................................ 5

3.

Scope ................................................................................................................... 5

4.

Considerations ...................................................................................................... 5

5.

Procedure ............................................................................................................. 5

6.

SystmOne Specific Procedures ............................................................................ 7

7.

Email Standards and Responsibilities ................................................................... 7

8.

Training and Awareness ...................................................................................... 8

9.

Monitoring and Review ......................................................................................... 8

Appendix 1: Consent Form .............................................................................................. 9 Appendix 2: Verifying and Email Address in TPP SystmOne ......................................... 11 Appendix 4: Guide to Accessing Encrypted Emails ....................................................... 14 Appendix 5: Emailing Patients - Quick Guide ............................................................... 21

Page 4 of 27

PAGE 5

1. Introduction With more and more people preferring to use email as a way of communicating, people are requesting to receive information about their care and treatment by email. Whist email is quick, reliable and secure within the organisation, most individuals do not have access to an NHS mail account and commonly use less secure email services such as Gmail, Hotmail, Yahoo, AOL mail.

The Organisation has a responsibility under the Data Protection Act 1998 to ensure that personal confidential data is held securely and that appropriate consent is in place for the sharing of information.

There are many risks associated with the use of email which need to be understood by service users and staff. Some of these are outlined in Appendix 4.

The Caldicott2 Review Panel concluded that “personal confidential data can be shared with individuals via email when the individual has explicitly consented and they have been informed of any potential risk” For the purpose of this document the term “individual” refers to patients, clients, service users, their families, carers and representatives.

2. Purpose These procedures outline steps that must be taken when emailing individuals as well as good practice guidelines.

3. Scope These procedures apply to communicating patient confidential information with patients/ clients and their families/ carers via email.

4. Considerations It is important to consider whether email is the best method of communication in all circumstances. When responding to complicated or difficult problems or conveying particularly sensitive information it may be better to consider a telephone call or a face-to-face meeting to address these scenarios.

If requiring confirmation that information has been received, please be advised that an Email Read Receipt is not a reliable indication and should not be relied upon. Confirmation should be sought from the recipient if required.

5. Procedure Remember all email communication on behalf of the organisation must be sent from a secure NHS email address and never from a private email account. It must also be attached to the individual’s electronic care record.

Always use the secure functionality in NHS Mail by including the word secure in square brackets [Secure] in the subject line of the email when sending patient Page 5 of 27

PAGE 6

identifiable information to a non-secure email. The decision on whether to use the secure functionality should be based on whether the email contains sensitive information and whether there will be repercussions if lost.

For example, sending a generic service leaflet to a patient would not warrant the use of Encryption.

If you receive a request from a person to receive communications by emails, and your line manager has agreed to communicate in this way, then you must first ensure that the following is in place.

•

Agree within your team a generic email account that can be used for communicating with individuals. This should be a generic NHS mail account which is monitored daily and has an out of office message which signposts people to other contacts in case of emergency, during nonoffice working hours and details of expected response times.

•

Ensure that an email signature is set for the account and complies with Provide’s requirements for email signatures.

•

Implement a process that covers; 1. members of the team sending an email to the generic account for onward transmission to the individual, with timescales 2. who is the owner of the generic account and therefore takes responsibility for forwarding on messages, within timescales?

3. who is responsible for storing the email appropriately?

4. a process to raise a concern if the volume of emails from a particular individual becomes unmanageable.

Once the above is in place, then the following process should be completed with each individual: • •

• •

Present the Individual with the consent form (appendix 1) and ask them to review and sign. The consent form can also be emailed to the individual where a face-to-face appointment with the individual is not possible.

The form must then be filed in the patient’s care record. In the case of an emailed consent form, a copy of the email providing consent should also be filed. (File under Letter Type “Consent for Email Communication”) The Email address specified should be checked and updated on their care record.

Services using SystmOne must verify that they have been provided with the correct email address by following the instructions under Appendix 2 before sending any Confidential Information.

You now have consent to share appropriate and relevant information with that person by email. Consent needs to be reviewed on a regular basis i.e. at each episode of care or as part of checking demographic details to ensure that they are still happy to receive information by Email and also to verify that their email address is the same and has not changed.

Page 6 of 27

PAGE 7

If at any point, an email that has been sent by the organisation to a person and is returned with an undeliverable message (Mailer Daemon – message failure notification) no further email messages should be sent. Please record the message failure and the date received in the care record. Please remember to communicate the information by other appropriate means.

Please remember that if you wish to communicate with an individual’s carer or a member of their family, you will need the consent of the individual to do this. If the person lacks capacity to give consent then an MCA2 will need to be completed and a ‘best interest decision’ must be made and recorded. The information contained in this document will still apply.

6. SystmOne Specific Procedures If your service uses TPP SystmOne then the following should be followed: The patient consent form must be scanned on to the patient’s record (Under Communications and Letters) Verify the patient’s email address as per Appendix 2 before sending any Confidential Information.

Do not use SystmOne to send emails as it will not trigger the encryption. Letter’s/ Documents can be viewed in SystmOne and then sent as a PDF using the Service generic account Emails can be added to the patient record by saving as a Word document then dragging and dropping or copy and pasting into communications & Letters via document processing. The document should be saved under letter type “Email”.

7. Email Standards and Responsibilities It is the responsibility of all staff to ensure that any email communication is in line with this guidance and that the wishes of the individuals are recorded and adhered to at all times.

Staff must report any incidents or issues where information was shared inappropriately or to the wrong individual, via the organisation’s incident reporting system, Datix.

Remember to communicate in a professional manner at all times, as if you were writing a letter to the individual.

Never use the ‘Reply All’ button or distribution lists Double check the email address to ensure that you are sending to the correct recipient. If the email is to be sent to another person(s) with the consent of the individual, ensure the contact details of the recipient(s) is/ are accurate and consider whether the recipient(s) need to be copied in for all conversations.

Consider the length of the email trail.

•

Is it appropriate to include previous conversations with the current response?

Page 7 of 27

PAGE 8

•

Keep email trail to one theme/topic

Reread your email for grammatical and/or spelling mistakes and the contents before hitting the send button.

Avoid the use of abbreviations or acronyms. If this is absolutely necessary, ensure these are clearly explained.

When sending attachments, consider the size and the file type. It is preferable to send attachments in Portable Document Format (pdf) unless you are expecting them to edit the document. If it is a signed document then you must convert the document to pdf format before sending.

Services should, use approved letter templates instead of re-creating standard emails for different request types. Letters can be saved as a PDF and emailed.

Emails are an important part of the person’s record and should be handled in accordance with organisation’s policies and procedures, i.e. recorded on the individuals care record in accordance with the organisation’s Retention and Disposal Schedule Emails should not be retained for any longer than necessary in an Inbox or Sent Items.

Once the email is recorded in the individual’s care record delete the email from the Inbox, Sent Items and Deleted Items.

8. Training and Awareness There is no formal training required, however support may be provided by the IT service desk in the setting up of a generic email account. Awareness will be raised to staff through Staff Bulletin, MetaCompliance, via IG refresher training and the intranet.

The patient should be emailed the “Accessing encrypted emails guide” as an initiation of the emailing communication.

9. Monitoring and Review This document will be reviewed every two years or after any significant change which impacts upon the content, or as a result of an incident being reported for a potential breach of confidentiality by email.

The Information Governance Team is responsible for updating this document and ensuring that it is reflective of best practice and relevant statutory, NHS and local standards.

Page 8 of 27

PAGE 9

Appendix 1: Consent Form To be sent to individuals to receive information by email

Patient Name: ___________________________ Service Name(s): __

______________

NHS Number: __________

_____________________

Organisation: PROVIDE CIC

Dear ………………….

We would like to send reports and other information to you by secure email and we will take every precaution to ensure that this remains secure. We would like, however, to let you know the following risks in communicating by email:” Emails: • may be able to be accessed by other members of your family if you use a shared email account; • can be circulated, forwarded and stored in numerous paper and electronic files; • senders can easily misaddress an email; • are easier to falsify than handwritten or signed documents; • backup copies of email may exist even after the sender or the recipient has deleted his/her copy; • can be intercepted, altered, forwarded or used without authorisation or detection; • can be used to introduce viruses into computer systems; • can be used as evidence in court; • can be lost in transmission; • can be posted on the internet or other publicly available networks if intercepted.

In order to minimise some of these risks we will encrypt any email messages that we send to you which will require a one-time online registration to read these messages (you will be given/emailed a guide to help you register).

Please advise your consent to receiving emails, to include: Confidential information e.g. reports about my/ my Child’s care General information e.g. resource sheets Email conversations (General Communication which may include details of my/my Child’s care) Details of Appointments Page 9 of 27

PAGE 10

I would like you to correspond with me using the following email address: …………………………………………………………………………………………

I would like * only the service(s) listed on page 1 of this form / * any Provide Services that I receive care from to email me (* please delete as appropriate).

I understand that copies of email correspondence with you will be stored within * my Care Record / * my Child’s Care Record (* please delete as appropriate).

I understand that I may change my mind at any time and will inform my Care Professional of any changes to my email address or if I wish to no longer use email as a method of communication.

Signed: _________________________________

Date: ___________________________________

Patient Representative? * Yes / No (* please delete as appropriate) Representative: * Parent / Guardian / Carer / Other (* please delete as appropriate). If ‘Other’, please specify: _____________________________

Page 10 of 27

PAGE 11

Appendix 2: Verifying and Email Address in TPP SystmOne Before sending any confidential information to the patient you must follow these steps to verify their address: 1) In the Patient record go to the Administrative tree and select Patient Details:

2) Select “Record Contact Details” and enter the email address.

The following message will appear and will automatically send a verification email once the Patient record is saved.

Page 11 of 27

PAGE 12

Once the email has been verified it will update the Patient record. This can be checked by selecting Record Contact Details.

The recipient of a verification email can Reject it. This would happen for example if the email address entered in the SystmOne record is incorrect or if the patient decides that they do not wish to be contacted by email after all. When this happens, you will receive a task in your unit to this effect:

Someone within your service will need to take action by contacting the patient to query why this has been rejected – i.e. do they have a different email address they wish to use or do they wish for their email address to be removed.

Page 12 of 27

PAGE 13

Appendix 3: Risks Risks associated with sending emails to non NHS mail accounts for the purpose of providing information in relation to care and treatment of an individual: •

can be circulated, forwarded and stored in numerous paper and electronic files

•

can be immediately broadcast worldwide and received by many intended and unintended recipients

•

senders can easily misaddress an email

•

is easier to falsify than handwritten or signed documents

•

backup copies of email may exist even after the sender or the recipient has deleted his/her copy

•

can be intercepted, altered, forwarded or used without authorisation or detection

•

can be used to introduce viruses into computer systems

•

can be used as evidence in court

•

can be lost in transmission

•

can be posted on the internet or other publicly available networks

•

may be disclosed as part of a Subject Access Request or Freedom of Information Request.

Page 13 of 27

PAGE 14

Appendix 4: Guide to Accessing Encrypted Emails

Accessing Encrypted Emails Guide for NonNHSmail Users When receiving an encrypted email from an NHS email account it will look as per below and it will contain a link to access and read the encrypted message. The message reads: You have received an Egress secure platform notification.

You have received a new NHSmail secure email from…@nhs.net.

Click Open secure email and the account verification screen will appear:

Page 14 of 27

PAGE 15

1. Registration. If you have not previously received an encrypted NHSmail email and you are not registered to use Egress, you can create a new account by clicking “Create it for free”

The registration window will open. Please fill the form and click Create account.

Page 15 of 27

PAGE 16

• • • • • •

Add your email address and your details Type and confirm your password – you will need to use this password to open encrypted emails sent to you (it must be at least 8 characters long and contain at least 1 lower case and either 1 upper case or number) Select 2 of the security questions and type the answer Type the security code (the one that is shown on your authentication screen) Tick the box to confirm agreement to the Free User Terms and Privacy Statement Once you have completed all the fields, click Create Account

An activation code will be sent to your email address. Please type it in the activation box and then click Submit Activation Code or alternatively click Activate account on the link within your email.

Page 16 of 27

PAGE 17

A new window will be opened and you will be asked to confirm the password that you set up for your Egress account. Add the password and click Activate Egress Account.

Page 17 of 27

PAGE 18

After accessing the link, you will receive the Egress signing in confirmation and now you can read your message.

Click Read your message now and the Egress page will open.

Page 18 of 27

PAGE 19

2. If you have registered to the Egress encryption platform, anytime you receive an encrypted email and you click Open Secure email, you will be taken directly the Account Verification screen:

Page 19 of 27

PAGE 20

Make sure your email address is correct, enter your Password and click Sign In. The system will display the encrypted message that you received.

You will be able to Reply securely to the sender if needed or create a new email from your account. You will also be able to add attachments, check your account history, etc.

Your emails will be automatically encrypted.

This service is completely free and the access to the secure message can also be done via mobile phone (both Android & iOs).

Page 20 of 27

PAGE 21

Appendix 5: Emailing Patients - Quick Guide

Sending secure emails to a non-NHSmail The encryption should be use at all the times when emailing patient sensitive information to a non-secure / non-NHSmail and at all the times when in doubt.

Sending sensitive information should be in accordance with IGPOL65 – Transferring Confidential Information and before sending the information via secure email please make sure that and to make sure that the recipient is expecting the data.

Ways of sending encrypted emails 1. Using [secure] in the subject of the email (the word “secure” in square brackets).

Page 21 of 27

PAGE 22

2. Additional to the classic method NHSmail users can now use the Egress Outlook add-in.

NHSmail Egress Outlook add-inn enables the user to send encrypted emails without using [secure] in the subject line.

You can use this add-in in the Outlook by clicking on the open padlock in the top left of your new email and selecting SECURE.

By selecting SECURE the email will be encrypted automatically. Locked padlock = SECURE Page 22 of 27

PAGE 23

This Egress Outlook add-in offers also an optional feature that allows the user to restrict the period in which the recipient could access the secure email.

You can use this optional tool if you wish by clicking on the Message Restrictions tab and selecting the dates and times.

Page 23 of 27

PAGE 24

In this case, the recipient of the email can only access the email and the attachments within the time frame that you selected.

An encrypted copy of the email will be saved into your Sent Folder and you can also have a full audit of your encrypted emails by clicking Sent Packages tab on your main Outlook page or by logging into the Egress Web Portal https://esi.nhs.net

Page 24 of 27

PAGE 25

From here, you can see when the package has been sent, where, when it was accessed.

You can also modify the list of the people who have access, change the time restrictions or completely revoke the access by clicking on the package and amending the details (revoking should be done only if there is a genuine reason to do so, e.g. the package was sent in error.)

Please note: •

• • •

In order to read the encrypted email, the patient / the non-NHS user will need to register to the Egress platform at their end in the case they haven’t done so yet.

Please feel free to email them the Accessing Encrypted Emails Guide before sending sensitive data.

The patient / the non-NHSmail user can reply and attach documents securely from their account.

The encrypted email can be accessed only by the recipient of the email and only by using the email address where the original email was sent.

Page 25 of 27

PAGE 26

Requests for granting access for others to secure emails sent via Egress If a recipient forwards the encrypted email notification to another person who was not the original recipient(s), they will need to request access from you as the original sender.

If this happens, you will receive an email notification asking you to grant the access to the package.

Information Governance team is discouraging this practice and granting access should be refused unless there is serious and verified reason to do so.

Page 26 of 27

PAGE 27

Page 27 of 27