The NHSmail service gives access to a range of additional Microsoft applications which include Microsoft Teams for collaboration, SharePoint and OneDrive for file repositories alongside fully integrated security and access controls.
You must ensure you fully understand the privacy options in these apps and how to use them to avoid any risk to the privacy of your documents.
Default privacy settings should always be set to private, otherwise you risk sharing content with all users on the NHSmail tenant and is not restricted to your organisation.
It is your responsibility to be aware of these settings, the consequences of changing them and the risks involved.
Important note:
- The Public setting allows anyone on the NHSmail tenant to view any content within the selected team/site. Any files / documents / recordings, will be searchable and viewable across the NHSmail platform – this is not just restricted to your organisation
- The Private setting means only the team/site owners can control access and add members to view and interact with the content as appropriate. The private setting limits access to content.
Privacy monitoring and Reporting functionality is available for Local Administrators (LAs) across Teams and SharePoint Online to support content owners with protecting their data. Please visit the O365 Privacy Monitoring article for more information about the tooling in place.
If you choose to change the settings to public and use the ‘allow everyone’ setting you will publicly share content with all NHSmail users on the tenant. It is unlikely you would ever need to do this, and you may breach data protection, safety, and security protocols if you do so.
Checking settings and your responsibility
This section of the article outlines how you can check privacy settings across Microsoft Teams, and SharePoint Online.
Content should always be set to private unless you have a reason for anyone in NHSmail to have full access to it. The private setting should always be applied if you are working on documents containing personal data of patients, staff, or others.
Contact your data protection team if you are in any doubt about O365 privacy settings. It would never be appropriate to publicly share such information as personal data of patients, staff or others.
Microsoft Teams
Teams are created with a default permission of private. For support on how to create a Team please visit the Creating a team and adding owners or members permissions levels for non admin user guidance.
This means only the owners, members and guests given permission to use that Teams site can access it. Both the LA (Local Administrator) and owner of a Team can change the privacy setting from private to public which gives access to all NHSmail users which includes the ability to view/edit any files placed in that Team. To check your Team is set to private within Teams go to the Team name and select More options > Edit team toward the bottom of the menu.
Or you can amend the privacy setting for an existing Team via the edit process. Please sign in using your NHSmail credentials and visit Admin > Teams to administer.
For information on available security groups on NHSmail platform, please read the following NHSmail support site guidance: https://support.nhs.net/article-categories/security-group-management/
General Microsoft 365 Components Guidance
Other Microsoft components also have a public setting, such as Microsoft Teams. When set to public this will share to all NHSmail users who can then view and edit the content. It is very unlikely that you will ever want to share anything as public. You should never allow personal data of patients, staff, or others to be made available through using the public setting. If there is any potential risk, you should not share anything as public.
If in doubt, do not add any additional permissions and speak to your data protection team for guidance. It would never be appropriate to publicly share such information as personal data of patients, staff or others.
| Last Reviewed Date | 18/07/2024 |
