An Evaluation of a Secure Email Service (Healthmail): A Cross-sectional Survey of Irish GPs

Securing sensitive patient information has become increasingly important after cyber-attacks on healthcare systems. Many current forms of communication such as fax and letter are insecure. Effective cybersecurity can increase patient safety. Healthmail is a secure email service which acts as a means of transferring patient information. Healthmail is available to a range of Irish medical workers. An online survey was sent to Healthmail account holders and to general practitioners (GPs) in Ireland. Self-declared GP account holders’ responses were examined to evaluate their usage of Healthmail, opinions on Healthmail’s merits and suggestions for improving Healthmail. The response rate was 19.5% (276/1415). Over half (51.5%) of respondents sent at least one Healthmail email in the previous week. Overall, 64.7% (n=178) of respondents said Healthmail improves patient care. Also, 58.7% (n=155) of respondents said Healthmail should be expanded to other disciplines. Many respondents (40.5%) said they would be happy to communicate with patients using secure email. These results suggest that Healthmail’s perceived utility is high and could increase. Therefore, Healthmail has the potential to become part of mainstream communication between healthcare workers.

structured messages via Healthlink and fax, phone and letter. Letters and fax can easily be intercepted. Phone calls, though more secure, do not facilitate record keeping. However, large scale interception of data is less feasible with these forms of communication when compared to email [4].
"Effective cybersecurity is fundamental to patient safety." [5]. The recent Wannacry ransomware attack on the National Health Service in Britain [6] has highlighted the vulnerability of sensitive patient information in the information technology age. There have been several examples of cyber-attacks on healthcare organisations [7]. According to the 1995 European Union Directive on Data Protection, it is the responsibility of health data controllers to provide their patients with assurances that their data is secure [8]. Also, the new General Data Protection Regulation (GDPR) makes 'data protection by design' a legal obligation [9]. One way patient data can be protected is through secure clinical email with access controls.
Healthmail facilitates healthcare providers in transferring sensitive patient information securely. All agencies connected to Healthmail have transport layer security (TLS) which encrypts data in transit, preventing interception of sensitive data. The hard drives of the Healthmail servers are encrypted using Microsoft Bitlocker. Healthmail operates using a private bounded network and has access controls only allowing authenticated third parties to send and receive Healthmail emails. Also, Healthmail provides read receipts. A Cochrane review [10] of email communication describes encryption, access controls and read receipts as necessary elements of secure email services. Healthmail is available to all GPs and community pharmacies a in Ireland, once they register for an account. Clinicians in the Irish Health Services a This study was carried out before Healthmail was made available to pharmacies Universal Journal of Public Health 6(5): 284-297, 2018 285 Executive (HSE) and Voluntary Hospitals are automatically securely connected to Healthmail from their institutional accounts. Similar systems to Healthmail exist internationally such as NHS Mail in Great Britain. The researchers are not aware of any evaluations of services of this kind. A Cochrane review [10] concludes that there is a dearth of research on email as a means of communication between healthcare professionals.
With most patient information transferring from analogue to digital format, a concern of patients and healthcare providers [11] is privacy. In one survey 50% of patients agreed/strongly agreed that they were worried about health information being transferred over the internet [12].
There are several ways, other than security, that Healthmail can improve patient care. By functioning as a separate email solution, designated specifically for healthcare communication, it might overcome some of the difficulties with informality when standard email is used [13]. Also, as outlined by Atherton, Car and Meyer [14], the use of email between healthcare providers has advantages such as asynchronous communication, low cost and quick, and a simple means of transferring digital images. However, email can be slower than direct verbal communication. Also, the uptake of information technology such as email has been slow in health services [15].
A review of email communication between healthcare providers suggests that much of the research on this topic is conducted in North America and may not be applicable internationally due to different types of email technology and levels of availability [16].
In this context, this research sought to evaluate the usage patterns of Healthmail account holders, their opinions on Healthmail and their suggestions for improving Healthmail.

Methods
A cross-sectional design was used. An online survey was sent to all Healthmail account holders and to all members of the Irish College of General Practitioners (who may or may not be Healthmail account holders). For this paper, only those who were both GPs and self-declared that they have a Healthmail account were subject to analysis. The survey was sent to 1,541 Healthmail account holders on the 30th of January, 2017. Of these, 1,415 were GPs. Notices of the questionnaire were also placed on the Irish College of General Practitioners (ICGP), General Practices Information Technology (GPIT) and HSE websites, and in Forum, the monthly ICGP magazine. Responses were anonymous. To incentivise questionnaire completion, all participants were entered into a draw to win free registration to the ICGP's annual meeting.
The survey questions (appendix A) were developed in conjunction with an Irish GP who uses Healthmail and was involved in the development of the Healthmail service. Questions in the survey covered respondents' self-declared Healthmail usage, their experiences of Healthmail and their thoughts on improving Healthmail. The survey questions were mostly multiple choice questions. There were several qualitative questions but only one of these was subject to analysis for this paper: 'What do you mainly use Healthmail for?' The study and the survey were considered by the ICGP ethics committee. However, ethical approval was not deemed necessary given the nature of the research.
The survey was piloted with ten GPs who use Healthmail. They each provided feedback, which was discussed and incorporated into a revised survey where appropriate. Data was analysed using v25 of SPSS.

Results
Overall, 276 GP Healthmail account holders responded to the questionnaire, representing a response rate of 19.5%.
Respondents were asked whether their practice area was 'Urban' (population of over 5,000 people), 'Rural' or 'Mixed'. Overall, 54.2% (n = 226) worked in an 'Urban' area, 18.5% (n = 51) in a 'Rural' area and 27.3% (n = 75) in a 'Mixed' area. A breakdown of GP demographic information is in Table 1.  Account holders were asked in what setting they use Healthmail, 99.3% (n = 274) responded 'GP practice', and 0.7% (n = 2) said an 'Out of hours Co-op' c .
Account holders were asked how many Healthmail emails they had sent in the previous week and 48.5% (n = 133) had sent no emails in the previous week, 33.9% (n = 93) had sent less than five, 9.9% (n = 27) had sent between five and nine, and 7.7% (n = 21) had sent more than 10. Chi square tests were conducted to examine whether a relationship existed between the number of Healthmail emails sent in the previous week and demographic variables; gender, age and area. No significant relationships were found. A multiple ordinal regression was conducted to examine the relationship between respondent demographics and Healthmail usage ( Table 2). In this regression, area was significantly related to Healthmail usage; those from a rural area were more likely to have sent more Healthmail emails in the previous week compared to those from an urban area.
Those with an account were asked who they are communicating with using Healthmail, 60.1% (n = 166) said GPs. Further detail can be seen in Figure 1. Respondents were also asked what they 'mainly use Healthmail for'. The most prominent themes are seen in c An out of hours GP service for patients, active from 6.00pm to 8.00am on Monday to Friday, and for 24 hours on Saturdays, Sundays and state holidays.  Participants were also asked if they think the Healthmail service should continue and 80.8% (n = 223) relayed that it should, 5.4% (n = 15) said it should not and 13.8% (n = 38) said that they 'don't know'.
Respondents were asked if they would be happy to communicate with patients using a 'secure email solution', 40.5% (n = 111) said they would, 39.1% (n = 107) said they would not and 20.4% (n = 56) said they 'don't know' The questionnaire also asked whether one would like Healthmail availability to be expanded to other disciplines. Overall, 58.7% (n = 155) of respondents said they would, 14.8% (n = 39) said they would not and 26.5% (n = 70) said they 'don't know'.
Chi square tests were conducted to examine whether a relationship existed between responses to several questions about respondents' opinions of Healthmail (Table 4) and demographic variables; gender, age and area. Due to small cell counts, 'don't know' and 'no' responses were combined and compared to 'yes' responses. A significant relationship was found between gender and whether the Healthmail service should be expanded to other disciplines χ 2 (1, n = 264) = 6.44, p < .05. A multiple logistic regression was conducted to investigate whether demographic factors significantly predicted opinions on Healthmail, the results of which are displayed in Table 4. In this, the only significant finding was that gender predicted response on whether respondents would like to see Healthmail expanded to other disciplines. Participants were asked if Healthmail was expanded who they would like to see it expanded to and 50% (n = 138) said pharmacists. Further detail of who respondents would like to see access to Healthmail expanded to can be seen in Figure 2. Respondents were also provided with a list of potential suggestions to change Healthmail; 85.1% (n = 235) of participants suggested integrating Healthmail with the GP practice software system. Further information can be seen in Figure 3.

Discussion
Healthmail, a secure means of transferring sensitive patient data, appears to be widely used and a service that Healthmail account holders would like to see continue. Despite the high number of accounts registered, usage of Healthmail might be considered low. Going forward, there are several strategies that might entice people to register accounts and to use them more often. This may involve expanding Healthmail access to other professions and integrating Healthmail with GP practice software systems.
The study found that most Healthmail account holders who are GPs are positive about Healthmail with the majority (64.7%) thinking that it improves patient care and an even greater number (80.8%) wanting the service to continue.
Healthmail was being used for a variety of purposes. One of the primary uses described was the transfer of patient notes between GPs. Healthmail was also used for clinical queries to consultants and primary care staff. Several respondents relayed that they mainly use Healthmail for referrals to consultants. However, referrals to consultants are the intended use of another electronic messaging service; Healthlink [17].
The fact that 48.5% of GP account holders had sent no Healthmail emails in the previous week may indicate that despite registering for Healthmail that account holders are not using it. Nonetheless, 51.5% of GP account holders stated that they are sending at least one Healthmail email a week. It is unclear what communication method is being used instead of Healthmail for transferring sensitive patient information. Another study involving GPs [18] found that email communication was used by almost all GPs involved in the study. The technology acceptance model describes what effects uptake and use of information technology [19]. Two of the major aspects of the model are perceived usefulness and perceived ease of use. Given that the most suggested improvement for Healthmail is to integrate it with GP practice software systems, this implies that ease of use may play a role in the low usage. A study of Finnish physicians found ease of use played a major role in email usage [18]. Also, since GDPR came into effect in May 2018, usage of Healthmail has greatly increased [2]. This might imply that the perceived usefulness was low due to weak legislation around data protection.
Education and training was highlighted by only 35.9% of respondents as a means of improving Healthmail despite the fact that a review on email communication between physicians specifies that education and training are needed to ensure competent users of a technology [10]. Two other suggestions: engagement with Healthmail by hospitals, and engagement with Healthmail by primary care physicians were highly recommended with 78.3% and 44.9% of respondents respectively suggesting these. Engagement by hospitals and primary care clinicians could be heavily influenced by education and training. Education, training and ongoing support increase the effectiveness of the implementation of a technology [20]. Though this will require a concerted effort as current systems of communication such as phone, letter and fax are long embedded in the Irish system, and an awareness of the security of Healthmail may be lacking. Amongst GPs, promotion, education and training might be targeted at those from an urban area as they were significantly more likely to have sent less Healthmail emails in the previous week when compared with GPs from a rural area.
Amongst respondents, 60.1% said they communicate with GPs using Healthmail. The majority (58.7%) of participants would like to see Healthmail expanded. The most suggested profession to expand Healthmail to was Pharmacy (50%). This has since been implemented in April 2017 and involves discussions between GPs and pharmacists about prescriptions. After that, 41% of respondents wanted the service expanded to nursing homes. However, it is unclear as to whether it would be acceptable Universal Journal of Public Health 6(5): 284-297, 2018 289 to setup Healthmail for nursing home staff.
Furthermore, 40.5% of respondents said they would be happy to communicate with patients using secure email. It is unclear what kind of contact this would involve. With doctors increasingly communicating with patients via email [21,22] and patients wanting more email communication with doctors [23], this implies that secure email communication might be acceptable to some Irish healthcare staff. However, further research is needed as there are legal implications as well as potential concerns amongst GPs regarding workload and payment. In the UK, the use of email to contact patients is not obligatory, however, it is endorsed by the Department of Health [24] and the Royal College of General Practitioners [25].
Regarding limitations, it is likely that a participation bias exists whereby those who use Healthmail more often are more likely to respond to a survey about Healthmail. Also, information about the survey was only available via the internet and email, therefore those who are more technologically engaged are more likely to be aware of the survey. The study reported account holders' stated Healthmail usage and not their actual usage which may have led to a response bias. Use of this proxy measure undermines the validity of the results. The response rate of 19.5% is low which reduces the validity of the results. However, the respondents were distributed relatively evenly across Ireland's nine community health organisations, which improves the generalisability of the findings. As well, the age and gender of responding GPs were representative of the national profile of GPs in Ireland [26]. Notably, similar response rates for GPs have been seen in Ireland and abroad [27,28]. This may be due to the heavy workload related to general practice [29]. Monetary incentives and mixed-mode surveys have been shown to improve response rates amongst physicians [27].

Conclusions
The uptake of information technology in healthcare has been slow elsewhere [15] and the results here are similar. However, in Ireland, Healthmail's perceived utility is high among users and therefore, a secure email service has the potential to become part of mainstream communication between healthcare staff and also between GPs and patients. Education and training are essential to increasing uptake. Privacy is a key concern in the sharing and transfer of patient information [11,12,13], but Healthmail could provide an acceptable solution.