This page is based on the full guidance from NHSmail. Refer to NHSmail guidance for up to date guidance: https://support.nhs.net/knowledge-base/guide-for-health-and-social-care-email-users/

Secure email systems/recipients

Users of the following email systems can transfer data securely between each other without additional action:

• nhs.net
• gov.uk
• police.uk
• parliament.uk
• cjsm.net (Criminal Justice Secure Mail)
• mod.uk (Ministry of Defence)

This means (where appropriate to exchange information) as an NHSmail user, you can securely email these other services, including personal confidential data or sensitive data.

You can also do so with email addresses that are on the separate list of services that have met the secure email standards. This list changes continuously; however, if a service emails you and is on the list the following alert will be added to the top of the email by NHSmail:

For example (at the time of writing) the ICB's email system (@snee.nhs.uk) meets the secure email standards; however, like all on the list, that could change and should confirm in each case. If you have concerns about an email you can check the current list online and discuss with your Data Protection Officer.

If you are initiating the email exchange, you must know before sending if their system is secure; you can either check the current list online, or ask them to email you first and check for the alert above.

Do not save copies of the list of secure DCB1596 to refer to later, it is updated at any time.

Non-secure email systems/recipients

If a sender isn't part of the above, they will have the following added to the top of their emails by NHSmail:

This means (where appropriate to exchange information) as an NHSmail user, you must take action to secure your email if it includes personal confidential data or sensitive data.

To make the email transfer secure, include [secure] in the subject line.

This must be square brackets; however, the capitalisation does not matter.
e.g. These are fine: [secure], [SECURE], [Secure], [SeCuRe]

These are not: (secure), {secure}, [secure ], [sequre],