Does Forwarding NHS Emails in Outlook Breach Information Governance?
Question details
The user is inquiring whether forwarding NHS emails to another Outlook or personal email account constitutes a breach of Information Governance (IG) policies.
- Product
- Microsoft Outlook
- Device & OS
- not provided
- Scenario
- A user needs to forward sensitive work emails (NHS) to another email account for access or convenience.
- Observed behavior
- The user wants to clarify the compliance rules and risks associated with transferring NHS email data to external or personal email servers via Outlook forwarding.
Review your organization's Information Governance (IG) policies and ensure you clearly understand the classification of the data you are handling before forwarding any work-related emails outside the secure network.
Verify Account Authorization and Compliance Requirements
Determine whether the destination email address is an approved NHS account or an unauthorized personal service to avoid compliance breaches.
Forwarding an email sends a direct copy of its contents and attachments to the destination server. If you send sensitive NHS data to personal accounts like Hotmail, Gmail, or Outlook.com, you are placing patient or organizational data on unapproved external servers, which is a severe violation of information governance rules.
Check the domain of the receiving account to ensure it is an approved NHS Exchange account rather than a personal email service.
Request documented approval from your local IT or information security team before setting up any automated forwarding rules or manually forwarding sensitive data outside the secure NHS network.
Do not attempt to change the 'From' address in the Outlook client to bypass restrictions. The message data is still transferred to external servers, and this does not create an exemption from NHS compliance rules.
Need a Secure Document Editor? Try WPS Office
While email compliance and routing are managed by your IT network, handling sensitive documents safely requires reliable and secure software. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office, perfect for creating, editing, and protecting your local documents securely.
- 1. Visit the official website: Navigate to the official WPS website to download the latest secure version of WPS Office.
- 2. Install the software: Run the downloaded installer and follow the on-screen prompts to set up the office suite on your device.
- 3. Open and secure documents: Launch WPS Office to securely open your Microsoft Office files and apply local password encryption if required.
Frequently Asked Questions
Can I forward NHS emails to a personal Outlook.com account?
No, forwarding sensitive NHS information to personal accounts (like Outlook.com, Gmail, or Hotmail) generally breaches Information Governance rules unless you have explicit, documented permission from your NHS IT department.
Does changing the 'From' address in Outlook make it secure to forward?
No. Changing the 'From' address does not prevent the underlying message data from being transferred to the external server, nor does it create an exemption from organizational compliance rules.
Are there any exceptions for forwarding work emails to personal accounts?
Exceptions are extremely rare in healthcare environments and require formal, documented approval from your organization's Information Security team or IT department.
Why is forwarding an email considered a security risk?
When you forward an email, a complete copy of the message contents and its attachments is sent to and stored on the destination server, placing sensitive data outside your organization's secure and monitored network.
