This policy sets out how Hunrosa staff and consultants must use video conferencing platforms when working with colleagues and patients. It is designed to ensure compliance with NHS guidance, GDPR, and internal data governance standards.

The Policy applies to all Hunrosa staff, consultants, and contractors who use Zoom or NHS Teams for work-related meetings and patient consultations.

1. Use of Hunrosa Zoom Accounts

Hunrosa Zoom accounts are provided for internal meetings, training, and administration.

Cloud recordings must be set to store in the EU and will be auto-deleted after 30 days.

Local recordings on personal devices are not permitted.

Access must be through NHSmail login with multi-factor authentication enabled.

Sharing recordings or meeting links outside Hunrosa is prohibited unless authorised by the Information Governance (IG) lead.

Personal Zoom accounts must not be used for Hunrosa business.

2. Consultant Use of NHS Teams

All patient consultations must be carried out using NHS Teams on an NHSmail account.

Other platforms such as Zoom, WhatsApp, or FaceTime must not be used for patient communication.

Consultants who do not have an NHSmail account must request one before engaging in patient consultations.

Personal email addresses and personal accounts are not permitted.

3. Exceptional Use of Zoom for Patient Consultations

Where NHS Teams cannot be used (for example, where a patient cannot access Teams):

The consultation must take place on a Hunrosa organisational Zoom account, never a personal account.

A waiting room and passcode must be enabled for all meetings.

End-to-end encryption must be used if available.

Cloud recordings are not permitted. If a recording is required, it must be pre-approved by the IG lead and transferred into approved NHSmail/SharePoint storage immediately.

Any exceptional use must be logged with the IG lead, noting the date, patient initials, reason, and any resulting data storage details.

The Zoom meeting and any associated data must be deleted immediately after use unless securely transferred.

Responsibilities

1. The IG lead will oversee compliance and provide advice.

2. All staff and consultants are responsible for following this policy.

3. Breaches may result in disciplinary action and will be reported as data incidents if necessary.

Compliance Checklist

1. NHS Teams used for all patient consultations.

2. Zoom only used for internal meetings unless an exception is approved.

3. No personal Zoom accounts used for work.

4. Recordings only kept in EU storage, deleted within 30 days.

5. MFA enabled on all Zoom accounts.