NHSmail

For several years, community pharmacies in England have been able to request a pharmacy shared NHSmail mailbox. To access this, users must have their own personal NHSmail account which is linked to the shared mailbox.

Pharmacy shared NHSmail mailboxes use the following naming conventions:

Previously, the shared mailboxes followed a nhspharmacy.location.pharmacynameODScode@nhs.net naming convention, but following lobbying from Community Pharmacy England and others, this was amended in 2020 to the above, shorter format email address for virtually all pharmacies. The original, longer email address is now an email alias for the mailbox, so any emails sent to that email address will continue to be delivered to the shared mailbox.

NHS pharmacy shared NHSmail accounts are managed by NHS Digital’s National Administration Service (NAS) inside the ‘nhspharmacy’ container within the wider NHSmail system.

Personal NHSmail accounts can be linked to pharmacy shared NHSmail mailboxes, so the holder of the personal account can access the shared mailbox.

If your shared pharmacy mailbox is not yet aligning with the usual naming format pharmacy.ODScode@nhs.net a query should be urgently raised, so that the email address can be adjusted to the proper naming convention and preventing risk that the pharmacy might miss some messages intended for the pharmacy.

From 9th November 2020, under the NHS Terms of Service, contractors must ensure their staff have access to, and are able to send and receive NHSmail from, the pharmacy shared NHSmail mailbox. To meet this requirement, contractors must ensure that at least two members of staff at the pharmacy premises have live personal NHSmail accounts that are linked to the shared mailbox.

Contractors will therefore need to ensure that:

• they have a shared NHSmail mailbox for each of their pharmacy premises, which meets the pharmacy.ODScode@nhs.net naming convention;
• those staff that will need to send and receive NHSmail from the shared mailbox have live personal NHSmail accounts which are linked to the shared mailbox;
• there are sufficient staff with linked personal NHSmail accounts to ensure that the shared mailbox can always be accessed when the pharmacy is open, including when locums are acting as the responsible pharmacist;
• staff are reminded of the need to regularly check the shared NHSmail account and respond accordingly to emails that have been received; and
• the linked personal NHSmail accounts are regularly reviewed so that where staff leave the employment of the contractor, their personal NHSmail account is unlinked from the shared NHSmail account in order to avoid any data breaches.

If you want to obtain a shared NHSmail account for your pharmacy, you can do this via the community pharmacy NHSmail registration portal.

Working through this process will include the creation of up to three personal NHSmail accounts which will be used to access the shared NHSmail account. The process is explained in Community Pharmacy England Briefing: How to complete the NHSmail registration process.

Once you have completed your registration using the portal, you will be sent login details for the personal accounts so that you can activate them and then log into your shared NHSmail account.

When you first login to your personal NHSmail account, review and accept the user agreement which should pop up on your screen. Each NHSmail user within your pharmacy should activate their account by logging in using their individual login details. After each staff member has accepted the user agreement, they should receive an email which explains that activation has taken place.

If you are having difficulties with activating your account, raise a technical query. The NHSmail team will support you through the process.

Having problems finding your pharmacy in the registration portal?

During the registration process, if you are unable to locate your pharmacy within the portal, please raise a technical query and they will support you through the process (refer to the technical escalation section below).

If your pharmacy has had a shared NHSmail mailbox in the past, your pharmacy may not be selectable by default within the NHSmail registration portal. If your pharmacy is new or has a recently changed ODS code, there may also be a period of time until you can use the registration portal to set-up an account (see our ODS change checklist for more information). This can rely on other organisations such as PCSE, NHSBSA, DSPTK and the NHS Digital ODS team to have processed the ODS code changes. You should also use the NHSmail technical escalation query set out within the section below.

Already have a shared NHSmail account for your pharmacy?

Some pharmacies already have an NHSmail account for their pharmacy. This may be a shared mailbox, which users log into using a personal NHSmail account (i.e. the shared mailbox cannot be logged into directly), or it may be an NHSmail account which has been created for the pharmacy using a personal NHSmail account. NHS England and NHS Digital want all pharmacies to have shared mailboxes with email addresses in the pharmacy.ODScode@nhs.net format, which can only be accessed by authorised users who log in using their personal NHSmail account.

If you already have a pharmacy NHSmail account, but it is not a shared mailbox in the pharmacy.ODScode@nhs.net format, follow the above process to request a shared NHSmail account.

If you are joining a community pharmacy and already have an NHSmail account, you will need to ask the shared mailbox owner to link your account to the premises shared mailbox. If required, a technical query may be made for assistance.

If the new staff member does not have a personal account already, and the pharmacy has less than 10 user accounts, the shared mailbox owner will need to raise a query with the pharmacy national helpdesk from their shared NHSmail and to helpdesk@nhs.net to ask for the personal account to be created. The request will need to include: Pharmacy team members complete name, alternate email address and their mobile phone number.

The new staff member will need to provide the shared mailbox owner with their mobile phone number as the password will be sent to via a text message.

If your pharmacy already has 10 user personal accounts created, the shared mailbox owner may need to email the regional NHS England and NHS Improvement team, stating the reasons why more than 10 accounts are required to be connected to the shared mailbox, and asking them to approve an additional account being created. If the additional request is approved, the regional team will need to email the pharmacy national helpdesk at helpdesk@nhs.net stating that your additional account has been approved and asking for the account to be created and linked. Again, the new staff member will need to provide their personal mobile phone number as their password will be sent to them via a text message.

The new staff member should ensure their personal account is linked to the shared account after their personal account has been created. Either the NHSmail pharmacy owner, or the NHSmail team should be able to help with the linking.

Once pharmacy staff leave a community pharmacy they may also be unlinked in the same way.

Multiples head office staff can also create personal accounts by selecting a branch and being linked into one.

If related queries to the pharmacy national helpdesk require escalation, the pharmacy NHSmail owner should carefully follow each of the steps set out within the NHSmail escalation process.

NHS Digital has developed a guide which explains how to make use of NHSmail: Guide for community pharmacies using NHSmail (2017). This guide includes information about:

• logging in;
• the Shared Mailbox Owner;
• email signatures;
• setting auto responses;
• what to do if your name changes;
• training links;
• forgotten password process;
• locked account process;
• using the NHS Directory to find people; and
• service status.

Mobile devices

The NHS Digital Mobile guide for NHSmail (2019) explains the requirements for use of NHSmail on mobile devices such as Smartphones.

Pharmacy contractors may access NHSmail via their Smartphone web browser.

Following the Winter 2020 NHSmail upgrade, pharmacy contractors may also be able access the pharmacy shared NHSmail inbox using the Outlook mobile app.

Advice about ‘Bring Your Own Device policies’ can be found at:

• Using mobile devices; and
• the Pharmacy BYOD template policy 8B available at Data security templates.

Pharmacy NHSmail users that wish to use NHSmail on mobile devices will also have to be aware of various practical considerations, such as:

• Passcode/biometrics settings.
• Preventing access by others.
• Considering adjusting auto-preview of messages on home-screens if required.
• Having the ability to remotely wipe the device if stolen.
• Storage and archive settings.
• Processes if you will leave the pharmacy (the account may be removed from the Outlook app and you or your pharmacy team may unlink your personal account from the shared pharmacy mailbox once this becomes required).
• Pharmacy contractor policies may set out that if a staff member’s Outlook NHSmail notifications are enabled, that the ‘Do Not Disturb’ mode is used or auto-scheduled to prevent notifications arriving outside of work hours, or during working times when interruptions are not wanted.

Using NHSmail to send text messages to patients’ phones

Some pharmacy system suppliers enable you to send SMS text messages or email reminders to patients that want these messages via a special type of NHSmail pharmacy account called an NHSmail ‘application account’.

The process to set this up may involve:

• The contractor’s NHSmail administrator will need to set-up an NHSmail ‘application’ account linked to the pharmacy shared mailbox (this counts as using one of the standard allowance of up to ten individual email accounts linked to the shared pharmacy mailbox);
• The contractor’s NHSmail administrator contacts the pharmacy NHSmail admin helpdesk to request that the ‘application NHSmail account’ be set-up and enabled (the service route process for raising technical queries is outlined at within the ‘Technical queries and escalation’ section).
• There are some naming considerations for the application NHSmail account – the account email address should not be named a person, but it can be named reminders.[ODS code].donotreply or similar. ‘Donotreply’ can be added because this may be an unmonitored email account.

Activating your personal account

To access and activate your personal NHSmail account for the first time use this process:

1. In your internet browser, go to https://portal.nhs.net
2. Click on the login button in the top right
3. Enter your new email address in the email address box: *.******@nhs.net
4. Enter the password sent to your mobile phone in the password box

Once you have successfully logged into your account for the first time, you will be asked to change your password, create some security questions and accept the Acceptable Use Policy. These steps must all be completed before you can send emails from your new account.

After doing this, you will also be able to log in to Microsoft Teams. This will allow you to conduct video and audio calls, as well as instant message, with the people you need to work with across Health and Care.

Managing emails which go into your junk folder

It is recommended to regularly check the junk folder in case some legitimate emails are received into this.

There is a process to mark emails as legitimate, so that they may go into the main inbox the next time. See NHS Digital guidance: Managing the NHSmail junk folder

The NHSmail team announced in 2023 that multi-factor authentication (MFA) is set to become mandatory across the platform for all NHSmail users from 2024.

Community Pharmacy England said in early news stories that this would be expected to become mandatory from early 2024, however the timelines were shifted for the community pharmacy sector.

What is MFA?

Normally you use your email address and password to log into your NHSmail account. MFA is an additional way of checking that it is really you when you log in to your account and this will eventually be the default for all NHSmail user accounts.

MFA has been around for some time on the platform, and you may already be using it in NHSmail (or in your personal life such as for online banking). It is currently an optional feature, but there are many benefits to it. The NHSmail team have said that:

• More than 99.9% of accounts compromised by cyber attacks can be blocked by using MFA (Source: Microsoft, 2022)
• MFA can prevent disruption to patient care, referrals and appointments
• MFA helps keep any patient data in a more protected environment

As online working becomes the norm, so does the need to keep yourself and the data you work with safe.

NHSmail is a secure communication platform and MFA is intended to help keep it that way. It is being introduced across all NHSmail user accounts.

What does this mean for pharmacy NHSmail users?

Pharmacy NHSmail users can enrol for MFA, prior to it becoming mandatory, using one of the three methods below. We would recommend using the Authenticator App as it is the strongest form of security, and many users find this method the easiest.

Usability and how to try MFA

Read more within this step-by-step guide for trying pharmacy NHSmail MFA.

Let us know how you get on, by sharing your feedback via cpe.org.uk/itfeedback

Timelines for mandatory NHSmail MFA (updated 24th July 2024)

New users of new personal NHSmail: They must set-up accounts with MFA – expected during the week commencing 29th July 2024.

Existing users of personal NHSmail: From Autumn 2024 NHSmail pharmacy users must have MFA. Ahead of this: users will receive a pop-up notification around the 19th August, asking them to register an MFA authentication method when logging to their account. This prompt can be snoozed for a period of 14 days. If MFA has not been arranged by 2nd September 2024 access to the personal NHSmail account will change:

• Enhanced password policy including having to reset your password on 2nd September and requiring a minimum of 20 characters
• Not having persistent browsing sessions
• Restrictions on sign in frequency
• Password expiring every 90 days

Any NHSmail user can use the People Finder tool to search the NHS directory for local colleagues’ NHSmail addresses and more. The Using the NHSmail’s People Finder factsheet summarises the tool and its use.

The People Finder tool can be used to find individuals’ NHSmail addresses, or organisations’ shared NHSmail boxes, if they exist. The steps below describe how to use People Finder to send an NHSmail message to a new contact.

Access People Finder

Go to portal.nhs.net/PeopleFinder and log-in; or go to the NHSmail portal (portal.nhs.net) and select ‘Login’ (top right), and ‘People Finder’ from your menu options. Note: You can’t ‘auto-switch’ from Outlook NHSmail web to People Finder unless you use bookmarks or insert the website into the address bar.

Top tips

• Look-up an organisation’s ODS code and search for it, if needed: NHS Digital’s ODS search portal (odsportal.digital.nhs.uk).
• You should separately bookmark (or ‘add to favourites’) three webpages: People Finder, Outlook NHSmail web and NHSmail Portal  into your web browser, so that you can quickly reach any of those webpages directly with just one click.
• You can advise NHSmail-using colleagues to bookmark and use People Finder.
• Favourite NHSmail ‘contacts’ that you need to stay in touch with.

Factsheet

Using the NHSmail’s People Finder

There are a range of points that need to be considered when planning how NHSmail accounts should be used. The following issues to consider have been collated from feedback from pharmacists that have already used NHSmail.

• Links in emails to external websites – many pharmacies have strict controls on what websites can be accessed from the pharmacy computer. In some cases staff can only access a list of sites that have been pre-approved by a company Head Office;
• Managing access rights – who will have access to the shared mailbox and how will this access be managed? What processes are in place to ensure access rights are maintained when there are staff changes?
• Storing information received – storing records of clinical communications is important for clinical governance reasons. NHSmail is designed to support the transfer of information, not the storage of information. Whilst some information could be copied across to the notes in the patient’s pharmacy record, particular consideration will need to be given to how attached documents are stored (including arrangements for data back-up and appropriate access controls);
• Sending patient information – NHSmail is the only NHS approved method for exchanging patient data by email, but only if both sender and recipient use an NHSmail account or if sending to another government secure domain such as GSi (*.gsi.gov.uk) or CJX (*.police.uk or .pnn.police.uk). In addition to ensuring the recipient account is secure, it is important to check that the recipient is prepared to accept the information by email, check that information is being sent to the correct email address and indicate the sensitive nature of data in the header;
• Information Governance – appropriate information governance procedures need to be put in place if NHSmail is used to transfer sensitive information. As NHSmail can be accessed anywhere, it is not possible to limit access rights to a particular location, for example from within a pharmacy. Also NHSmail can be linked to a wide range of mobile devices – if this option is used, provision needs to be made for the event that they are stolen or lost, for example a process to activate self-wipe capability. Approaches by which safeguards around the use of NHSmail could be integrated into existing IG resources required for compliance with the NHS Information Governance Toolkit include:
  • Outlining the expectations on staff use of NHSmail in the pharmacy confidentiality code of conduct (Requirement 214).
  • Outlining how personal information will be handled if  received by email, for example in the pharmacy’s safe haven procedures (Requirement 322).
  • Providing guidance on the use of NHSmail in the pharmacy’s data transfer procedures (Requirement 322).
  • Where the service is accessed from mobile devices, providing additional guidelines for staff on mobile computing (Requirement 318).
  • General guidance on the NHS Information Governance requirements can be found in the NHS IG section of this website.
• Regulatory information in business letters – a requirement was introduced by the Companies (Registrar, Languages and Trading Disclosures) Regulations 2006 for companies in the UK to include certain regulatory information (e.g. company registration number, place of registration and registered office address) in their ‘business letters’ (which includes emails). In October 2009, similar requirements were introduced for sole traders and partnerships (with special provision for partnerships of more than 20 persons) and Limited Liability Partnerships. Although individuals can set up personal ‘email signatures’ in NHSmail, there is no way at present, via the NHSmail service to set up an automatic footer/signature stamp so that a company can ensure all emails sent by their employees contain the necessary information. Failure to include the information required in the Regulations would be a breach of the Companies Act 1985, and could render companies liable to a substantial fine.

See also: Raising NHSmail technical issues and escalation factsheet

In the event of a technical NHSmail query:

1. Prepare an email for helpdesk@nhs.net with the question.

2. Where possible, send your email from your NHSmail inbox (from either your shared pharmacy mailbox or from your personal NHSmail inbox depending on the query type). Use another email address if required because you can’t yet access your NHSmail.

3. Generally you shouldn’t need to ask your question by phone. The general NHSmail national phoneline desk may be able to help in certain limited scenarios (0333 200 1133), however it is strongly recommended that you email your query.

4. Your email question should be short and clear and include information:

• question;
• name;
• your position;
• pharmacy name;
• ODS code;
• contact telephone number; and
• relevant NHSmail email addresses (i.e. usually both the shared mailbox address and your personal NHSmail email address).

5. The NHSmail team usually will reply by email before two full working days passes. If you cannot find a reply within this time, that would be unusual and you should check your ‘Junk’ email folder. On occasion you might be contacted by phone if you have provided the right phone details.

6. If NHSmail team have written an email reply to progress resolution, they may have supplied information or suggested steps within the ‘Resolution Information’ section of the email that they have sent you. This might include: information; actions for you to perform; and queries for more information so that the technical issues can be further understood.

7. Ticket status: If ‘Resolution information’ has been given to you, then the ticket may be held in a resolved state and closed automatically soon after if no response is sent by you. Carefully check that you’ve followed any suggested steps made within the ‘Resolution information’ section.

8. Ticket re-review/reopening: Two options for re-review or follow-up:

• Option A: The email with resolution information may include a link which can be clicked/selected to have a ticket re-reviewed, this may generate generate an email with ticket ref to an Accenture email address. You may cc helpdesk@nhs.net. Note that the Accenture tech firm support NHSmail.
• Option B: Prepare an email for helpdesk@nhs.net, ‘paste’ your original email query(ies) at the bottom of the chain and NHSmail reply email(s) immediately above. Include your new follow-up question at the very top of the email. Include the incident reference number (INC number) in the subject.

9. Escalation: Keep all of the emails just in case further escalation is required. You may escalate to Community Pharmacy England by emailing it@cpe.org.uk (and include all the the email correspondence which you sent and received) if you have a single or systemic issues that you are struggling to resolve with the NHSmail team and you have tried the above. Community Pharmacy England may then support you with re-raising your question.

During the late part of 2020, the NHSmail team undertook work to improve the NHSmail service and pharmacy and other NHSmail accounts were upgraded.

The upgrade involved:

• the system being moved to the Microsoft 365 platform;
• a range of Office 365 apps and features, some of which you already have access to, such as Microsoft (MS) Teams;
• new functionality e.g. ability to create a meeting within MS Teams; and
• ability to add the pharmacy shared mailbox into your Outlook mobile app.

All pharmacy accounts were upgraded by February 2021.

Read more about the new features at:

Community Pharmacy England one-page factsheet: Pharmacy NHSmail accounts upgrade.

All community pharmacy contractor NHSmail users have ability to access MS Teams, and are encouraged to download and test the use of the tool.

The NHSmail team previously upgraded pharmacy NHSmail accounts in late 2020, to further improve the NHSmail service including extra Teams functionality.

How to use MS Teams and tips

• Download the Teams apps on your computer and mobile devices.
• Encourage NHSmail using team members within the same pharmacy to download the Teams app.
• Use MS Teams as an audio / text / video communication tool for your pharmacy work and collaboration with NHSmail users within and outside of your own pharmacy.

Read more: NHSmail MS Teams and upgrade factsheet and Pharmacy video conferencing.

NHS Digital are seeking pharmacy contractor volunteers to take part with trialling the NHSmail Virtual Visits booking and consultation platform.

During the pilot the Virtual Visits tool will be able to be used to record face-to-face or virtual consultations. The tool is associated with NHSmail Microsoft Teams. It enables an interface that patients and pharmacy staff can use to arrange and carry out a consultation.

Prerequisites for community pharmacy team members taking part with the pilot:

• an active personal NHSmail account;
• access to shared NHSmail inbox;
• MS Teams is installed on computer or tablet;
• participation with the pilot instructions including the testing of the booking and consultation features of Virtual Visits;
• a computer or device with a webcam.

Community Pharmacy England is supporting the research because pharmacy contractors commenting on their IT systems and portals will help the development of more usable digital tools.

Participants will be granted access to the Virtual Visits platform and will be able to use the platform to comment on technical experiences, the setup process and usability.

Participants from across the pharmacy sector including those who do not always adopt IT early are welcomed. The research intends to help make the tool easy-to-use for any pharmacy staff member in the event of wider roll-out. This current stage of the pilot takes place approx Feb 2022 onwards.

How to get involved?

To volunteer to take part or find out more about what is involved please email it@cpe.org.uk with ‘Virtual Visits pilot’ in the subject title and please confirm your ODS code and pharmacy name. Community Pharmacy England will provide additional information or pass your information to the project team so that you can take part.

Information for pilots

Community Pharmacy England and NHS Digital worked on a guidance checklist for use by pharmacy team pilots, and can learn about the tool within this How does Virtual Visits work for pharmacy pilots factsheet.

Read more about: Pharmacy remote consultations.

Consider:

• Using the mobile Outlook app and customizing your settings using Community Pharmacy England’s Outlook mobile app factsheet.
• If you use Outlook web within your internet browser, add the inbox to your favorites, or set it as the homepage for when you open the internet.
• If you will not be using your NHSmail account frequently for a certain period, e.g. because of a change to your job role, you could set a diary reminder to send yourself an email once a fortnight to keep the account active [i.e. used within each 30-day period]. Or get your account set to ‘disabled’ to freeze it for a longer period of time, e.g. over a month.