IGPOLCORE88 Internet Email IM & Social Media Policy v4.1 by Provide Community

Version: V4.1

Ratified by: Finance & Risk Committee

Date ratified: 26/10/2022

Job Title of author: Information Governance Manager

Reviewed by Committee or Expert Group Technology Programme Board

Equality Impact Assessed by: Information Governance Manager

1. Introduction

Provide Group (hereafter referred to as “the organisation”) wishes to encourage the correct and proper use of the Internet, Email, Instant Messaging Systems and Social Media Sites and expects staff to use these facilities during the normal course of work. The organisation encourages the appropriate use of these systems by staff and to increase their competence and understanding of their potential.

This policy determines how Provide staff can use these services professionally, ethically and lawfully without compromising patient or staff confidentiality and whilst maintaining the security of the IT network.

The use of these systems are intended primarily for Provide business related purposes or professional development and training that supports the goals and objectives of the organisation. Staff should therefore use them primarily for the legitimate business of the organisation and within the bounds of their authority.

2. Scope

This policy applies to all directly and indirectly contracted staff and other persons working for the organisation:

• All Provide employees whilst engaged in work for the organisation at any location, on any computer or internet connection (including mobile phones).

• Any other uses by Provide employees which identify the person as a Provide employee or which could bring the organisation into disrepute on any computer or internet connection.

• Other persons working for the organisation, persons engaged on Provide business or persons using Provide equipment and networks; and

• All usage by anyone granted access to the organisation’s network or to Guest Internet facilities.

Additionally the policy applies to:

• *.nhs.net email accounts for business and personal use on Provide and nonProvide premises including from home, internet cafes and via portable devices (e.g. Mobile phones)

• Any Provide systems whether clinical or otherwise that allows for the sending of electronic messages either indirectly through an NHS Mail account or through integrated messaging capabilities. For example, email and instant messaging functionality in SystmOne or MS Teams, Pando, Webex, or Cisco Jabber.

3. Definitions

Where referenced within this Policy the term ‘data’ may refer to either the organisation’s business data or person identifiable data (PID) – this includes patients, staff, visitors and suppliers.

Any references to ‘Internet’ in this document covers Web browsing, webmail and any other services available from the global Internet or HSCN Network

Offensive material referenced in this policy includes but is not restricted to: hostile text, images, videos or voice relating to gender, ethnicity, race, sex, sexual orientation, religious or political convictions and disabilities.

Instant messaging, often shortened to simply "IM" or "IMing," is the exchange of text messages through a software application in real-time. Instant messaging differs from ordinary e-mail in the immediacy of the message exchange and also makes a continued exchange simpler than sending e-mail back and forth. Approved Instant Messaging systems in the organisation are Cisco Jabber, Cisco WebEx, Pando, Telegram and TPP SystmOne Instant Messaging.

4. Responsibilities

4.1

Responsibilities of the Organisation

The organisation must provide a ‘Duty of Care’ to all its employees by ensuring that, whilst within the workplace, they are protected from information and activities that are classed as ‘socially unacceptable’ or pose a threat to the Confidentiality, Integrity and Availability of the organisation’s data.

4.2

Responsibilities of all Staff

All staff are obliged to adhere to this policy. It is the responsibility of the individual to ensure that they understand this policy. Managers at all levels are responsible for ensuring that their staff have read and understand their obligations in relation to this Policy.

5. Access to Internet and Email

Internet and Email are available to all staff that are registered as users of the computer network. Staff may only use these services while they remain employees of the organisation. An NHS Mail account may be retained by the employee if they move to another NHS provider or NHS healthcare organisation. Internet Access is given to staff by default when a request for a network user account is made by the user’s line manager. Requests for an Email account must be made through the online Provide Technology Selfservice portal: https://servicedesk.provide.org.uk

In order for staff to receive email services, or to change an existing account this must first be approved by an appropriate manager. Any changes to an existing email account must be requested through the Technology self-service portal as above.

Staff can make certain changes to their NHS Mail accounts themselves by logging in through the web portal (www.nhs.net). This includes changes to contact details, address, roles, speciality and work areas.

Access to networks and websites on the HSCN network will only be accessible from Provide issued equipment which includes desktop PCs and mobile devices. Users with

portable devices such as laptops and tablets connect using a virtual private network (VPN) facility called Direct Access which will route onto the HSCN secure gateway and afford the same levels of security.

Use of Public Networks

Wi-Fi that is available in coffee shops, hotels and other public places can often be insecure and should not be used for work purposes.

Whilst Provide laptops benefit from an always-on Virtual Private Network (VPN) and group companies are issued with an alternative VPN solution, this does not make use of public networks completely secure as this only offers protection when communicating with the Provide network or systems within the HSCN environment.

In circumstances where there is a legitimate need to work in such places, the safest way to connect is to tether to a work issued or approved mobile phone. If there is any doubt about the safety of a connection, the user must contact the Provide Service Desk for advice.

5.1 Guest Internet Access

Guest Wireless Internet Access is provided at various sites for non- Provide issued laptops and mobile devices. This is a separate internet service to ensure that there are no security risks to Provide’s internal data and systems and the wider NHS HSCN network. This service is to allow external contractors and guests (and staff using personal devices) to connect to the internet, as well as videoconferencing facilities.

It is prohibited to connect Provide issued equipment to the guest internet without prior authorisation from the Provide Technology Department. Staff are however permitted to connect provide issued mobile phones to the guest wireless internet.

Personal devices connected to the guest internet are not supported by the Provide Technology Department and the guest wireless is supported via best endeavours and should not be relied upon.

It is prohibited to connect personal computing equipment such as laptops, tablets, mobile phones and also Provide issued mobile phones to the internal network in order to receive internet access.

5.2 Blocked Websites

To reduce the risk to individuals, the organisation has implemented software that restricts access to sites based on their categorisation.

The monitoring software maintains a database of website categories to which access is monitored, because they are deemed inappropriate for access at work. The following categories are blocked by the antivirus and firewalls (N.B this list is not exhaustive):

• Pornography / Adult/ mature content;

• Gambling/ betting;

• Alcohol/ Tobacco (see 7.3 below);

• Illegal drugs (see 7.3 below);

• Auction sites;

• Personal dating;

• Spyware/ malware sources;

• Violence/ hate/ racism/ intolerance;

• Weapons; and

• Any site engaging in, encouraging or promoting illegal activity.

Web Mail Services and Messaging Services other than NHS Mail, SystmOne Messaging, Cisco WebEx and Cisco Jabber

The following categories are blocked on the guest internet access (where provided):

• Alcohol

• Adware

• Anime/ Manga/Webcomic

• Dating

• Drugs

• Gambling

• Forums/ Message Boards

• Hate/ discrimination

• Lingerie/ Bikini

• Nudity

• P2P/ File Sharing

• Pornography

• Proxy/ Anonymiser

• Sexuality

• Tasteless

• Tobacco

• Typo Squatting

• Weapons

• Web Spam

It is accepted that legitimate sites may, because of language and or visual images, be incorrectly classified by the screening software but that staff may need to access these sites in order to carry out legitimate Provide business. In these instances it is possible to have such sites entered into an exceptions database and access to the site enabled. In such instances a call should be logged with the Provide Technology Service Desk.

No member of staff is allowed to alter or tamper with their PC internet settings or use additional software for the purpose of bypassing or attempting to bypass the Internet filtering and monitoring software. Doing so is considered a serious breach of IT network security and this policy and may result in disciplinary action which may lead to dismissal.

6. Personal Use

The use of the internet on the organisation’s internal network connection and the NHS Mail Email system is intended primarily for business use so that staff can access the Intranet, approved web hosted applications, undertake research, professional development and training and to access other information relevant to work.

Limited personal use of Internet and Email facilities are permitted provided it is consistent

with the organisation’s code of conduct and does not interfere with the performance of your duties

6.1 Personal use of Email

Employees must regard this facility as a privilege that should normally be exercised in their own time without detriment to the job and not abused. Inappropriate or excessive personal use may result in disciplinary action and/or removal of email facilities. Staff should be aware that both private and legitimate Provide business use of email will be subject to monitoring. There is no absolute right for staff to use the email facilities for personal use.

Use of Webmail systems (e.g. Hotmail, Gmail, etc.) on work equipment, other than NHS Mail (for personal use), are prohibited.

6.2 Personal use of the Internet

The organisation will not be held liable for any financial or material loss to an individual user in accessing the internet for personal use.

Employees wishing to spend significant time outside their own normal working hours using the Internet, for example, for study purposes, should obtain Line Manager approval. It is the Line Manager’s responsibility to file the approval appropriately and to copy the approval to the member of staff.

Social Media, such as Facebook, provide a number of benefits in which Provide staff may wish to participate in their personal life. However, when someone clearly identifies their association with the organisation and/or discusses their work, they are expected to behave appropriately, and in ways that are consistent with both the organisation’s values and policies and their individual responsibility as an employee of the organisation. See Appendix 1 for the organisation’s policy on Social Media.

Please note, the use of WhatsApp messaging application is not permitted for sharing patient identifiable data or for encouraging service users to register/join a WhatsApp group to receive Provide delivered service, support or communication. Please use approved applications for this purpose. Please discuss options with the IG department.

7. Sending and Receiving Emails

The organisation has chosen NHSmail as its primary email system due in part to the security features that this system affords.

Acceptable methods of sending information by Email are listed within the Transferring of Personal Information Policy.

Key messages:

• Use email only when it is the most appropriate means of communication;

• Communicate only with those who are required to read the message to avoid breach of confidentiality;

• Use the Global Address Book with care to ensure email reaches the correct recipient;

• Use the Blind Carbon Copy (BCC) feature in outlook or NHSmail web portal when sending an email message to a number of people where you need to safeguard security and privacy (See Appendix 5)

• In the event of a mistake,use the ‘recall’ message tool, but be aware that thisfacility is not fail safe;

• File attachments should only be sent via email when absolutely necessary and should be deleted as soon as is practicable. Ideally place large attachments in a shared location (where possible) and include the path to the file in the email. Make use of approved tools to minimise size of attachments, eg Portable Document Format (PDF).

7.1 Large numbers of recipients

Be selective about who you send messages to. Place large attachments in a shared location or in an appropriate shared folder and send only the link to the location.

Use the Blind Carbon Copy (BCC) feature in Outlook or NHS Mail portal where you need to safeguard security and privacy (See Appendix 5)

7.2 Global emails

Global emails are intended only for communicating high-level information relating Provide business within the organisation.

All messages must have a named signatory and be approved by an appropriate Head of Department or Director and/or the Communications Team before they are sent. If you wish to reply to a global email message, only reply to the named contact at the bottom of the email. Do not respond globally as this takes up unnecessary storage space on email servers

Global e-mails from Provide staff must only be sent by the communication team from the Provide Communication email address. Requests for communications approval and sending of global emails should be sent to provide.communications@nhs.net

7.3 Email received in error

Inform the sender if you receive a message sent to you in error. Delete the message from your mailbox.

Emails that contain unintentionally disclosed personal data thus represent a breach in the data subject’s confidentiality and must be reported in line with the organisations incident reporting policy.

7.4 Phishing email

If you receive an email with suspicious or clearly fraudulent content do not open the email and do not respond to the email or provide your credentials via the link on the email. Delete it immediately. Do not respond as this indicates an active mailbox.

If you are not sure if the email is genuine, please report it to the service desk. Open the service desk portal service desk and open the “I need Something” option. In there they will need to open “SPAM Email” request https://provide.freshservice.com/support/catalog/items/74. Then follow the instructions in the request and upload the email as an attachment and submit.

If you open or respond to a phishing email, you must immediately switch off your device and contact the IT Service desk for assistance.

7.5 Email with warnings about criminal activity / frauds/ scams

Where there are genuine security matters that staff need to be aware of these will be notified by the Police to NHS Security Management specialists who in turn will issue warnings or guidance to staff.

If you receive email purporting to give warnings about criminal activity or scams please do not forward these on to colleagues. Many of these are junk chain letters that have been circulating in one form or another for some time. Please check with the organisation’s local security management specialist in the first instance.

Spam emails should be forwarded to the NHS Mail Service desk so that these can be blocked and investigated if necessary (spamreports@nhs.net)

7.6 Managing Emails during staff absence

Emails and attachments created or received by staff in the course of their duties, are the property of the organisation.

Staff should make arrangements for their emails to be managed during planned absences and use the Out-of-Office message facility to advise contacts of their unavailability and who to contact in their absence

There may be some occasions when it is necessary to access email correspondence from an individual’s mailbox when a person is away from the office for an extended period, e.g. sudden illness or failure to make adequate arrangements for planned absences. The reasons for accessing an individual’s mailbox are to action business information i.e:

• Subject Access requests made under the Data Protection Act;

• Freedom of Information request;

• Evidence in legal proceedings;

• Evidence in a criminal investigation; and

• Line of business enquiry or other information relevant to the organisation.

Where it is not possible to ask the permission from the member of staff whose mailbox needs to be accessed, the procedure for gaining access to their mailbox is to:

• Gain authorisation from the Service/ Department lead;

• Submit a request to the Provide Technology Service Desk;

• A record is made of the reasons justifying access to the mailbox together with the name of the authorised person;

• Only one person who is senior to the absent employee should be authorised to gain access;

• Access is kept to a minimum on a strict need-to-know basis;

• An Out-of-Office message is set-up to alert subsequent contacts of the unavailability of the addressee;

• The need to access the in-box is reduced by using the ‘forward email’ function; and

• Inform the person whose mailbox was accessed as soon as it is practical to do so.

Authorised access to another person’s inbox is provided for the continuation of business purposes only. Access must be justified as a business purpose and kept to a minimum to meet that need. Emails that are clearly personal communications must not be accessed under any circumstances

Advice must be sought from the Information Governance Manager where there are grounds to access personal emails.

The Provide Technology team, reserves the right to inspect the content of an email, including personal emails, if there is credible reason to believe that it contains evidence of unlawful activity, including instances where there may be a breach of policy constituting gross misconduct, or where there is reason to believe that it contains harmful material e.g. a file containing a worm or virus, or where the law requires it.

It is less likely that this procedure will need to be followed if email records are managed appropriately or mailbox access has been delegated to a trusted third party.

7.7 Non-delivery report, delivery reports and receipt reports

If a message is not delivered, you will receive a non-delivery report. This will normally identify the cause of non-delivery such as incorrect address, unavailable end system, etc. Look at this information first before raising a request for support, as you may just need to correct the address.

Delivery reports indicate that the email has been successfully sent and will only be returned if the sender has requested it.

Receipt notifications indicate that the recipient has opened the email. Remember that the recipient may not have read or acted upon the email, as a personal assistant or administrator may have read the email on behalf of the recipient.

Delivery reports or read receipt notifications should only be used when you need positive confirmation that a message has been received and read.

7.8 Formation of Contracts

Email is capable of forming or varying a contract in just the same way as a written letter. Such capability gives rise to the danger of employees inadvertently forming contracts on behalf of the organisation or varying contractual terms to which the organisation then becomes bound. For example sending an ambiguous email to a contractor or supplier that could be misread as asking them to undertake some work on behalf of the organisation could be deemed a legal contract. Employees should take due care when drafting the words of an email so that they cannot be construed as forming or varying a contract when

this is not the intention. Please contact the contracts team if in any doubt, at provide.contracts@nhs.net

7.9 General rules for Email

You must not:

• Use other people’s mail accounts to send your emails;

• Give others authority to view or amend your mailbox unless fully justified;

• Engage in any activity, which is illegal, offensive or likely to have negative repercussions for the organisation;

• Allow third parties to read personal or confidential data in emails by leaving your screen in view of such third parties;

• Read other people’s emails sent to someone else, without their express permission;

• Create or send any offensive, obscene or indecent images, data or other material;

• Initiate or propagate any provocative exchanges of email;

• Initiate or propagate electronic chain letters or junk email;

• Engage in unauthorised selling or advertising of goods and services;

• Create or send messages that may constitute racial, sexual harassment or harassment on the grounds of a disability;

• Send any unsolicited commercial or advertising material either to another user or organisation(s);

• Forge, use a false identity or anonymously send emails

7.10 Email Signatures

All staff should adhere to a consistent email signature. Please see Appendix 4, Email Signature Guidelines.

Directorate/department specific additions/amendments to this format must be approved by the Head of Service initially and then by the Communications Team, to ensure consistency across Provide

Provide Email Signatures must only be used on Provide issued NHS Mail accounts.

8. Use of Instant Messaging for work

The organisation has approved the use of, TPP SystmOne Instant Messaging (IM), Cisco Webex, Pando, Telegram and Cisco Jabber as Instant Messaging services for use to carry out Provide Business. The use of other IM Systems (including Whatsapp) to conduct Provide Business are strictly prohibited and approval must be sought from the Technology Programme Board.

Instant messaging has a place to play in communication with colleagues but it is not always the best way of communication so please consider the following points.

• Some members of staff do not like this way of making contact therefore please respect individual views when deciding methods of contact.

• If your message requires the recipient to do something, consider using email as there is no way to save an instant message so actions can easily be forgotten.

• Remember that you are ‘interrupting’ the recipient so consider if this is the best way to contact them.

• A message can be sent even if the recipient is not in front of their computer so there is no guarantee the person is actually going to get the message.

• Any patient related communication must be attached to the patient record.

Consider using Instant Messaging in the following type of circumstances:

• To tell a clinician their patient will be late

• ‘Can you call me when you have a minute’

• To ask a question when you do not want the patient or other individual to overhear you.

What it is not for:

• It is not to be used as a ‘chat room’ It is not a replacement for email

9. Personal use of Social Media Sites

Social media is the term commonly used for websites which allow people to interact with each other in some way - by sharing information, opinions, knowledge and interests. As the name implies, social media involves the building of online communities or networks, encouraging participation and engagement.

Social networking websites (such as Facebook, Instagram, Snapchat, Twitter and Google +) are perhaps the most well known examples of social media, but the term covers other web-based services. Examples include Blogs, audio and video podcasts, ‘wikis’ (such as Wikipedia), message boards, social bookmarking websites (such as del.icio.us), photo, document and video content sharing websites (such as Flickr and YouTube and Instagram), or micro-blogging services (such as twitter)

These media provide a number of benefits in which Provide staff may wish to participate in their personal life. However, when someone clearly identifies their association with the organisation and/or discusses their work, they are expected to behave appropriately, and in ways that are consistent with both the organisation’s values and policies and their individual responsibility as an employee of the organisation.

The intention of this Policy is not to stop staff from conducting legitimate activities on the Internet, but serves to highlight those areas in which problems can arise for both individual staff members and the organisation. Please note there have been several cases where staff have been dismissed by their employer for inappropriate use of a social networking site or other media.

To this end when identified as a Provide staff member (for example by use of e-mail address, by joining a NHS or health related network on social network sites or by making reference to Provide as your employer), staff:

• Must not reveal confidential information about our patients, staff, or the organisation;

• Must not discuss work-related issues online, including conversations about patients or complaints about colleagues. Even when anonymised, these are likely to be inappropriate.

• Must not engage in activities on the Internet which might bring the organisation into disrepute;

• Must act in a transparent manner when altering online sources of information such as websites like Wikipedia;

• Must not use the Internet in any way to attack or abuse colleagues; and

• Must not post derogatory or offensive comments on the Internet about colleagues, their work or the organisation

• Must not build or pursue relationships with service users, even if they are no longer in your care.

• Must not post pictures of service users on Social networking sites or other websites (even if they ask you to do so).

• Must be aware that even applying privacy settings in Facebook (and other social networking sites) does not mean that any postings will be kept out of the public domain. These postings could be copied by people entitled to access them and sent on to others beyond the original posters control.

Any online activities associated with work for the organisation should be discussed and approved in advance by a Line Manager and by the organisation’s Communications team where necessary.

Please refer to Appendix 1 for guidance on using Social Media Responsibly

10.Viruses and Malware

Viruses and Malware can damage computer systems, destroy data, cause disruption and incur considerable expense for the organisation. The Provide Technology department will ensure that computers connected to the network have appropriate virus protection software and that this is updated as appropriate.

Employees must not open email attachments or download documents from external sources unless they are sure of their authenticity. If in doubt seek clarification from the sender or the Provide Technology Service Desk. Areas expecting emails from unknown sources should request a code be inserted in the tile/subject heading eg a job vacancy code.

If any viruses are found or you suspect that your machine may be infected, the Technology Service desk must be informed immediately (0300 303 9955)

It is forbidden to download or send executable computer programme files as attachments, without prior consent from the Provide Technology Service Desk. The downloading and subsequent use of any software without the prior approval of the Service Desk is strictly forbidden (this includes screen savers).

It will be considered a serious breach of this policy if an email user deliberately infects or makes any attempt to infect the organisations or other network system with computer viruses.

11.Harassment

It is strictly forbidden to send messages that contain offensive or harassing statements or language, particularly in respect of race, national origin, sex, sexual orientation, age, disability, religious or political beliefs. Remarks sent by email, instant messaging systems or other internet services that are capable of amounting to harassment may lead to complaints of discrimination under the Sex or Disability Discrimination Acts or the Race Relations Act

12.Defamation

The ease of use of email and Instant Messaging systems can lead to unguarded and impetuous comments being made, which in turn could be classified as defamatory. Defamation arises where there is the publication of an untrue statement tending to lower the subject of the statement (which may be an individual or an organisation) in the estimation of the public generally. Liability for the tort of defamation applies to electronic communication just as it does to more traditional forms of publishing. Any expression of fact, intention and opinion can be held against the author and/or the organisation, therefore do not include anything in a message you are not prepared to account for or defend. Employees are therefore advised to take care when sending messages to ensure that they are not defamatory, incur liability on the part of the organisation or adversely impact on the image of the organisation.

13.Copyright

Email, Internet and Instant Messaging Users must observe all contractual, copyright issues. Under the Copyright, Designs and Patents Act 1988, copyright law can be infringed by making an electronic copy or making a ‘transient’ copy (which occurs when sending an electronic message). Copyright infringement is becoming more commonplace as people forward text, graphics, audio and video clips. Employees must not copy, forward, upload or otherwise disseminate third-party work without the appropriate consent

14.Confidentiality

Employees are reminded that they are bound by the common law duty of confidence and the Data Protection Act 2018 and General Data Protection Regulations (GDPR) which apply to person identifiable information of patients, staff, contractors or third parties. Any disclosures of person identifiable information should be done in accordance with the organisation’s Data Protection Policy.

Confidentiality of other information that is not person identifiable may be protected under legislation associated with the Freedom of Information Act 2000.

15.Breach of Policy

Staff will be liable to disciplinary action if they are in breach of this policy and depending on the severity of the offence staff may be liable to summary dismissal.

The distribution or the accessing of any information via the Internet, Email and Instant messaging Systems is subject to UK law and any illegal use will be dealt with appropriately. Emails and Instant Messages both in hard copy and electronic form, are admissible in a court of law.

If staff conduct and/or actions are unlawful or illegal the individual may be personally liable. In the event of an accidental breach of this policy staff members must advise their line manager immediately so that appropriate steps can be taken to mitigate or remove any possible risk(s) e g the exposure and/ or loss of sensitive or person/ patient identifiable data.

16.Monitoring

The organisation has the ability and legal right to monitor Internet, email and Instant Messaging usage. By using these systems the employee consents to any monitoring the organisation considers to be appropriate. Monitoring will be conducted by the organisation as the most effective way of ensuring compliance with this policy.

Monitoring is required because the use of these systems for business purposes and personal use is subject to UK law, as well as regulations, standards, and guidelines issued by the Department of Health and the NHS. Any employee using these facilities illegally or inappropriately could put the organisation in breach of the law, for which the penalties can be severe.

All monitoring will be undertaken in accordance with the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 and the Regulation of Investigatory Powers Act (2000).

The organisation will always consider if any monitoring intrudes unnecessarily on an employee’s privacy and all monitoring will be carried out in accordance with current relevant legislation.

When monitoring takes place staff will be made aware of the purpose and extent of the monitoring to be carried out except for the purposes defined under ‘Monitoring without consent’.

Employees will be allowed to make representations about the information gathered through monitoring where it may have an adverse impact on them.

All staff have a right of access to information held on them, including information obtained through monitoring; such information may be withheld if by doing so it would prejudice the detection of a crime.

16.1 Monitoring of Internet Access

The organisation monitors all internet activity by staff. This is an automatic process, carried out by computer software, which records the volume of Internet traffic, the Internet sites visited, type of site and length of time of any visit to the site. This recorded information will be retained for analysis, and will be processed according to the principles of the Data Protection Act.

Reports will be monitored and action taken where necessary in line with this policy. Where required, reports can be requested by the Human Resources department, Senior Management and line managers.

Evidence of excessive personal use, inappropriate or attempted inappropriate use will be presented to the staff member’s Line Manager for appropriate action to be taken in accordance with the organisation’s disciplinary and dismissal policy and procedures.

No member of staff is permitted to access, display or download from Internet sites that hold offensive material. Doing so is considered a serious breach of security and may result in dismissal or prosecution.

16.2 Monitoring of Email

The organisation retains the right of access to and ownership of all email sent from and received by its systems.

When the monitoring of personal emails is necessary monitoring will be confined to the message address or heading wherever possible.

17.Review

This Policy will be reviewed every 2 years by the Information Governance and IT Projects Manager and the Technology Operations Manager. Earlier review may be required in response to exceptional circumstances, organisational change or relevant changes in legislation.

Appendix 1 - Guidance on using Social Media Responsibly

Introduction

Social media is impacting on the way healthcare is planned, delivered and discussed. In the UK, the whole healthcare sector is representedon multiple social media platforms (see. definitions)

Every day, NHS staff, patients, and the public are discussing the NHS from feedback on services to the detail of commissioning. This quick guide helps you answer these questions:

✓ What should I know about social media now I work for the NHS?

✓ How do I protect my personal information from the public?

✓ What impact could social media have on my job?

If used responsibly and appropriately, social networking sites can offer several benefits for staff. These include:

✓ building and maintaining professional relationships;

✓ establishing or accessing nursing and midwifery support networks and being able to discuss specific issues, interests, research and clinical experiences with other healthcare professionals globally; and

✓ being able to access resources for continuing professional development (CPD).

This document provides guidance for staff on how to use social media and social networking sites responsibly.

The principles outlined in this guidance can also generally be applied to other kinds of online communication, such as personal websites and blogs, discussion boards and general content shared online, including text, photographs, images, video and audio files. (See i. definitions for a comprehensive list of social media portals.)

Key actions and points

Social media can have a positive impact on your job, helping you to make connections across the NHS.

NHS organisations and staff add value to their work and connect with their target audiences through Facebook, Twitter, LinkedIn and YouTube.

Implications of Social Media

Did you know that staff may put their professional registration at risk, and students may jeopardise their ability to join the Nursing and Midwifery Council, if they act in any way that is unprofessional or unlawful on social media including (but not limited to):

• sharing confidential information inappropriately;

• posting pictures of patients and people receiving care without their consent;

• posting inappropriate comments about patients;

• bullying, intimidating or exploiting people;

• building or pursuing relationships with patients or service users;

• stealing personal information or using someone else’s identity;

• encouraging violence or self-harm; and

• inciting hatred or discrimination.

All employees, clinical or otherwise, should be aware that Provide can view content and information made available by employees through social media. Employees should use their best judgment in posting material that is neither inappropriate nor harmful to the company, its employees, or customers.

It would be highly inappropriate to post informal, personal or derogatory comments about patients or colleagues on social media or other public internet forums, and could result in disciplinary action. Provide’s Internet, Email, Instant Messaging and Social Media Policy sets out expectations for staff behaviour on social media and should be referred to if in doubt.

Please bear in mind that if, from your profile or online activity, your employer or place of work can be identified and you are posting content online that could undermine your professional creditability and reputation and/or that of Provide, this could also result in disciplinary action being taken against you.

Sanctions in these instances could include formal warnings or even termination of employment if behaviours and values displayed are thought to be incompatible with those of Provide, or if your actions result in damage, or perceived or potential damage, to the reputation of Provide.

However, the benefits of using Social Media in a professional capacity are many, and, providing that employees are responsible and aware of their position in the community, then using Social Media for professional reasons can be valuable.

Remember, even if your privacy settings are set to the maximum, it is possible that someone else may be able to see what you post – especially if your friends share it on their accounts too. Once this information has been posted it can be duplicated across the internet with no legal stance for it to be removed.

Key actions and points

Check the privacy settings on your social media profile(s)

Even private posts can be copied and shared to a wider audience

Be aware of what you post on social media sites. Information may be public for anyone to see. If you wouldn’t say it aloud in the canteen… don’t post it online

You may want to maintain both a personal social media profile and a professional one.

Top tip: how to check the privacy settings you have on your social media profiles.

✓ Can everyone see the content you post? What comes up when you Google search your name? Once you understand this, check the things you’ve posted and question if they would be acceptable to your patients or employer. You can then decide on how you will manage your profile.

Risk of Intimidation, Harassment or Defamation

Whilst we acknowledge that staff are proud of where they work, listing your job on social media pages can leave you open to criticism from the public. Staff can leave themselves open to intimidation or harassment against the blogger, sometimes without apparent reason.

If a member of staff discloses that they work for Provide or can be identified as an employee through association with other people, they should ensure their profile and related content is consistent with how the Service would expect them to present themselves to colleagues and business contacts.

Defamatory pages on public sector staff are increasing in popularity, these pages claim to “investigate” and “name and shame” NHS workers. These pages can cause irreparable damage to hardworking staff.

Social media sites largely view any comments, slanderous or otherwise, as freedom of speech. This means that they will not remove posts by others, even if these can be proved to be false and legal action would need to be pursued in order for this to be removed.

Any staff member who finds themselves a victim of Intimidation, Harassment or Defamation regarding their professional, is urged to contact their manager. The Marketing team can also be contacted for further advice and support on social media provide.marketing@nhs.net

How do you limit public information on social media?

Social media privacy can vary. Some social media sites are public by nature, and others can be adjusted to protect your personal information from the public. For example information you put into Facebook is automatically public unless your privacy settings are changed.

Different social media can have different audiences, information that might be appropriate on Twitter, might not be acceptable to publish on LinkedIn. You can manage your privacy settings through the settings section of most social media sites once logged in, see below.

Whilst you can change your privacy setting to make less information available to the public, not belonging to social media is the only way to guarantee your information is hidden from

the public. Private posts can be copied by friends or followers and published to the wider internet.

Your choices:

Maintain a private, personal profile (non-public).

Maintain a public, professional profile which only discusses work.

Maintain multiple profiles (e.g. professional profile, personal profile).

Maintain a cross-over profile which discusses both work and life.

Maintain no presence on social media.

Definitions Blog

Content

Site where online articles/discussions are published

Anything posted on a social media site e.g. a photo published on Instagram

Figure 1 Facebook Privacy

Figure 3 Twitter Security and Privacy

Figure 2 LinkedIn Privacy and Settings

Follower

Someone who subscribes to your Twitter account so they receive your postings

Friend Someone you’re linked with on Facebook

Handle

Social media

Your Twitter ID is known as a handle e.g. Provide’s Twitter handle is @Provide_CIC

Online sites/forums that enable you to connect with other people or groups, sharing ideas, content and information

Examples of social media platforms:

• Microblogging – for example, Twitter

• Blogging – for example, WordPress and Tumblr

• Video sharing – for example, YouTube and Vimeo

• Picture sharing – for example, Flickr and Instagram

• Social bookmarking – for example, Reddit and StumbleUpon

• Social sharing – for example, Facebook

• Professional sharing – for example, LinkedIn

How Provide uses Social Media

Facebook

Provide has a corporate Facebook page to stay in contact with our local populations. It can be helpful for health campaigns and emergencies, such as the measles outbreak. It can also help the organisation keen in contact with customers and get timely feedback on services.

Text, URLs, YouTube videos, photos and infographics can all be posted to Facebook pages.

By clicking the ‘Like’ button on the Provide page, all updates will be shown on your feed.

This Facebook is regularly monitored to ensure comments/ questions are dealt with in a timely manner.

Twitter

Twitter has become one of the key social media platforms used by NHS organisations and individual staff.

Twitter is used in a number of ways by NHS organisations and staff: Tweet chats using the hashtags such as #nhssm, #wenurses and #nhscomms. Promoting health campaigns such as flu fighter and Be Clear on Cancer.

Conversations about current or polemic news topics involving parts of the NHS or healthcare industry.

In the event of a crisis, to get simple instructions quickly to the public and media to keep them up to date with developments.

A LinkedIn company page functions like an organisation’s online CV to promote its services, skills and achievements. You can connect with your organisation to stay up to date with its posts.

NHS organisations can re-post interesting projects delivered by their staff on the organisation’s LinkedIn company page to promote their work. LinkedIn analytics tracks the connections, page views and interactions as well as viewer demographics based on job title, level of seniority, location and so forth.

If you need further information on social media, visit the NHS social media information online Social media - NHS Digital where you’ll find lots of helpful social media resources.

Appendix 2 – Unacceptable Use of the Internet

The following activities are considered to be unacceptable uses of the Internet:

• Excessive personal use of the internet;

• Personal use of the internet outside of recognised breaks without permission from the appropriate Line Manager;

• Communication of confidential information over the Internet/Intranet;

• Creating, downloading, uploading or transmitting any obscene or indecent images, data or other material, or any data capable of being resolved into obscene or indecent images or material;

• Creating, downloading, uploading or transmitting any defamatory, sexist, racist, offensive or otherwise unlawful images, data or other material.;

• Creating, downloading, uploading or transmitting material that is designed to annoy, harass, bully, inconvenience or cause needless anxiety to other people;

• Creating or transmitting ‘junk-mail’ or ‘spam’. This means unsolicited commercial web mail, chain letters or advertisements;

• Using the Internet to conduct private or freelance business for the purpose of commercial gain;

• Non-Healthcare profit making activity that abuses the service;

• Creating, downloading, uploading or transmitting data or material that is created for the purpose of corrupting or destroying other user’s data or hardware;

• Downloading unauthorised software (this includes shareware, trial and demo software), images, music, streaming media, screensavers or other executables from the Internet. Only licensed software is to be used on Provide computers. Staff must not download any software for use on Provide owned computers without consultation and authorisation from the Technology department;

• Use of File Sharing services for the sharing of music, videos, pictures and software;

• Distribution or use of copyrighted data without the permission of the copyright holder;

• Posting comments on discussion forums in a professional capacity (other than on the organisation’s intranet site or other approved sites) without prior approval from management; and

• Other activities that do not benefit patient care or that do not support the professional concerns of those providing that care, where those activities constitute abuse of the service.

Appendix 3 – Email Etiquette

Email has become a core business tool. Because of the relative degree of informality involved in email exchanges and the speed at which we communicate it is easy to make mistakes and cause offence or misunderstandings. One of the biggest problems with emails is the sheer volume that people receive every day. Some staff can receive up to 100 emails a day from internal and external sources.

The key aims of this etiquette protocol are to reduce the quantity of emails and improve their quality.

Simple do’s for effective use of emails.

Do take the time to read the organisation’s email policy. There are rules about the types of message that you can send and also how your use of the email system is monitored or screened.

Do try to think about the message content before you send it out and use proper spelling, grammar and punctuation, taking time to check your message before you press ‘send’.

Do make sure that the content is relevant to the recipients. Nobody likes to receive junk email, so check who you copy into the message.

Do be polite. Terseness can be misinterpreted.

Do ensure that you have a relevant "Subject" line.

Do try to quote from the original message where relevant. You can break the quoted message down into paragraphs and comment on them individually to make it clearer.

Do include your ‘email signature’ at the bottom of the mail and always use the standard Provide approved email signature as detailed in the Email Policy.

Do use emphasis where its useful to do so. If the email is in plain text and doesn't allow bold or italics then a common convention is to use a *star* either side of the word you want to stress.

Do use plain English with active rather than passive verbs.

Do remember that the laws relating to written communication also apply to email messages, including, but not restricted to defamation, copyright, freedom of information, wrongful discrimination, obscenity and fraudulent misrepresentation

Do remember that you can still pick up the phone or talk with someone face to face. Avoid sending emails to colleagues in the same office when it is just a short enquiry

Do ensure that e-mails are answered as quickly as possible

Do ensure that you set your out of office when away from the office, even if it is for one day. Include details of who to contact in your absence.

Do ensure that you manage your mailbox and delete emails when they are no longer required.

Simple don’ts for effective use of emails.

Don't use ‘reply all’ unless everyone needs to know what you think or that you are attending the meeting etc. This fills everyone’s inbox with irrelevant emails.

Don't send irrelevant messages, especially to mailing lists or newsgroups. The Communications Team will only send group emails which are;

• Urgent information which must get to staff within a certain time frame.

• Important, to the business of the organisation as a whole

• Relevant to a significant majority of all staff who will receive the email.

Don't send large attachments without checking with the recipient first.

Don’t forward chain letters, virus warning or "make money fast" messages. There are many hoaxes which contain viruses.

Don’t reply to an email message when angry, as you may regret it later. Once the message has been sent, you will not be able to recover it.

Don't type in CAPITALS as this is considered to be SHOUTING.

Don't conduct arguments in public, by copying all recipients on a mailing list.

Don't make personal remarks about third parties. Email messages can come back to haunt you.

Don't send or forward emails containing libellous, defamatory, offensive, racist or obscene remarks or attachments.

Don’t use text message abbreviations and emoticons in business emails.

Don't overuse the high priority option, because when you really do have an urgent message it may not be treated in the way it deserves.

Don’t print emails unless absolutely necessary. Use flags or drag emails to your task list if you require a reminder to do something

Don’t attach a disclaimer at the bottom of your emails. A disclaimer is automatically added at the bottom of all emails being sent.

Don’t rely on read receipt notifications. These indicate that the recipient has opened the email but not necessarily read or acted upon the email, as a personal assistant or administrator may have read the email on behalf of the recipient

Appendix 4 – Email Signature Guidelines

Email Signature Guidelines

Step 1 – Populate the email signature template below with your own contact details. If a field is not applicable to you i.e. mobile number, please delete the wording as appropriate.

T: <Insert base number> | M: <Insert mobile number> | E: <Insert email address>

Please note my working hours are: <insert working hours>

Provide Community Interest Company: 900 The Crescent, Colchester Business Park, Colchester, Essex CO4 9YQ

Registered in England and Wales no. 07320006

T: 0300 303 9999 | | E: provide.enquiries@nhs.net | www.provide.org.uk

Step 2 – In Outlook open a new email.

Step 3 – Across the top toolbar select ‘Signature’ as indicated below, and from the drop down menu that appears select ‘Signatures…’

Step 4 – A window will appear as below – select ‘New’ as indicated.

Step 5 - Add a name for this signature then select ‘OK’

Step 6 - Copy and paste the email signature you populated at the beginning of this word document to the blank window as indicated below, then select ‘OK’.

Step 7 – You can choose if you would like the email signature to always be present on new emails and replies/forwards by selecting your signature title in the drop down menus below. Then select ‘OK’.

You have now successfully uploaded your Provide email signature!

Appendix 5 – Using the Blind Carbon Copy (BCC) email function

When emailing multiple patients/parents/careers/customers you might need to prevent recipients from seeing the names and email addresses of others who receive copies of your message (for example emailing a cohort of patients asking them to fill a survey or to fill some questionnaires, emailing information about the service, new updates, etc.).

You can protect the recipients’ addresses by adding the list into the “Bcc” (Blind Carbon Copy) field instead of “To” or “Cc”.

You can add or remove “Bcc” tool from your email message by clicking the Options tab first and then “Bcc”.

Click here to enter text.

EQUALITY IMPACT ASSESSMENT TEMPLATE: Stage 1

: ‘Screening’

Name of project/policy/strategy (hereafter referred to as “initiative”):

IGPOL88 - Internet Email Instant Messaging and Social Media Policy

Provide a brief summary (bullet points) of the aims of the initiative and main activities:

Project/Policy Manager: Information Governance and IT Projects Manager Date: 29/4/2022

This stage establishes whether a proposed initiative will have an impact from an equality perspective on any particular group of people or community – i.e. on the grounds of race (incl. religion/faith), gender (incl. sexual orientation), age, disability, or whether it is “equality neutral” (i.e. have no effect either positive or negative). In the case of gender, consider whether men and women are affected differently.

Q1. Who will benefit from this initiative? Is there likely to be a positive impact on specific groups/communities (whether or not they are the intended beneficiaries), and if so, how? Or is it clear at this stage that it will be equality “neutral”? i.e. will have no particular effect on any group.

N/A

Q2. Is there likely to be an adverse impact on one or more minority/under-represented or community groups as a result of this initiative? If so, who may be affected and why? Or is it clear at this stage that it will be equality “neutral”?

Q3. Is the impact of the initiative – whether positive or negative - significant enough to warrant a more detailed assessment (Stage 2 – see guidance)? If not, will there be monitoring and review to assess the impact over a period time? Briefly (bullet points) give reasons for your answer and any steps you are taking to address particular issues, including any consultation with staff or external groups/agencies.

Guidelines: Things to consider

Equality impact assessments at Provide take account of relevant equality legislation and include age, (i.e. young and old,); race and ethnicity, gender, disability, religion and faith, and sexual orientation.

The initiative may have a positive, negative or neutral impact, i.e. have no particular effect on the group/community.

Where a negative (i.e. adverse) impact is identified, it may be appropriate to make a more detailed EIA (see Stage 2), or, as important, take early action to redress this – e.g. by abandoning or modifying the initiative. NB: If the initiative contravenes equality legislation, it must be abandoned or modified.

Where an initiative has a positive impact on groups/community relations, the EIA should make this explicit, to enable the outcomes to be monitored over its lifespan.

Where there is a positive impact on particular groups does this mean there could be an adverse impact on others, and if so can this be justified? - e.g. are there other existing or planned initiatives which redress this?

It may not be possible to provide detailed answers to some of these questions at the start of the initiative. The EIA may identify a lack of relevant data, and that data-gathering is a specific action required to inform the initiative as it develops, and also to form part of a continuing evaluation and review process.

It is envisaged that it will be relatively rare for full impact assessments to be carried out at Provide. Usually, where there are particular problems identified in the screening stage, it is envisaged that the approach will be amended at this stage, and/or setting up a monitoring/evaluation system to review a policy’s impact over time.

EQUALITY IMPACT ASSESSMENT TEMPLATE: Stage 2:

(To be used where the ‘screening phase has identified a substantial problem/concern)

This stage examines the initiative in more detail in order to obtain further information where required about its potential adverse or positive impact from an equality perspective. It will help inform whether any action needs to be taken and may form part of a continuing assessment framework as the initiative develops.

Q1. What data/information is there on the target beneficiary groups/communities? Are any of these groups under- or over-represented? Do they have access to the same resources? What are your sources of data and are there any gaps?

Q2. Is there a potential for this initiative to have a positive impact, such as tackling discrimination, promoting equality of opportunity and good community relations? If yes, how? Which are the main groups it will have an impact on?

Q3. Will the initiative have an adverse impact on any particular group or community/community relations? If yes, in what way? Will the impact be different for different groups – e.g. men and women? NA

Q4. Has there been consultation/is consultation planned with stakeholders/ beneficiaries/ staff who will be affected by the initiative? Summarise (bullet points) any important issues arising from the consultation.

Q5. Given your answers to the previous questions, how will your plans be revised to reduce/eliminate negative impact or enhance positive impact? Are there specific factors which need to be taken into account?

Q6. How will the initiative continue to be monitored and evaluated, including its impact on particular groups/ improving community relations? Where appropriate, identify any additional data that will be required. NA

Guidelines: Things to consider

An initiative may have a positive impact on some sectors of the community but leave others excluded or feeling they are excluded. Consideration should be given to how this can be tackled or minimised. It is important to ensure that relevant groups/communities are identified who should be consulted. This may require taking positive action to engage with those groups who are traditionally less likely to respond to consultations, and could form a specific part of the initiative. The consultation process should form a meaningful part of the initiative as it develops, and help inform any future action. If the EIA shows an adverse impact, is this because it contravenes any equality legislation? If so, the initiative must be modified or abandoned. There may be another way to meet the objective(s) of the initiative.

Further information:

Useful Websites www.equalityhumanrights.com Website for new Equality agency www.employers-forum.co.uk – Employers forum on disability www.disabilitynow.org.uk – online disability related newspaper www.efa.org.uk – Employers forum on age

EQUALITY IMPACT ASSESSMENT TEMPLATE: Stage One: ‘Screening’