SMS, email and online messaging

Digital messages are fast and convenient, but they can be forwarded, screenshotted, opened by the wrong person or read on a shared device.

Reception staff must use approved systems and approved wording. Personal accounts, informal messaging apps and unverified addresses increase confidentiality and security risks.

Before sending a message

• Check the recipient: number, email, online account and patient identity.
• Check consent and preference: whether the patient has agreed to this route where required.
• Check sensitivity: whether the message could reveal something harmful if seen by another person.
• Use approved templates: especially for appointments, recalls, results and administrative messages.
• Record where needed: particularly if the message changes the next action.

Keep content limited

Include only the information needed. Often it is enough to say the practice needs to speak with the patient rather than giving clinical details. Follow approved wording to avoid causing unnecessary anxiety.

Do not paste detailed clinical notes into SMS or email unless the practice has a clear policy and a secure route for doing so. When unsure, check before sending.

Online access and proxy risks

Patients can view parts of their GP record online and some have proxy users who act on their behalf. Before adding sensitive notes or sending messages via online portals, consider whether visibility could create a safeguarding or confidentiality risk.

This is particularly relevant for young people, domestic abuse, coercion, safeguarding concerns, sexual health, mental health and third-party information.

Messaging systems

A digital message is still a disclosure of information; check the recipient, content, route and safety before sending.