Emailing a patient referral is not against the law in the UK, but ordinary email is one of the weaker ways to send one. UK GDPR does not ban email. It requires practices to protect health information with security appropriate to the risk, and to be able to show how they do it. The real question is whether a particular email setup, used by a particular team on a busy day, actually meets that standard. For many practices the honest answer is “not reliably”.
This guide explains what the rules require, where email falls short, how NHSmail fits in, how to reduce the risk if you do use email, and what to look for in a safer alternative. It is written for principal dentists, practice managers and anyone responsible for information governance in a dental practice. It is general guidance rather than legal advice, so check anything specific with your data protection lead.
In brief
- Referrals contain health data, which UK GDPR treats as special category data needing extra care.
- UK GDPR requires security appropriate to the risk. It does not name email as either acceptable or unacceptable.
- The main risks with email are sending to the wrong address, uncontrolled copies, and no record of who has seen what.
- NHSmail is a secure email service, but it only helps when both ends use it or its encryption feature, and it does not stop human error.
- Secure referral forms and portals remove most of these risks by keeping each referral in one controlled place.
What UK GDPR says about sending health information
A dental referral usually contains the patient’s name, date of birth, contact details, medical history, clinical findings and often radiographs or photographs. Under UK GDPR, information about a person’s health is special category data. You need a lawful basis and an additional condition to process it. For referrals made as part of a patient’s care, the relevant condition is usually the one covering the provision of health care.
Having a lawful basis is only part of it. Two principles matter most when it comes to sending referrals:
- Integrity and confidentiality. Personal data must be processed in a way that keeps it appropriately secure, including protection against unauthorised access and accidental loss.
- Accountability. You must be able to show how you comply, not simply say that you do.
Article 32 of UK GDPR adds that security measures should be appropriate to the risk, taking into account the nature of the data. Encryption is given as an example of an appropriate measure. Health data carries a higher risk than most personal data, so the expected standard is higher too.
Dental professionals also have professional obligations. The General Dental Council’s Standards for the Dental Team include a principle to maintain and protect patients’ information, and practices holding NHS contracts complete the Data Security and Protection Toolkit each year.
If something does go wrong, a personal data breach must be reported to the Information Commissioner’s Office within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms. Where the risk is high, the patients affected must also be told without undue delay. All breaches, reportable or not, should be recorded internally.
Where email falls short
Email was designed to deliver messages quickly to anyone with an address. That makes it convenient, and it is also the source of most of its weaknesses as a way to send clinical information.
Sending to the wrong person
Personal data emailed to the wrong recipient is one of the most common types of breach reported to the ICO. Address autocomplete makes it easy to choose the wrong contact, particularly when two practices or two colleagues have similar names. Once the message has gone, there is usually no way to take it back.
Encryption is not guaranteed from end to end
Most business email services encrypt messages as they travel between servers, but this depends on both providers supporting it, and the sender normally has no way of checking. Once the message arrives, it sits in the recipient’s mailbox protected only by that mailbox’s own security. If an account is compromised, every referral in it is exposed.
Copies in many places
A single emailed referral can quickly exist in the sender’s sent items, the recipient’s inbox, a shared mailbox, a colleague’s inbox after forwarding, a downloads folder, a desktop and a backup. Each copy is a further risk, and it becomes very difficult to say where a patient’s information is held or to delete it once it is no longer needed.
No reliable record
Email gives you little control over who opens a message, who forwards it, or what happens to attachments once they are downloaded. If you are ever asked to show who has accessed a patient’s referral, an inbox is not much help.
Shared inboxes and changing teams
Many practices route referrals to a shared address that several people can read. When staff leave, passwords are not always changed, and access tends to grow over time rather than being reviewed.
Large attachments
Radiographs and CBCT scans can be too large to email comfortably. This pushes people towards file transfer services or personal accounts, which brings in more third parties and more copies.
Incomplete referrals
A free-text email has no required fields, so it is easy to leave out information the specialist needs. Missing medical history or radiographs lead to further emails, each carrying more patient information, and delay the patient’s care.
What about NHSmail?
NHSmail is the NHS’s secure email service for health and care organisations. Messages sent between NHSmail addresses are encrypted, and the service meets the national secure email standard (DCB1596). When sending to an address that does not meet that standard, NHSmail users can encrypt the message by adding [secure] to the subject line, and the recipient then reads it through a protected service.
For practices that hold NHS contracts, NHSmail is a sensible choice for sending patient information to other health and care organisations. It has limits for referrals between private practices, though:
- Many private-only practices do not have NHSmail accounts.
- The encryption only helps if it is used every time, and the [secure] tag is easy to forget.
- It does not prevent a message being sent to the wrong address.
- Copies and attachments still end up in inboxes and download folders.
- It gives the receiving practice no structure: a referral is still an email to be read, sorted and followed up.
In many areas, referrals into NHS services now go through local electronic referral systems rather than email, so it is worth checking the arrangements with your local commissioner.
If you do use email, reduce the risk
Some practices will continue to receive referrals by email for a while, and some referrers will always prefer it. If so, these steps reduce the risk:
- Check the address every time. Consider turning off autocomplete for external addresses, or keeping a short list of verified referrer addresses.
- Use encryption where both sides support it. NHSmail between NHSmail accounts, or with the [secure] tag, is one example.
- Keep patient details out of the subject line. Subject lines are often visible in previews and notifications.
- Send only what is needed. Every extra detail or attachment adds risk without necessarily helping the referral.
- Password-protect attachments as a minimum, and send the password by a different route, such as a phone call.
- Protect the mailbox. Use strong passwords and two-factor authentication, give access only to staff who need it, and review that list when people join or leave.
- Do not let referrals pile up. Move each referral into the patient’s record once it has been dealt with, then delete the email copies, including any downloaded attachments.
- Write it down. A short written procedure, and training for everyone who handles referrals, is part of showing accountability.
These steps help, but they rely on everyone following them every time. That is the underlying problem with email for clinical information: its safety depends on the care taken by the busiest person in the building on their busiest day. We look at the wider case for moving away from email in why a separate referral system is better than email.
Safer ways to send and receive referrals
The alternative most practices move to is a secure referral form or referral portal. Instead of composing an email, the referring dentist completes an online form over an encrypted connection. The referral is stored in one secure place, and the receiving practice reviews it there rather than in an inbox.
This approach deals with most of the weaknesses of email:
- No wrong address. The referral goes to the practice whose form was used, not to whichever contact autocomplete suggested.
- One copy, not many. The referral lives in one place, with no attachments scattered across inboxes and desktops.
- Controlled access. Only authorised members of the practice team can log in and view referrals.
- A clear record. Activity and messages are recorded against the referral.
- Complete referrals. Required fields mean the information you need arrives first time, which saves time for both practices.
- A defined retention period. Referrals can be removed once they have been moved into the clinical record.
What to check before choosing a referral platform
Moving referrals into a platform moves part of the security question to the supplier, so it is worth asking:
- Where is the data hosted, and does any of it leave the UK?
- Is data encrypted in transit and at rest, and which version of TLS is used?
- Which sub-processors handle data, and for what purpose?
- Is any patient information sent to automation services or AI tools, and if so, where are they based?
- Do email notifications contain clinical information, or only an alert to log in?
- Is there a record of activity, and can you control which staff have access?
- How long is referral data kept, and can you change that?
- Is the supplier registered with the ICO?
Any supplier handling patient data on your behalf should be able to answer these questions clearly and in writing. Our security and compliance FAQs answer them for Valident.
How Valident handles referrals
Valident provides secure online referral forms and two-way referral messaging for UK dental practices. Referrals are submitted over HTTPS using TLS 1.2 or higher and stored encrypted in a UK data centre operating to ISO 27001 standards. Each referral, and any messages about it, stay together in one record, with access limited to authorised users in your practice and a clear history of activity.
Email notifications let your team know that something needs attention, but they do not contain clinical information, and clinical information is never passed to third-party automation platforms. Referral data is kept for 28 days by default and the retention period can be adjusted. Valident Ltd is registered with the ICO under registration number ZB743517. Our security and compliance page has more detail, including the services that support the platform.
If you would like to replace emailed referrals, vForms provides the referral forms and dashboard, and vResponse adds secure messaging with the referring practice. Our guide to dental referral management covers the rest of the referral process, from tracking to reporting.
Frequently asked questions
Is it illegal to email patient information in the UK?
No. UK GDPR does not prohibit email. It requires security appropriate to the risk, and health information carries a higher risk. Whether a particular use of email is acceptable depends on how well it is protected and how consistently the safeguards are followed.
Is a standard business email account secure enough for referrals?
A business account with strong passwords, two-factor authentication and encryption between servers is far better than a personal account. It still leaves the main risks in place: messages sent to the wrong address, copies building up in inboxes, and little control over what happens after delivery.
Is password-protecting attachments enough?
It is a sensible minimum when email cannot be avoided, provided the password is sent by a different route. It does not protect the body of the email or the subject line, and it does not help if the message goes to the wrong address along with enough detail to guess the password.
Do we have to report a referral emailed to the wrong person?
Every incident should be recorded internally. Whether it must be reported to the ICO depends on the risk to the patient. If it is likely to result in a risk to their rights and freedoms, it must be reported within 72 hours of the practice becoming aware of it. If you are unsure, the ICO publishes guidance and a self-assessment to help you decide.
Can we still accept referrals by email while we move to a secure form?
Yes. Most practices run both for a period. Publishing a link to your referral form, and replying to emailed referrals with that link, usually moves most referrers across within a few months.
