Setting up and using secure email as an adult social care provider
How to set up a secure email service that meets the secure email standard if you provide adult social care.
Applies to England
Information about the health and care of people you support is sensitive and must be shared securely.
To meet this secure email standard (DCB1596) you must use a secure email service when sending confidential or personal information.
Choose a secure email service
You can use:
- NHSmail (now called NHS.net Connect)
- another secure email provider (such as Microsoft 365 or Google Workspace) and meet the secure email standard
- your own email service and have it accredited against the standard
For most social care providers, NHS.net Connect will be the simplest option.
NHS.net Connect is the national secure collaboration service for health and social care in England. It’s available free of charge to eligible organisations and already meets the secure email standard.
If you use Microsoft 365, Google Workspace or another email service, you must make sure it meets the requirements of the standard.
Secure email will enable you to:
- communicate with GP partners more easily
- order prescriptions more easily
- send secure and standardised patient discharge summaries
- increase collaboration over hospital admissions and appointments
- have simpler processes for ordering blood and urine tests
- reduce time on admin tasks
- access the NHS directory
You will also be able to access support with setting up and managing your account from the National Administration Service (NAS).
To use NHS.net Connect, you must first complete The Data Security and Protection Toolkit to at least ‘approaching standards’.
Check if you can use NHS.net Connect
NHS.net Connect is free of charge to:
- Care Quality Commission (CQC) registered care providers in England
- some organisations that provide publicly funded health and social care services
Read the NHS.net Connect access policy for full eligibility information.
If you’re unsure whether your organisation is eligible, contact feedback@nhs.net.
Set up NHS.net Connect
How you apply depends on whether your organisation manages its own IT systems and user accounts.
Organisations that need NHS.net Connect support
If your organisation does not have its own IT function, you can register through the National Administration Service (NAS).
NAS will provide support with setting up and managing your NHS.net Connect account.
By registering you can:
- access a helpdesk
- use email addresses ending in @nhs.net
- get one shared mailbox and up to 10 named user accounts
Organisations that manage their own IT
If your organisation has its own IT function and can manage NHS.net Connect accounts internally, you may be able to apply for self-management. This allows your organisation to manage user accounts, passwords and access arrangements directly.
Register using the self-management application form (Word, 87KB). Your head office, or the site the accounts will be managed from, should complete the form.
Organisations commissioned by another provider
If your organisation has been commissioned to provide services, the commissioning organisation may be able to provide NHS.net Connect accounts through its existing arrangements. Contact your commissioning organisation for more information.
Non-CQC-registered services
If you are not CQC-registered but meet the criteria for using NHS.net Connect, read and sign the NHSmail Access Policy Document (PDF, 144KB) and send it to feedback@nhs.net.
Getting started with NHS.net Connect
Once your NHS.net Connect account has been set up, follow the NHS.net Connect guidance for social care providers to:
- access your account
- set up users
- manage passwords
- use NHS.net Connect securely
If you need more help setting up NHS.net Connect contact helpdesk@nhs.net.
Using NHS.net Connect securely
Using NHS.net Connect means your organisation already meets the secure email standard.
You must still follow the NHS.net Connect acceptable use policy.
Using another email service
If you do not use NHS.net Connect, your organisation must still meet the secure email standard. The requirements depend on the email service you use.
The process for meeting the standard is different depending on whether you use:
- Office 365 or Google Workspace
- a different email service, which you must self-accredit
Find out more about the secure email standard on the NHS England website. This includes information about:
- how to meet the standard using other email services
- whether your organisation’s email system is accredited on the national list of accredited organisations
After your service is accredited
Once your service is accredited, it will be included on the national list of accredited organisations. This helps other organisations identify email services that meet the secure email standard.
You should make partners aware that your email domain is accredited and encourage them to add your domain to their ‘allow’ list.
Ask your IT supplier to:
- add other accredited organisations to your allow list
- use an encryption tool for emails from non-accredited senders
You will need to update your list regularly as organisations are added and removed from the accredited list.