The NHSmail service gives access to a range of additional Microsoft applications which include Microsoft Teams for collaboration, SharePoint and OneDrive for file repositories alongside fully integrated security and access controls.
You must ensure you fully understand the privacy options in these apps and how to use them to avoid any risk to the privacy of your documents.
Default privacy settings should always be set to private, otherwise you risk sharing content with all users on the NHSmail tenant and is not restricted to your organisation.
It is your responsibility to be aware of these settings, the consequences of changing them and the risks involved.
Important note:
- The Public setting allows anyone on the NHSmail tenant to view any content within the selected team/site. Any files / documents / recordings, will be searchable and viewable across the NHSmail platform – this is not just restricted to your organisation
- The Private setting means only the team/site owners can control access and add members to view and interact with the content as appropriate. The private setting limits access to content.
Privacy monitoring and Reporting functionality is available for Local Administrators (LAs) across Teams and SharePoint Online to support content owners with protecting their data. Please visit the O365 Privacy Monitoring article for more information about the tooling in place.
If you choose to change the settings to public and use the ‘allow everyone’ setting you will publicly share content with all NHSmail users on the tenant. It is unlikely you would ever need to do this, and you may breach data protection, safety, and security protocols if you do so.
Checking settings and your responsibility
This section of the article outlines how you can check privacy settings across Microsoft Teams, and SharePoint Online.
Content should always be set to private unless you have a reason for anyone in NHSmail to have full access to it. The private setting should always be applied if you are working on documents containing personal data of patients, staff, or others.
Contact your data protection team if you are in any doubt about O365 privacy settings. It would never be appropriate to publicly share such information as personal data of patients, staff or others.
Microsoft Teams
Teams are created with a default permission of private. For support on how to create a Team please visit the Creating a team and adding owners or members permissions levels for non admin user guidance.
This means only the owners, members and guests given permission to use that Teams site can access it. Both the LA (Local Administrator) and owner of a Team can change the privacy setting from private to public which gives access to all NHSmail users which includes the ability to view/edit any files placed in that Team. To check your Team is set to private within Teams go to the Team name and select More options > Edit team toward the bottom of the menu.
Or you can amend the privacy setting for an existing Team via the edit process. Please sign in using your NHSmail credentials and visit Admin > Teams to administer.
SharePoint Online
SharePoint site owners are in control of privacy settings for their content. To administer your site’s privacy settings please sign in to O365 using your NHSmail credentials and visit SharePoint Online. Navigate to the site for which a change is required.Once within the site, please select site contents and then site settings as shown below:
Under Site settings, select the site permissions option:
Click on the grant permission option in the top left corner of the screen:
You can control access to the site using the options from the pop out window. To check your site has a private setting, only the owner’s credentials should appear within the shared with field.
To amend the site settings to public select invite people search everyone except external users and click share. This site is now shared with all users across the nhs.net tenant.
To revert to private, remove everyone except external users from the list below:
Some SharePoint site templates provide a more seamless experience to navigate to the sharing permission menu. If you see a Share option on your site homepage,
Selecting it will provide you immediate access to manage your content:
When selecting your SharePoint site template please ensure you review the privacy settings. Some templates have a default setting of public, please demonstrate caution when selecting the below:
- Enterprise Search centre
- Community Portal
- Team Site- SharePoint online Configuration
General Microsoft 365 Components Guidance
Other Microsoft components also have a public setting. When set to public this will share to all NHSmail users who can then view and edit the content. It is very unlikely that you will ever want to share anything as public. You should never allow personal data of patients, staff, or others to be made available through using the public setting. If there is any potential risk, you should not share anything as public.
If in doubt, do not add any additional permissions and speak to your data protection team for guidance. It would never be appropriate to publicly share such information as personal data of patients, staff or others.
| Last Reviewed Date | 29/01/2024 |
