Recipients Guide for Email Encryption Version 1.2 Document Location n/a Copies can be requested from the IT Dept 01603 50 8622 Revision Previous Revision by Summary of Changes Version date revision date number April 2010 N/A MP Initial Draft 1.0 Nov 2010 April 2010 MP NCHC new address/logo and additional steps 1.1 Feb 2011 Nov 2010 MP Additional information on password process & helpful information 1.2
Quick Links Introduction Scenario Secure Reply Helpful Information
Introduction Norfolk Community Health and Care NHS Trust (NCH&C) has a responsibility to ensure that all potentially sensitive and/or patient identifiable data sent from the organisation is secure in transit. To ensure this responsibility is met NCH&C has introduced an email encryption solution. This document has been created for recipients of emails sent from NCH&C as a leaflet on how to access encrypted emails. To help explain the process step by step a scenario has been created. In the scenario Iain is the NCH&C employee and Matthew is the external recipient. The steps that Matthew performs will be the same for all recipients no matter what the email address. (i.e. fred.bloggs@btopenworld.com fred.bloggs@yahoo.com etc etc). For this scenario a nhs.net address has been used simply to illustrate the process. Scenario Iain (iain@nchc.nhs.uk) is sending Matthew (matthew@nhs.net) an email that requires encryption. When Iain (iain@nchc.nhs.uk) sends Matthew (matthew@nhs.net) the email, Matthew will receive email informing him that Iain has sent him a message and in order to retrieve the email (and any attachments) Matthew will need to register a password that will be used to encrypt the email. A screen shot of this is below (image 1); Image1
In order for Matthew to receive the encrypted email he must register a password that will be used for the encryption. To do this Matthew must click on the link in the email (Image1). This process is explained in the email that Matthew receives as shown in Image1. Once Matthew clicks the link he will be directed to the page shown below (Image2); Image2 Matthews email address will appear in the top box. Matthew enters a password and confirms his password. The password requirements will all turn green once the minimum criteria have been met. Matthew then clicks the register button and then sees the success screen (Image3) the email will then be delivered to Matthew s inbox.. Image3 If Matthew does not see this success screen then the password creation was not successful and Matthew should close the window and re-click the link in the email from Iain (image 1)
The encrypted email has been delivered to Matthew as shown in image 4. The message (and any attachments if applicable) from Iain will be contained within the attachment (circled in image 4); Image 4 The message that Iain sent to Matthew (and attached documents if applicable) can be viewed by clicking the attachment as circled in image 5. Some email clients will display multiple attachments, the one containing the message will start with the senders name (in this case Iain) contain the date and end with the letters PDF. Upon opening the attachment Matthew (the recipient) will be prompted for the password (image5). Image5 This is the password that Matthew created earlier in the process. The password created by Matthew will remain valid for all encrypted emails received from any NCH&C sender. The password will only become invalid if a period of 30 days elapses during which Matthew receives no encrypted emails from any NCH&C sender.
Iain does not know the password that Matthew created nor does he need to know. The password and the management of the password(s) is Matthew s responsibility. Once Matthew enters the password, the email and any associated attachments will be displayed as shown below (image6); Image6 Matthew will be able to view the email as shown in image7. Every email that is encrypted will be headed with a banner page. This banner page is for information purposes and cannot be removed. It will be attached to all emails that are encrypted. A copy of the banner page is attached to this document for reference (Appendix A) Matthew can save the attachments and work on the data as he would any other email.
Secure Reply Matthew has the option of replying to Iain and making use of the encryption ensuring that the reply to Iain is protected by the same encryption tool. Iain has no input in this process. In order for Matthew to make use of the secure reply to Iain, he needs to click on the reply button located within the encrypted attachment (circled below in image7) Image7 Once Matthew has clicked on the reply button within the message he will be directed to a web page where he will be able to compose his secure reply (and attach any files as necessary) as shown in Image 8. Image8
Once the message has been created and any file attached, Matthew must click the Reply button below the text box to send the message If Matthew has forwarded the email to another user, this new recipient will be able to reply via the Secure Reply but the mail will be sent to Iain as the email originator and will be copied to Matthew as the original recipient. If Matthew wants to reply to Iain but not make use of the secure reply then he can simply reply to the email as if it were any other mail by using the normal reply button within their email client.
Helpful Information This section of the documentation is designed to give the recipient a better understanding of the solutions purpose and best how it can be used. Purpose and Use The purpose of the encryption solution is to ensure that all sensitive and/or person identifiable data when being transferred by email is suitably secure. It is not the intention of the solution to provide a secure storage of data. When a recipient receives an encrypted email it is strongly recommended that the information within the email and any attachments are saved out from the email and stored locally with any other data you may have (for example, within your My Documents folder). Once the information has been saved out from the email, the email may then be deleted. Please note: The reasons for encouraging this are that the encryption has served its purpose and the data has successfully arrived at its destination, therefore the encryption is no longer needed. It is worth noting that if a password to an encrypted email is forgotten, the information within the encrypted email cannot be retrieved. The recipients password can be reset, but this will not allow access to any data previously encrypted with another password. This is another reason we would encourage recipients to save information out of the email at the earliest convenience. Passwords When a recipient registers a password to receive encrypted email, this password is used to un-encrypt all emails sent from NCH&C as long as a 30 day time window has not passed between receiving encrypted emails. If a 30 day window has passed it is possible to register the same original password to receive new emails. The encryption server does not require unique passwords when re-registering. If you are part of an organisation that is likely to receive a number of encrypted emails to different individuals, it may be worth agreeing a standard organisational password for all encrypted emails sent by NCH&C. This way your organisation can avoid any confusion associated with multiple recipients having multiple passwords and all encrypted emails can be opened by all staff with one organisational password. (note, it is still recommended if using this approach to save information out from the encrypted email at the earliest convenience). Need to Send Data Encrypted to NCH&C? If your organisation has a need to send some data to NCH&C and feel it would be more appropriate to be sent encrypted, you have the option to contact the intended recipient at NCH&C and request an encrypted email to be sent to yourself. It is then possible to make use of the secure reply functionality and reply whilst making use of the NHC&C supplied encryption solution. (For more information please see the secure reply section of the guide)
Appendix A Encrypted Email Message This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Recipients should be aware that all emails received or sent by this Trust are subject to the Freedom of Information Act 2000 and therefore may be disclosed to a third party. Access attachments via the attachment tab in the left corner of your screen or by clicking the following menus View, Navigation Panels, Attachments To reply securely to this email click the reply button on the next page. This will reply to the original sender of the message maintaining the secure encryption Please scroll down to find the email message