Recipients Guide for Encryption Version 1.2

Transcription

1 Recipients Guide for Encryption Version 1.2 Document Location n/a Copies can be requested from the IT Dept Revision Previous Revision by Summary of Changes Version date revision date number April 2010 N/A MP Initial Draft 1.0 Nov 2010 April 2010 MP NCHC new address/logo and additional steps 1.1 Feb 2011 Nov 2010 MP Additional information on password process & helpful information 1.2

2 Quick Links Introduction Scenario Secure Reply Helpful Information

3 Introduction Norfolk Community Health and Care NHS Trust (NCH&C) has a responsibility to ensure that all potentially sensitive and/or patient identifiable data sent from the organisation is secure in transit. To ensure this responsibility is met NCH&C has introduced an encryption solution. This document has been created for recipients of s sent from NCH&C as a leaflet on how to access encrypted s. To help explain the process step by step a scenario has been created. In the scenario Iain is the NCH&C employee and Matthew is the external recipient. The steps that Matthew performs will be the same for all recipients no matter what the address. (i.e. fred.bloggs@btopenworld.com fred.bloggs@yahoo.com etc etc). For this scenario a nhs.net address has been used simply to illustrate the process. Scenario Iain (iain@nchc.nhs.uk) is sending Matthew (matthew@nhs.net) an that requires encryption. When Iain (iain@nchc.nhs.uk) sends Matthew (matthew@nhs.net) the , Matthew will receive informing him that Iain has sent him a message and in order to retrieve the (and any attachments) Matthew will need to register a password that will be used to encrypt the . A screen shot of this is below (image 1); Image1

4 In order for Matthew to receive the encrypted he must register a password that will be used for the encryption. To do this Matthew must click on the link in the (Image1). This process is explained in the that Matthew receives as shown in Image1. Once Matthew clicks the link he will be directed to the page shown below (Image2); Image2 Matthews address will appear in the top box. Matthew enters a password and confirms his password. The password requirements will all turn green once the minimum criteria have been met. Matthew then clicks the register button and then sees the success screen (Image3) the will then be delivered to Matthew s inbox.. Image3 If Matthew does not see this success screen then the password creation was not successful and Matthew should close the window and re-click the link in the from Iain (image 1)

5 The encrypted has been delivered to Matthew as shown in image 4. The message (and any attachments if applicable) from Iain will be contained within the attachment (circled in image 4); Image 4 The message that Iain sent to Matthew (and attached documents if applicable) can be viewed by clicking the attachment as circled in image 5. Some clients will display multiple attachments, the one containing the message will start with the senders name (in this case Iain) contain the date and end with the letters PDF. Upon opening the attachment Matthew (the recipient) will be prompted for the password (image5). Image5 This is the password that Matthew created earlier in the process. The password created by Matthew will remain valid for all encrypted s received from any NCH&C sender. The password will only become invalid if a period of 30 days elapses during which Matthew receives no encrypted s from any NCH&C sender.

6 Iain does not know the password that Matthew created nor does he need to know. The password and the management of the password(s) is Matthew s responsibility. Once Matthew enters the password, the and any associated attachments will be displayed as shown below (image6); Image6 Matthew will be able to view the as shown in image7. Every that is encrypted will be headed with a banner page. This banner page is for information purposes and cannot be removed. It will be attached to all s that are encrypted. A copy of the banner page is attached to this document for reference (Appendix A) Matthew can save the attachments and work on the data as he would any other .

7 Secure Reply Matthew has the option of replying to Iain and making use of the encryption ensuring that the reply to Iain is protected by the same encryption tool. Iain has no input in this process. In order for Matthew to make use of the secure reply to Iain, he needs to click on the reply button located within the encrypted attachment (circled below in image7) Image7 Once Matthew has clicked on the reply button within the message he will be directed to a web page where he will be able to compose his secure reply (and attach any files as necessary) as shown in Image 8. Image8

8 Once the message has been created and any file attached, Matthew must click the Reply button below the text box to send the message If Matthew has forwarded the to another user, this new recipient will be able to reply via the Secure Reply but the mail will be sent to Iain as the originator and will be copied to Matthew as the original recipient. If Matthew wants to reply to Iain but not make use of the secure reply then he can simply reply to the as if it were any other mail by using the normal reply button within their client.

9 Helpful Information This section of the documentation is designed to give the recipient a better understanding of the solutions purpose and best how it can be used. Purpose and Use The purpose of the encryption solution is to ensure that all sensitive and/or person identifiable data when being transferred by is suitably secure. It is not the intention of the solution to provide a secure storage of data. When a recipient receives an encrypted it is strongly recommended that the information within the and any attachments are saved out from the and stored locally with any other data you may have (for example, within your My Documents folder). Once the information has been saved out from the , the may then be deleted. Please note: The reasons for encouraging this are that the encryption has served its purpose and the data has successfully arrived at its destination, therefore the encryption is no longer needed. It is worth noting that if a password to an encrypted is forgotten, the information within the encrypted cannot be retrieved. The recipients password can be reset, but this will not allow access to any data previously encrypted with another password. This is another reason we would encourage recipients to save information out of the at the earliest convenience. Passwords When a recipient registers a password to receive encrypted , this password is used to un-encrypt all s sent from NCH&C as long as a 30 day time window has not passed between receiving encrypted s. If a 30 day window has passed it is possible to register the same original password to receive new s. The encryption server does not require unique passwords when re-registering. If you are part of an organisation that is likely to receive a number of encrypted s to different individuals, it may be worth agreeing a standard organisational password for all encrypted s sent by NCH&C. This way your organisation can avoid any confusion associated with multiple recipients having multiple passwords and all encrypted s can be opened by all staff with one organisational password. (note, it is still recommended if using this approach to save information out from the encrypted at the earliest convenience). Need to Send Data Encrypted to NCH&C? If your organisation has a need to send some data to NCH&C and feel it would be more appropriate to be sent encrypted, you have the option to contact the intended recipient at NCH&C and request an encrypted to be sent to yourself. It is then possible to make use of the secure reply functionality and reply whilst making use of the NHC&C supplied encryption solution. (For more information please see the secure reply section of the guide)

10 Appendix A Encrypted Message This and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Recipients should be aware that all s received or sent by this Trust are subject to the Freedom of Information Act 2000 and therefore may be disclosed to a third party. Access attachments via the attachment tab in the left corner of your screen or by clicking the following menus View, Navigation Panels, Attachments To reply securely to this click the reply button on the next page. This will reply to the original sender of the message maintaining the secure encryption Please scroll down to find the message