Guidance for recipients of an encrypted NHSmail

Transcription

1 Guidance for recipients of an encrypted NHSmail January 2015 V.03 Copyright 2013, Health and Social Care Information Centre. 1

2 Contents Introduction 3 Receiving an encrypted 3 Reply to and forward encrypted s 6 Registration 7 Start of registration 7 Register encryption account 9 Check your to activate your account 10 Registration confirmation message 10 Authentication Successful 11 Keeping encrypted s secure 12 Help and further guidance 13 Frequently asked questions 13 Copyright 2014, Health and Social Care Information Centre. 2

3 Introduction NHSmail is national secure service for health and social care designed to enable the secure exchange of information by . Users of the service send from an address ending with The service allows NHSmail users to send secure, encrypted s to any service such as free global hosted services such as Gmail/Hotmail and company run services. This document provides guidance for recipients of encrypted s sent from an NHSmail account. It explains how to open and read an encrypted and send an encrypted reply. It also provides important guidance about information governance and ensuring sensitive information that has been received remains secure. Please note it is not possible for anyone other than an NHSmail user to initiate an encrypted exchange using the NHSmail encryption feature. If you are a non-nhsmail user and wish to exchange information securely with a member of health or social care staff who uses NHSmail, please direct them to the document: Encryption guidance for senders January 15 in the NHSmail training and guidance pages at: in the section ing sensitive or patient identifiable information. Receiving an encrypted An encrypted will be sent from an NHSmail address and will contain a link to access the encrypted message. The message reads: TREND MICRO PRIVATE AND CONFIDENTIAL You have received an message Secured by Private Post. Please open the file called Encrypted_Message.htm for instructions on how to read your . Example received Copyright 2014, Health and Social Care Information Centre. 3

4 Fig 1. An encrypted NHSmail message in Gmail Open the file Encrypted_Message.htm. Your browser should allow you to either view the file directly or to download and then open the file. It is not necessary to install the Private Post Helper software to read encrypted s. Fig 2. The Encrypted_Message.htm file Click Open my in the Encrypted_Message.htm file. Not registered? If you have not previously received an encrypted NHSmail you will be redirected to an external website which will guide you through the registration process to create an account with the NHSmail encryption provider. See the section on Registration in this document. If you have registered with the NHSmail encryption provider, the system may display the Account Verification screen (Fig 3). If the screen does not display your correct address, click Change. Enter your Password. Or click Forgot your password or answers? if you have forgotten your password. Select a time from the Keep me signed in list. Click Continue. Copyright 2014, Health and Social Care Information Centre. 4

5 Fig 3. Account Verification The system will display the encrypted message sent to you from NHSmail Fig 4. A test encrypted You will be able to o Read the From, To, Sent and Subject information o Read the message o Reply to the sender o Reply to all recipients o Forward the o Download attachments Copyright 2014, Health and Social Care Information Centre. 5

6 Reply to and forward encrypted s You can reply to or forward encrypted s. Your s will be automatically encrypted. You can include attachments if required. Open an encrypted NHSmail Enter your password if the system prompts for it Click Reply or Reply All or Forward (as required) Enter the recipients in the TO: CC: and BCC: fields Edit the Subject field (as required) Add attachments (as required) Enter a message Click Send Copyright 2014, Health and Social Care Information Centre. 6

7 Fig 5. A decrypted Registration If you have not previously received an encrypted from the Trend Micro encryption service you will be redirected to the Trend Micro Private Post website. There you will be guided through the registration process to create an account with the NHSmail encryption provider. Registered recipients don t need to re-register to read subsequent encrypted messages sent from any NHSmail user. Start of registration Fig 6. Start of Registration Copyright 2014, Health and Social Care Information Centre. 7

8 If your address is not correctly displayed, click the (Not your ?) link Click Register The Register Encryption Account screen will be displayed. Copyright 2014, Health and Social Care Information Centre. 8

9 Register encryption account Fig 7. Register Encryption Account Complete all fields and tick the agreement box. Enter and confirm your password you will need to use this password to open encrypted s sent to you Select a security question and answer Select an Identification Word (that will appear on authentication screens) Type in the code displayed in the CAPTCHA image (the obscured code at the bottom of the screen aimed at preventing spam and fake registrations) Tick the box to confirm agreement to the Licence and Terms Click Continue The Check your to activate your account screen will be displayed. Copyright 2014, Health and Social Care Information Centre. 9

10 Check your to activate your account Fig 8. Check your to activate your account A message prompts you to check your inbox for a registration confirmation message and follow instructions in the message to confirm your encryption account. Click Close Page Registration confirmation message Fig 9. Registration confirmation message Open the Registration confirmation message in your Inbox. (If you do not see a Copyright 2014, Health and Social Care Information Centre. 10

11 registration confirmation in your Inbox, check your spam folder.) Click the link in the Registration confirmation message. Authentication Successful The Authentication Successful message will be displayed. Fig 10. Authentication Successful message Click Close Page This will complete your registration. Once you have successfully registered, you will be able to open, read and download any attachments in encrypted NHSmail s. Once you have completed registration, you are registered to receive encrypted from any NHSmail user and do not need to register again if another NHSmail user sends you an encrypted . To read and reply to another encrypted message you just need to verify your identity using the credentials you registered when you first signed up to the service. If you forget your password, the system includes a self-service password reset feature. If another organisation sends you an encrypted using the same Trend Micro encryption, your Trend Micro account credentials can be used to decrypt these messages too. Authentication screen once an account has been created: Copyright 2014, Health and Social Care Information Centre. 11

12 N.B. You do not need to click on the Want to Reply? link to use the service. Keeping encrypted s secure If you click on Want to reply click here to find out more (shown in screenshot above), you ll be given the opportunity to install a Microsoft Outlook add-on that will provide you with the means to send encrypted replies to s that you receive. You should be aware though that if you install the add-on to a shared computer, someone else could see confidential messages you have received. Before replying to an encrypted , ensure that the recipient is expecting it and is ready to handle the contents appropriately as part of an agreed clinical, or business partner sensitive data workflow, particularly if it contains sensitive or patient identifiable information. If you wish to keep any received s we recommend you download them and store them safely as required. Although all attachments sent or received through the NHSmail encryption service will be virus checked we do recommend you run your own anti-virus software. For third party organisations: please note it is your responsibility, on behalf of your employing organisation, to safeguard any data received in line with the data protection and information governance requirements agreed between your organisation and the sending organisation. You should retain unencrypted copies of any encrypted received in your local information repositories. If you are a patient and are receiving information from health or social care staff using the NHSmail service, you should have given consent to the organisation to exchange information with you before they send it. Once received, it is your responsibility to look after any sensitive information sent to you. You should consider whether the computer on which you access the information is shared with other people if so they may be able to view any information you receive. There are Copyright 2014, Health and Social Care Information Centre. 12

13 various excellent sources of guidance on how to keep information secure such as Help and further guidance For help please visit the Trend Micro support site at: Or you can call the national NHSmail helpdesk on or Recipients of NHSmail encrypted s that require help with registration should refer to the help provided on the registration website. Frequently asked questions Q: What is the maximum number of addresses that can be included on a reply to an encrypted or when the is forwarded? A: You can reply to, or forward the encrypted to a maximum of 200 recipients. Q: If I want to forward an encrypted I ve received to someone else, will the remain encrypted? A: Yes. Any recipient added will receive the message securely (encrypted). Q: Is message tracking (e.g. delivery or read receipts) available on encrypted s? A: No. delivery over the Internet has no guarantees that a message will reach its intended recipient as Internet can be silently lost. Q: What is the maximum attachment size I can send on encrypted replies / forwards? A: 20Mb Q: What types of attachments can be included on encrypted replies / forwards? A: Certain file types that can contain potentially harmful content are blocked by the NHSmail service and cannot be sent or received. The list of blocked attachments is below: File type avi bas bat chm cmd cnt com cpl crt Description Audio Video Interleaved animation file BASIC programming files DOS batch file MS compiled HTML help file OS/2 or Windows NT batch file Helpfile contents 16-bit DOS executable Windows Control Panel extension Security Certificate Copyright 2014, Health and Social Care Information Centre. 13

14 exe hlp hta inf ins isp js jse lnk Mdb mpe mpeg mpg mp2 mp3 msc msi msp mst pcd pif reg scr sct shs vbe vbs wsc wsf wsh DOS or Windows 16/32 bit executable Windows help files: 16-bit executable HTML file Windows installer setup file - 16-bit executable Internet naming service Internet communication settings JavaScript file. JavaScript encoded script Windows shortcut file Microsoft Access file format MPEG Movie Clip MPEG Movie Clip MPEG animation MPEG audio file mp3pro Audio file MS common console doc Windows installer file Windows installer patch Visual test source file Photo CD image` Program Information File Windows registry file Screen saver Windows script component Windows scrap object Visual Basic encoded script Visual Basic script Windows script component Windows script file Windows scripting host settings file Copyright 2014, Health and Social Care Information Centre. 14