Emails that may contain personally identifiable information, sensitive information, or medical information have been assessed by the UK Government's Communications-Electronics Security Group (CESG) as requiring protection to Business Impact Level 4 (B-IL 4). This was assessed in reference to CESGs guidance on Technical Risk Assessment for the UK Cabinet Office published as HMG IA Standard No 1 (IA1 – Technical Risk Assessment), and defined by the potential distress or embarrassment a breach of the system could cause NHS patients, as given in the Impact Level table on p. 54 of the Standard.