NHSmail

For several years, community pharmacies in England have been able to request a pharmacy shared NHSmail mailbox. To access this, users must have their own personal NHSmail account which is linked to the shared mailbox.

Pharmacy shared NHSmail mailboxes use the following naming conventions:

Previously, the shared mailboxes followed a nhspharmacy.location.pharmacynameODScode@nhs.net naming convention, but following lobbying from Community Pharmacy England and others, this was amended in 2020 to the above, shorter format email address for virtually all pharmacies.

The original, longer email address is now an email alias for the mailbox, so any emails sent to that email address will continue to be delivered to the shared mailbox.

All pharmacy shared NHSmail accounts are managed by NHS England’s National Administration Service (NAS) inside the ‘nhspharmacy container’ within the wider NHSmail system.

Personal NHSmail accounts can be linked to pharmacy shared NHSmail mailboxes, so the holder of the personal account can access the shared mailbox.

Terms of Service requirement to access NHSmail

Since 9th November 2020, the NHS Terms of Service have required that pharmacy owners must ensure their staff have access to, and are able to send and receive NHSmail from, the pharmacy shared NHSmail mailbox.

To meet this requirement, pharmacy owners must ensure that at least two members of staff at the pharmacy premises have live personal NHSmail accounts that are linked to the shared mailbox.

Pharmacy owners must therefore ensure that:

• they have a shared NHSmail mailbox for each of their pharmacy premises, which meets the pharmacy.ODScode@nhs.net naming convention;
• those staff that will need to send and receive NHSmail from the shared mailbox have live personal NHSmail accounts which are linked to the shared mailbox;
• there are sufficient staff with linked personal NHSmail accounts to ensure that the shared mailbox can always be accessed when the pharmacy is open, including when locums are acting as the responsible pharmacist;
• staff are reminded of the need to regularly check the shared NHSmail account and respond accordingly to emails that have been received; and
• the linked personal NHSmail accounts are regularly reviewed so that where staff leave the employment of the contractor, their personal NHSmail account is unlinked from the shared NHSmail account in order to avoid any data breaches.

If you need to obtain a shared NHSmail mailbox for your pharmacy, you can request this via the community pharmacy NHSmail registration portal.

Working through this process will include the creation of up to three personal NHSmail accounts which will be used to access the shared mailbox.

The process is explained in Community Pharmacy England Briefing: How to complete the NHSmail registration process.

Once you have completed your registration using the portal, you will be sent login details for the personal accounts so that you can activate them and then log into your shared mailbox.

When you first login to your personal NHSmail account, review and accept the user agreement which should pop up on your screen.

Each NHSmail user within your pharmacy must activate their account by logging in using their individual login details.

After each staff member has accepted the user agreement, they should receive an email which explains that activation has taken place.

If you are having difficulties with activating your account, raise a technical query with the NAS and they will support you through the process.

Having problems finding your pharmacy in the registration portal?

During the registration process, if you are unable to locate your pharmacy within the portal, please raise a technical query with the NAS and they will support you through the process.

If your pharmacy has had a shared NHSmail mailbox in the past, your pharmacy may not be selectable by default within the NHSmail registration portal.

If your pharmacy is new or has a recently changed ODS code, there may also be a period of time until you can use the registration portal to set-up an account (see our ODS change checklist for more information). This can rely on other organisations such as PCSE, NHSBSA and the NHS England ODS team to have processed the ODS code changes. In this circumstance, you should also use the NHSmail technical escalation query set out within the section below.

Already have a shared NHSmail account, but it is not in the pharmacy.ODScode@nhs.net format?

If your pharmacy has a shared mailbox whose address is not in the pharmacy.ODScode@nhs.net format, you can either follow the above process to request a new shared NHSmail account.

Alternatively, you can raise a technical query with the NAS, requesting that the email address is adjusted to the proper naming convention.

Some pharmacies may have a pharmacy NHSmail account which was historically created using a personal NHSmail account. All pharmacies must have a shared mailbox, where the shared mailbox addresses is in the pharmacy.ODScode@nhs.net form and the mailbox is only accessible via linked personal NHSmail accounts. If that is the case for your pharmacy, follow the above process to create a new shared NHSmail account.

If a new member of staff already has an NHSmail account, the pharmacy’s shared mailbox owner can link the account to the premises shared mailbox. Alternatively, that can be undertaken by raising a technical query with the NAS.

If the new staff member does not have a personal account and the pharmacy has fewer than 10 personal accounts associated with the shared mailbox, the shared mailbox owner will need to ask the NAS for the personal account to be created by emailing helpdesk@nhs.net from the shared NHSmail account.

The request must include:

• the pharmacy team member’s full name;
• an alternate email address for that staff member; and
• their mobile phone number (to which their password for the new account will be texted).

If your pharmacy already has 10 associated personal NHSmail accounts

If your pharmacy needs further personal NHSmail accounts for pharmacy staff, but your pharmacy has already had 10 associated personal accounts created, the shared mailbox owner will need to email the pharmacy contracts team at the Integrated Care Board (ICB), stating the reason why more than 10 accounts are required and asking them to approve additional accounts being created.

If the request for additional personal accounts is approved, the pharmacy contracts team will need to email the national helpdesk stating your additional accounts have been approved and asking for the account to be created and linked to the pharmacy’s shared mailbox. The staff members who require the new accounts will need to provide their personal mobile phone number as their password will be sent to them via a text message.

Activating your personal account

To access and activate your personal NHSmail account for the first time use this process:

1. In your internet browser, go to https://portal.nhs.net
2. Click on the login button in the top right
3. Enter your new email address in the email address box: *.******@nhs.net
4. Enter the password sent to your mobile phone in the password box

Once you have successfully logged into your account for the first time, you will be asked to change your password, create some security questions and accept the Acceptable Use Policy. These steps must all be completed before you can send emails from your new account.

After doing this, you will also be able to log in to Microsoft Teams. This will allow you to conduct video and audio calls, as well as instant message, with the people you need to work with across Health and Care.

NHS Digital developed a guide which explains how to make use of NHSmail:

Guide for community pharmacies using NHSmail

The guide includes information about:

• logging in;
• the Shared Mailbox Owner;
• email signatures;
• setting auto responses;
• what to do if your name changes;
• training links;
• forgotten password process;
• locked account process;
• using the NHS Directory to find people; and
• service status.

Managing emails which go into your junk folder

It is recommended to regularly check the junk folder in case some legitimate emails are received into this.

There is a process to mark emails as legitimate, so that they may go into the main inbox the next time. See NHS Digital guidance: Managing the NHSmail junk folder

Accessing NHSmail on mobile devices

The NHS Digital Mobile guide for NHSmail (2019) explains the requirements for use of NHSmail on mobile devices such as Smartphones.

Pharmacy owners can access NHSmail on their mobile device via a web browser or via the Outlook mobile app.

The following links provide advice to pharmacy owners in relation to staff using their own mobile devices to access NHSmail accounts.

• Using mobile devices
• Data security templates: Policy 8B – Pharmacy Bring Your Own Device (BYOD) template policy

Pharmacy NHSmail users that wish to use NHSmail on mobile devices also need to consider a range of practical considerations, such as:

• Use of passcode/biometrics settings to prevent access by others.
• Considering adjusting auto-preview of messages on home-screens to avoid disclosure of confidential information.
• Having the ability to remotely wipe the device if stolen.
• Storage and archive settings.
• Processes when a staff member leaves employment at a pharmacy.
• Use of ‘Do Not Disturb’ mode or similar to prevent email notifications arriving outside of work hours, or during working times when interruptions are not wanted.

Using NHSmail to send text messages to patients’ phones

Some pharmacy system suppliers enable you to send SMS text messages or email reminders to patients that want these messages via a special type of NHSmail pharmacy account called an NHSmail ‘application account’.

The process to set this up involves:

• The contractor’s NHSmail administrator will need to set-up an NHSmail ‘application’ account linked to the pharmacy shared mailbox (this counts as using one of the standard allowance of up to ten individual email accounts linked to the shared pharmacy mailbox);
• The contractor’s NHSmail administrator contacts the pharmacy NHSmail admin helpdesk to request that the ‘application NHSmail account’ be set-up and enabled (the service route process for raising technical queries is outlined at within the ‘Technical queries and escalation’ section).
• There are some naming considerations for the application NHSmail account – the account email address should not be named a person, but it can be named reminders.[ODS code].donotreply or similar. ‘Donotreply’ can be added because this may be an unmonitored email account.

The NHSmail team announced in 2023 that multi-factor authentication (MFA) was set to become mandatory across the platform for all NHSmail users from 2024.

What is MFA?

Normally you use your email address and password to log into your NHSmail account. MFA is an additional way of checking that it is really you when you log in to your account and this will eventually be the default for all NHSmail user accounts.

MFA has been around for some time on the platform, and you may already be using it in NHSmail (or in your personal life such as for online banking). It is currently an optional feature, but there are many benefits to it. The NHSmail team have said that:

• More than 99.9% of accounts compromised by cyber attacks can be blocked by using MFA (Source: Microsoft, 2022)
• MFA can prevent disruption to patient care, referrals and appointments
• MFA helps keep any patient data in a more protected environment

As online working becomes the norm, so does the need to keep yourself and the data you work with safe.

NHSmail is a secure communication platform and MFA is intended to help keep it that way. It is being introduced across all NHSmail user accounts.

What does this mean for pharmacy NHSmail users?

Pharmacy NHSmail users can enrol for MFA, prior to it becoming mandatory, using one of the three methods below. We would recommend using the Authenticator App as it is the strongest form of security, and many users find this method the easiest.

Usability and how to try MFA

Read more within this step-by-step guide for trying pharmacy NHSmail MFA.

Timelines for mandatory NHSmail MFA (updated 24th July 2024)

New users of new personal NHSmail: They must set-up accounts with MFA – expected during the week commencing 29th July 2024.

Existing users of personal NHSmail: From Autumn 2024 NHSmail pharmacy users must have MFA. Ahead of this: users will receive a pop-up notification around the 19th August, asking them to register an MFA authentication method when logging to their account. This prompt can be snoozed for a period of 14 days. If MFA has not been arranged by 2nd September 2024 access to the personal NHSmail account will change:

• Enhanced password policy including having to reset your password on 2nd September and requiring a minimum of 20 characters
• Not having persistent browsing sessions
• Restrictions on sign in frequency
• Password expiring every 90 days

Any NHSmail user can use the People Finder tool to search the NHS directory for local colleagues’ NHSmail addresses and more. The Using the NHSmail’s People Finder factsheet summarises the tool and its use.

The People Finder tool can be used to find individuals’ NHSmail addresses, or organisations’ shared NHSmail boxes, if they exist. The steps below describe how to use People Finder to send an NHSmail message to a new contact.

Access People Finder

Go to portal.nhs.net/PeopleFinder and log-in; or go to the NHSmail portal (portal.nhs.net) and select ‘Login’ (top right), and ‘People Finder’ from your menu options. Note: You can’t ‘auto-switch’ from Outlook NHSmail web to People Finder unless you use bookmarks or insert the website into the address bar.

Top tips

• Look-up an organisation’s ODS code and search for it, if needed: NHS Digital’s ODS search portal (odsportal.digital.nhs.uk).
• You should separately bookmark (or ‘add to favourites’) three webpages: People Finder, Outlook NHSmail web and NHSmail Portal  into your web browser, so that you can quickly reach any of those webpages directly with just one click.
• You can advise NHSmail-using colleagues to bookmark and use People Finder.
• Favourite NHSmail ‘contacts’ that you need to stay in touch with.

Factsheet

Using the NHSmail’s People Finder

There are a range of points that need to be considered when planning how NHSmail accounts should be used. The following issues to consider have been collated from feedback from pharmacists that have already used NHSmail.

• Links in emails to external websites – many pharmacies have strict controls on what websites can be accessed from the pharmacy computer. In some cases staff can only access a list of sites that have been pre-approved by a company Head Office;
• Managing access rights – who will have access to the shared mailbox and how will this access be managed? What processes are in place to ensure access rights are maintained when there are staff changes?
• Storing information received – storing records of clinical communications is important for clinical governance reasons. NHSmail is designed to support the transfer of information, not the storage of information. Whilst some information could be copied across to the notes in the patient’s pharmacy record, particular consideration will need to be given to how attached documents are stored (including arrangements for data back-up and appropriate access controls);
• Sending patient information – NHSmail is the only NHS approved method for exchanging patient data by email, but only if both sender and recipient use an NHSmail account or if sending to another government secure domain such as GSi (*.gsi.gov.uk) or CJX (*.police.uk or .pnn.police.uk). In addition to ensuring the recipient account is secure, it is important to check that the recipient is prepared to accept the information by email, check that information is being sent to the correct email address and indicate the sensitive nature of data in the header;
• Information Governance – appropriate information governance procedures need to be put in place if NHSmail is used to transfer sensitive information. As NHSmail can be accessed anywhere, it is not possible to limit access rights to a particular location, for example from within a pharmacy. Also NHSmail can be linked to a wide range of mobile devices – if this option is used, provision needs to be made for the event that they are stolen or lost, for example a process to activate self-wipe capability. Approaches by which safeguards around the use of NHSmail could be integrated into existing IG resources required for compliance with the NHS Information Governance Toolkit include:
  • Outlining the expectations on staff use of NHSmail in the pharmacy confidentiality code of conduct (Requirement 214).
  • Outlining how personal information will be handled if  received by email, for example in the pharmacy’s safe haven procedures (Requirement 322).
  • Providing guidance on the use of NHSmail in the pharmacy’s data transfer procedures (Requirement 322).
  • Where the service is accessed from mobile devices, providing additional guidelines for staff on mobile computing (Requirement 318).
  • General guidance on the NHS Information Governance requirements can be found in the NHS IG section of this website.
• Regulatory information in business letters – a requirement was introduced by the Companies (Registrar, Languages and Trading Disclosures) Regulations 2006 for companies in the UK to include certain regulatory information (e.g. company registration number, place of registration and registered office address) in their ‘business letters’ (which includes emails). In October 2009, similar requirements were introduced for sole traders and partnerships (with special provision for partnerships of more than 20 persons) and Limited Liability Partnerships. Although individuals can set up personal ‘email signatures’ in NHSmail, there is no way at present, via the NHSmail service to set up an automatic footer/signature stamp so that a company can ensure all emails sent by their employees contain the necessary information. Failure to include the information required in the Regulations would be a breach of the Companies Act 1985, and could render companies liable to a substantial fine.

See also: Raising NHSmail technical issues and escalation factsheet

In the event of a technical NHSmail query:

1. Prepare an email for helpdesk@nhs.net with the question.

2. Where possible, send your email from your NHSmail inbox (from either your shared pharmacy mailbox or from your personal NHSmail inbox depending on the query type). Use another email address if required because you can’t yet access your NHSmail.

3. Generally you shouldn’t need to ask your question by phone. The general NHSmail national phoneline desk may be able to help in certain limited scenarios (0333 200 1133), however it is strongly recommended that you email your query.

4. Your email question should be short and clear and include information:

• question;
• name;
• your position;
• pharmacy name;
• ODS code;
• contact telephone number; and
• relevant NHSmail email addresses (i.e. usually both the shared mailbox address and your personal NHSmail email address).

5. The NHSmail team usually will reply by email before two full working days passes. If you cannot find a reply within this time, that would be unusual and you should check your ‘Junk’ email folder. On occasion you might be contacted by phone if you have provided the right phone details.

6. If NHSmail team have written an email reply to progress resolution, they may have supplied information or suggested steps within the ‘Resolution Information’ section of the email that they have sent you. This might include: information; actions for you to perform; and queries for more information so that the technical issues can be further understood.

7. Ticket status: If ‘Resolution information’ has been given to you, then the ticket may be held in a resolved state and closed automatically soon after if no response is sent by you. Carefully check that you’ve followed any suggested steps made within the ‘Resolution information’ section.

8. Ticket re-review/reopening: Two options for re-review or follow-up:

• Option A: The email with resolution information may include a link which can be clicked/selected to have a ticket re-reviewed, this may generate generate an email with ticket ref to an Accenture email address. You may cc helpdesk@nhs.net. Note that the Accenture tech firm support NHSmail.
• Option B: Prepare an email for helpdesk@nhs.net, ‘paste’ your original email query(ies) at the bottom of the chain and NHSmail reply email(s) immediately above. Include your new follow-up question at the very top of the email. Include the incident reference number (INC number) in the subject.

9. Escalation: Keep all of the emails just in case further escalation is required. You may escalate to Community Pharmacy England by emailing it@cpe.org.uk (and include all the the email correspondence which you sent and received) if you have a single or systemic issues that you are struggling to resolve with the NHSmail team and you have tried the above. Community Pharmacy England may then support you with re-raising your question.

All community pharmacy contractor NHSmail users have ability to access Microsoft Teams, and are encouraged to download and test the use of the tool.

The NHSmail team previously upgraded pharmacy NHSmail accounts in late 2020, to further improve the NHSmail service including extra Teams functionality.

How to use Microsoft Teams and tips

• Download the Teams apps on your computer and mobile devices.
• Encourage NHSmail using team members within the same pharmacy to download the Teams app.
• Use MS Teams as an audio / text / video communication tool for your pharmacy work and collaboration with NHSmail users within and outside of your own pharmacy.

Read more: NHSmail MS Teams and upgrade factsheet and Pharmacy video conferencing.

NHS Digital are seeking pharmacy contractor volunteers to take part with trialling the NHSmail Virtual Visits booking and consultation platform.

During the pilot the Virtual Visits tool will be able to be used to record face-to-face or virtual consultations. The tool is associated with NHSmail Microsoft Teams. It enables an interface that patients and pharmacy staff can use to arrange and carry out a consultation.

Prerequisites for community pharmacy team members taking part with the pilot:

• an active personal NHSmail account;
• access to shared NHSmail inbox;
• MS Teams is installed on computer or tablet;
• participation with the pilot instructions including the testing of the booking and consultation features of Virtual Visits;
• a computer or device with a webcam.

Community Pharmacy England is supporting the research because pharmacy contractors commenting on their IT systems and portals will help the development of more usable digital tools.

Participants will be granted access to the Virtual Visits platform and will be able to use the platform to comment on technical experiences, the setup process and usability.

Participants from across the pharmacy sector including those who do not always adopt IT early are welcomed. The research intends to help make the tool easy-to-use for any pharmacy staff member in the event of wider roll-out. This current stage of the pilot takes place approx Feb 2022 onwards.

How to get involved?

To volunteer to take part or find out more about what is involved please email it@cpe.org.uk with ‘Virtual Visits pilot’ in the subject title and please confirm your ODS code and pharmacy name. Community Pharmacy England will provide additional information or pass your information to the project team so that you can take part.

Information for pilots

Community Pharmacy England and NHS Digital worked on a guidance checklist for use by pharmacy team pilots, and can learn about the tool within this How does Virtual Visits work for pharmacy pilots factsheet.

Read more about: Pharmacy remote consultations.

Consider:

• Using the mobile Outlook app and customizing your settings using Community Pharmacy England’s Outlook mobile app factsheet.
• If you use Outlook web within your internet browser, add the inbox to your favorites, or set it as the homepage for when you open the internet.
• If you will not be using your NHSmail account frequently for a certain period, e.g. because of a change to your job role, you could set a diary reminder to send yourself an email once a fortnight to keep the account active [i.e. used within each 30-day period]. Or get your account set to ‘disabled’ to freeze it for a longer period of time, e.g. over a month.

The most frequently asked questions are outlined within NHSmail FAQ factsheet.

Read additional related FAQs at: the NHSmail FAQs webpage.