Can I use NHSmail as a private GP?

Two different questions

“Can I use NHSmail?” usually means one of two things, and the answers differ.

1. Can I use the @nhs.net account I already have from my NHS job for private patients?
2. Can my private practice get its own NHSmail accounts?

NHSmail has been renamed NHS.net Connect. Addresses still end in @nhs.net, and most people still call it NHSmail.

Using the account you already have

The NHSmail acceptable use policy (version 6.0, September 2023) says clinical and care staff may use the service in relation to the treatment of private patients, in line with their own professional codes of conduct. So using your existing account for occasional private correspondence is not automatically a breach. Check the current policy when you accept it, and check your NHS employer’s own information governance policy too.

There are good reasons not to make it your practice’s main address:

• It is not yours. The account is linked to your NHS organisation, and the policy states that all data in the service remains the property of the NHS. If you leave that role, the account may move or close.
• Your private records must be complete. Clinical correspondence needs to end up in your private practice’s record, not only in a personal NHS inbox.
• It does not scale. Staff cannot share it, and patients will expect to reach the practice, not one doctor.
• Mixed roles confuse people. NHS colleagues may assume a message from your NHS address is NHS work.

Getting NHSmail for your private practice

NHS.net Connect is for organisations that provide or support publicly funded health and social care. NHS England’s application process for independent providers asks for:

• an Organisation Data Service (ODS) code
• a business justification, including your relationship with NHS organisations
• an up-to-date Data Security and Protection Toolkit (DSPT) assessment
• a nominated local administrator, and a signature from a director or board member.

The process is aimed at independent organisations delivering NHS services. Access is reviewed periodically to check you are still eligible, and NHS England can refuse an application that does not fit. If an NHS commissioner has contracted you locally and wants you to use NHSmail, it should sponsor your accounts for the length of the contract.

In practice, a purely private GP service with no NHS contract is unlikely to qualify. If you do hold an NHS contract, for example for a commissioned service, ask your commissioner first.

A correction to older advice

You may read that NHSmail is available to every CQC-registered care provider that has reached “Approaching Standards” on the DSPT. That route is for adult social care providers, such as care homes, and not for private GP services. It does not open NHSmail to a private GP practice.

What do you actually need it for?

Most private GPs want NHSmail for one of three jobs. Each has another route.

Job	Route without your own NHSmail
Letters to the patient’s NHS GP	A record system or document transfer service that sends over MESH into the GP practice’s workflow
Secure email to NHS colleagues	An email service accredited to the NHS secure email standard (DCB1596), or a paid encrypted email service
Secure email to patients	Encrypted email, or a secure patient portal or messaging tool

MESH for letters

MESH (Message Exchange for Social Care and Health) is the NHS messaging service that carries documents into GP practices’ document workflow. Some private record systems and document transfer services send letters over MESH on your behalf, so you do not need your own mailbox or NHSmail account. See how to send notes to the NHS GP.

The secure email standard

DCB1596 is the NHS secure email standard. Organisations that do not join NHSmail can accredit their own email service against it, and accredited services can exchange sensitive information securely with NHSmail. NHS England Digital describes two routes:

• Microsoft 365: submit a signed conformance statement. NHS England says this typically takes one to three months.
• Self-managed services: submit a conformance statement with evidence. This typically takes six months to a year.

Accreditation lasts one year and must be renewed. It is more work than most small practices need, but can suit a larger private provider that emails NHS organisations often. See secure email without NHSmail for simpler options.

The DSPT

All organisations with access to NHS patient data and systems must complete the DSPT. That includes NHSmail and MESH. Even if you do not need it, working through it is a useful check of your security. See UK GDPR for private practice.

Outside England

NHS.net Connect and the registration routes above are for England. Scotland, Wales and Northern Ireland run their own NHS email arrangements, so ask the local health board or trust how independent providers can exchange information securely.

What to do

1. Set up a practice email on a business service with multi-factor authentication, and add encryption for sensitive messages.
2. Choose a route for letters to NHS GPs, ideally electronic transfer over MESH.
3. Use your existing NHS account for private work only if your employer’s policy allows it, and file anything clinical in your private record.
4. If you hold an NHS contract, ask your commissioner about NHSmail sponsorship.