Secure Messaging & Case Sharing

Safeguards stated

Vendor states ISO 27001; DSPT assured (ODS 8JT17); Cyber Essentials and Cyber Essentials Plus; data encrypted in transit and at rest; servers in a London Microsoft Azure data centre (sensitive patient data hosted in UK or EU; some support data may be processed in the US under the UK Extension to the EU-US Data Privacy Framework). Message Professional can save correspondence to the patient record (EMIS, SystmOne, Vision) by default.

Cost

Not stated on the security page (G-Cloud supplier).

Note: Messages to non-accredited addresses are not guaranteed secure (vendor's own warning). DTAC/DCB0129 not stated on the security page. Second page used: source

Safeguards stated

System C states it is cloud-based so no patient information is stored directly on users' mobile devices; two-factor authentication at login; fully auditable (who viewed/updated). Supports photo attachments to referrals.

Cost

Not stated.

Note: Safeguard details come from a 2020 System C news item; the current System C page (source) is a customer story without security details. No ISO/DSPT/DTAC statements found on System C's pages.

Safeguards stated

NHS England states 'sensitive information is protected with data encryption at rest and in transit' and that Teams 'can be protected and monitored within the NHS secure boundary when accessed via secure NHS networks'. Where used for clinical care, clinical risk standards DCB0129 and DCB0160 'need to be applied'. Advises not to store confidential information on devices unless necessary.

Cost

Cloud storage described as free; no other cost stated.

Note: Page is undated and does not explicitly say whether patient-identifiable information may be shared in Teams chats; follow local trust policy.

Safeguards stated

Described by NHS England as 'a secure encrypted email and collaboration service'. Gateway threat detection for malware, phishing and spam. Confidential information sent to non-NHS addresses must be encrypted unless the recipient domain is on the DCB1596 Secure Email Standard list; built-in encryption feature for sending to non-secure addresses (e.g. Gmail).

Cost

Not stated on the page opened (nationally commissioned; no charge to individual users is stated).

Note: Community Pharmacy England reported on 1 Dec 2025 that the NHSmail programme is being rebranded 'NHS.net Connect' (addresses and sign-in unchanged; rollout gradual): source . Cost/funding not stated on the official page.

Safeguards stated

Vendor homepage displays ISO 27001, Cyber Essentials Plus and 'DTAC Ready' logos; states 'Secure, compliant, and trusted'. NHS England dermatology digital playbook describes Pando as an 'Approved supplier on the NHS Transformation Directorate Clinical Communications Framework', with photos 'securely saved in the app rather than downloaded or saved to the user's device or in the cloud' and photo sharing linked to nhs.net email.

Cost

Not stated (vendor says 'affordable').

Note: Encryption method and hosting location not stated on the homepage. The NHSX Clinical Communications Framework ran 2020-2022 (+12 months possible), so 'approved supplier' status refers to that framework; confirm current procurement route.

Safeguards stated

Sectra describes it as a 'secure platform' giving access 'in ways that protect patient data'. No technical details (encryption, hosting, HSCN) stated on the page opened.

Cost

Not stated (contracted by trusts).

Note: Press release undated (refers to 2023 figures; Digital Health reported the same on 29 Nov 2024). Technical safeguards not documented on the public page.

Safeguards stated

Product description (Nov 2025): chat content end-to-end encrypted; TLS per BSI standards; data centre in Germany with TIER IV, ISO 27001 and ISO 9001 certification; attachments up to 110 MB. gematik product approval reported Jan 2025; controlled commissioning completed and nationwide rollout announced Nov 2025.

Cost

Per CGM price list; set-up charges may apply (no figures in the document).

Note: Approval and rollout dates are from vendor-sourced trade press items (zwp-online.info), not the gematik list.

Safeguards stated

Vendor states first provider to receive gematik TI-Messenger approval (reported 9 Apr 2024); end-to-end encryption; hosted in Germany; ISO 27001 (a C5 badge is shown graphically but not named in text).

Cost

Not stated; three-month trial 'at minimal cost' mentioned.

Note: BSI C5 attestation not confirmed in text.

Safeguards stated

gematik states every KIM message is 'automatically encrypted and signed', only the recipient can decrypt, sender/recipient details signed and checked; only approved KIM providers may be used.

Cost

Not stated on the page opened.

Note: Suited to letters and findings rather than real-time case discussion; attachment limits and costs not on this page.

Safeguards stated

gematik requires the open Matrix protocol and a gematik approval (Zulassung) for each provider/product; states 'every communication via the TI-Messenger is protected several times against third-party access'. Intended for short, time-sensitive ('flüchtige') communication.

Cost

Not stated by gematik (set by each provider).

Note: Uptake still modest: gematik dashboard figures reported 9 Mar 2026 show 7,309 institutions using a TI-Messenger (Pharmazeutische Zeitung).

Safeguards stated

Website describes the network as secure and data-protection compliant; no encryption method, hosting location or certification stated on the homepage.

Cost

Price categories for hospitals, rehab clinics, radiology/cardiology practices and other practices; amounts not on homepage.

Note: Technical safeguards not documented on the public homepage; ask the provider for the DPA and technical-organisational measures.

Safeguards stated

Describes exchange as secure and shows a GDPR (DSGVO) badge; encryption method not described.

Cost

Not stated.

Note: Network appears to be branded connectMT now; technical safeguards not documented on the public page.

Safeguards stated

HIN states it enables 'privacy-compliant sending of sensitive data by email'; HIN-encrypted mails are marked [HIN secured]; HIN website lists an ISO 27001 certification page.

Cost

Membership-based; prices not on the pages opened.

Note: Encryption details come from the HIN booklet v7.0 (Nov 2022): source . ISO 27001 scope not read.

Safeguards stated

HIN: short messages and video telephony within the HIN trust space. Threema (25 Nov 2025): HIN Talk 'is now based on Threema OnPrem', keeping data within Switzerland.

Cost

Part of HIN membership; prices not stated.

Note: end-to-end encryption not explicitly stated in the sources read (Threema products are generally E2E, but not stated for HIN Talk here).

Safeguards stated

A1 brochure: findings transfer relies on digital signatures and a secured network connection (GIN); online backup encrypted before transfer. Encryption method for findings transfer not described.

Cost

Packages (receive / send-receive / Wahlarzt); prices not shown.

Note: A1 brochure date unclear (footer '08/16' but references 2018 law). Official-body listing: Ärztekammer Wien fax-replacement overview (updated 5 Feb 2026): source . Not designed for real-time case discussion.

Safeguards stated

CGM states 'TÜV-audited security mechanisms' protect the network and C-BOX sends data 'sicher verschlüsselt'; method not named.

Cost

Quote-based.

Note: Listed by Ärztekammer Wien (5 Feb 2026) among recommended fax replacements (DaMe, Medical Net, GNV) until a public solution arrives (expected H2 2026 at the earliest).

Safeguards stated

Vendor security page: end-to-end encryption of messages, photos, videos, files and calls; ISO 27001 and NEN 7510 certified; C5 Type 1 attestation; annual NHS Data Security and Protection Toolkit submission; GDPR; Secure Camera saves media to in-app 'Connect Media', not to the phone gallery or iCloud/Google Drive/Dropbox.

Cost

Messenger free to download; 'Connect for Organisations' tailored/paid.

Note: Siilo did not shut down; it was renamed. Hosting location not stated on the security page. An outage of the messaging function was logged on a third-party status site (isdown.app) - not significant for status. Not part of the German TI-Messenger network.

Safeguards stated

Vendor states end-to-end encryption and zero-knowledge architecture; no phone number/email required; data in ISO 27001-certified data centres in Switzerland or self-hosted (OnPrem); GDPR and Swiss FADP; DPA included as standard; open-source apps, externally audited cryptography; central admin can revoke access.

Cost

Subscription: Core 3.00, Professional 5.00 per user per month (CHF/EUR/USD); 30-day free trial for up to 30 users.

Note: General business messenger, not a health-specific product or medical device; compliance statements are the vendor's own; use only the organisation-managed Work version, not private Threema.

Safeguards stated

Vendor states CE mark (DECA5900190121), FDA listing D245938 and other registrations; ISO 27001 (ISMS); patient data anonymised at gateway server; on-device chat data encrypted; VPN between hospital and cloud; TLS; app passcode; images cannot be downloaded and cache cleared.

Cost

Quote-based; options extra.

Note: MDR class and EU hosting location not stated; European availability and support should be confirmed with Allm. Company active in 2026 (press release 4 Jun 2026).

Safeguards stated

Vendor states TLS 1.2, DTLS/SRTP for video, AES-256 at rest; SOC 2 Type 2; signs a BAA with each user at registration and institutional BAAs for enterprise customers.

Cost

Not stated on the security page.

Note: US-focused; not relevant for UK/EU patient data.

Safeguards stated

Microsoft states its HIPAA BAA is available by default through the Microsoft Online Services Data Protection Addendum; Teams is listed in scope for Office 365 Commercial and GCC. Microsoft also states 'using Microsoft services doesn't on its own achieve HIPAA compliance'.

Cost

Microsoft 365 subscription.

Note: Configuration and governance by the organisation determine compliance.

Safeguards stated

Vendor markets 'HIPAA Compliant Messaging Software for Healthcare'; states end-to-end encryption, HITRUST certification, PIN lock, access reports and audit logs, and message auto-deletion.

Cost

Quote-based.

Note: BAA not mentioned on the product page. US-oriented; GDPR/UK GDPR suitability not documented.