Frontline Services’ Best Practice Guide: Email Privacy and Safety
Many workers use email to communicate information to and about survivors. However, email is not a secure form of communication. In addition to the fact that email is not secure, it’s easy for emails to be forwarded, accidentally sent to the wrong person, or be downloaded onto many devices. There are many ways someone else can gain access to your work emails. For these reasons, it’s important that as a front-line practitioner, you have good email privacy habits, especially if you are emailing survivors or someone else about survivors.
Double check the “To” field
Many email programs auto-fill the “To” field so you don’t have to type out the entire email address. However, if you’re not paying attention, the auto-fill email address could be someone else – not the person you’re intending to email.
In some cases, you might have more than one email address for someone. The email program will auto-suggest the “default” email address, so if you don’t check, it could be going to the wrong email address.
Always double check to make sure it’s going to the right person at the right email address.
Don’t include personally identifying information
The best way to ensure survivors’ privacy when you are emailing about them is to not include information that could identify them. For example, we have received emails that include the survivors full name and very personal details about their abuse when the information and the personal details were not needed to answer the question being asked.
Before sharing personal details about a survivor in email, consider the following questions:
- What information does the person you’re emailing really need?
- Can you get your questions answered without sharing personal details about the survivor? If the person you’re emailing does need to know personal details, only include what they absolutely need to know.
- Do they need to know her name? If they do, do they need to know her full name? Unless they need to contact the survivor, you can use a pseudonym or not use her name at all.
Give them a ring
If you need to share detailed information, it might be best to pick up the phone instead of sending an email. First, decide if the other person really needs to know detailed information about the survivor you’re working with. In some cases, you might be able to get your questions answered without needing to go into details about the survivor’s situation. However, if you need to share personal information, giving the other person a ring and talking with them will be more private than putting it all in writing.
Delete emails that contain very private information
If you receive emails that contain detailed and private information, consider deleting the email after you respond to it. In addition, when replying, consider deleting the private information from the original email or starting a new email message. This way, the continued email thread won’t contain the private information.
We also recommend that agencies have an email retention policy, where emails are regularly deleted after a certain period of time. Otherwise, every email you’ve ever sent to a survivor or about a survivor will stay on your email servers (or the servers of whichever email company you use) forever.
Don’t download work emails to personal devices
If you can, don’t download work emails onto personal devices. For some of us, we tend to be more comfortable with our friends and family having access to our personal devices. If your partner or children have regular access to your personal phone, laptop, or tablets, don’t download work emails – which could contain private survivor information – onto those devices.
Be privacy-focused when emailing with survivors
Many survivors and workers are often worried about the abuser intercepting her emails. Often, workers will address this issue by talking to survivors about her email safety and privacy but not think about their own habits and practices. There are quite a few things you can do to minimise the amount of information someone else may inadvertently see if they get access to your or your clients’ email.
Is it safe for me to email you?
Before you email a survivor, ask her if it’s safe to email her. Even if email is a concern, this doesn’t necessarily mean that you can’t email her at all. Have a discussion with her, and she can tell you what’s safe for her and what isn’t. For example, she may have one email address that is compromised, and would prefer you to use another email address. Or perhaps she knows he has access to one of her devices, and she has a private email address that she only checks from a safer device. Help her develop communication strategies that will work for her.
Delete email threads
Email threads can become a written record of a long conversation between the worker and the survivor. It’s best to delete the email thread when you reply. If the email is intercepted or gets forwarded, it won’t include the conversation history that could reveal intimate details or personal information.
Keep emails specific and avoid unnecessary details
When writing emails to survivors, keep them simple and avoid personal details that the survivor may not want someone else reading about. You can often communicate the same meaning without including information that would be problematic if someone else read it. Compare the following examples.
|“I have found some counsellors who can speak to your daughter about her sexual assault. They have experiences working with young children who’ve been molested by family members and come highly recommended.”|
“I have found some counsellors for your daughter. The counsellors are experienced in the issues that we discussed, and they come highly recommended.”
Develop email policies
To ensure that every staff member practices good email privacy habits, it’s best to develop written policies, so everyone is aware of their obligations. Policies should include guidance or limitations on how survivor information can be shared via email. Many agencies already have policies on how to refer to survivors when there are other people around or in public spaces to protect privacy and safety. Email communication is no different.