" email security Archives - Page 2 of 7 - LuxSci

Posts Tagged ‘email security’

Understanding the HIPAA Requirements for Email Encryption

Tuesday, November 28th, 2023

If you are in the healthcare field, you may have wondered what HIPAA’s exact requirements are regarding email encryption. Understandably, not many people are willing to read the 115 pages of the simplified regulation text, so the question often goes unanswered.

The good news is that we have parsed them for you. We’ve trawled through the long and arduous document to identify the HIPAA regulations concerning email encryption. We also conducted some analysis to help you figure out just how your organization can comply with these requirements.

person composing email

What Does HIPAA Say About Email Encryption?

There are a few different segments of the HIPAA Security Rule that apply to email encryption. The first one we will discuss is section 164.306 Security Standards.

Security Standards for HIPAA Email Encryption

The general requirements state that covered entities and business associates must do the following:

  1. Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.
  2. Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.
  3. Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part.
  4. Ensure compliance with this subpart by its workforce.

Let’s unpack some of these terms to understand how they apply to your obligations under HIPAA.

  • Covered entity – As a simplification, a covered entity is any healthcare-related organization dealing with protected health data.
  • Business associate – A business associate (BA) is a person or organization with which a covered entity shares electronic protected health information (ePHI). This relationship is governed by a business associates agreement (BAA).
  • Electronic protected health information (ePHI) – This is basically any digital information that is both “individually identifying” and contains “protected health information.” Individually identifying information includes names, contact details, social security numbers, and more. Protected health information relates to a patient’s health, treatments, or payments. Check out our article on ePHI for the specifics.

To summarize: Under the Security Rule, healthcare organizations and those dealing with their protected health information are obligated to protect that data. Encryption is just one way that data can be protected when stored or transmitted electronically, like through an email account.

HIPAA Technical Safeguards and Email Encryption

The next place to find information about email encryption is in section 164.312 Technical Safeguards. The rule states:

“Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health information.”

Notice how it says “addressable”? HIPAA has two different specifications regarding implementation, “required” and “addressable.” Required means that a particular mechanism must be in place for compliance.

On the other hand, addressable means that there is flexibility in the mechanisms that can be used. HIPAA is intentionally vague and technologically agnostic on purpose. This gives organizations the flexibility to develop the best security measures for their unique situation. It is not an excuse to be lax about security. Some addressable standards may not apply to an organization because of the structure or technologies used. Whether or not you need to meet the standard is a question for your legal and compliance teams. 

Does HIPAA Require Encryption and Decryption?

At this stage, you may assume that since encryption is an addressable standard, it’s optional, and you do not have to utilize it. This assumption is almost correct– nowhere in the HIPAA documentation does it specify that encryption and decryption must be used.

But unfortunately, things aren’t that simple. Let’s return to the Security Standards of section 164.306, where it states that covered entities and business associates must:

“Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.”

This time, we’ve put different terms in bold. So, while HIPAA does not state that covered entities have to use encryption, it does say that they need to ensure the confidentiality of any ePHI that is created, received, maintained, or transmitted.

The big question is, “If you aren’t going to use encryption, what techniques will you use to guarantee confidentiality instead?” Will you put all electronic data on flash drives and lock them in metal boxes for storage and transit?

The text doesn’t say that you have to use encryption. Still, given the other requirements in the HIPAA documentation, encryption is the only reasonable solution if you want to communicate electronically about patients and their health conditions.

Is Email Encryption Required for HIPAA?

As stated above, HIPAA does not require the use of email encryption. However, if you plan to communicate PHI via email, you must take steps to secure that data. Without other suitable technologies, encryption is the easiest way to protect patient data in emails. 

So what can you do? The HIPAA text doesn’t include specific encryption requirements, so the documentation isn’t particularly helpful for organizations looking for ways to be compliant and secure. Thankfully, the National Institute of Standards and Technology (NIST), another government agency, has released its own guidelines for email and how to keep it secure.

The guide is extensive, but some of the key takeaways are:

  • Appropriate authentication and access control measures need to be in place.
  • TLS should be used to connect to the email server.
  • Mechanisms such as PGP or S/MIME should be used to encrypt sensitive data (such as ePHI).

If you don’t feel like reading such an exhausting document, you can turn to a HIPAA compliance specialist like LuxSci instead. Our HIPAA-Compliant Email includes email encryption as well as other features to help your organization stay both secure and compliant.

Tags: email encryption, email security, HIPAA email encryption, hipaa email requirements, HIPAA requirements, how to secure email
Posted in Email, LuxSci Library: HIPAA
No comments »

What is a Secure Email Gateway?

Tuesday, October 24th, 2023

As threats to email security are increasing, organizations are looking for ways to enhance their security and reduce risk. One option is a secure email gateway. In this article, we review what secure email gateways are and how they can be used to secure sensitive data as it flows into and out of your accounts.

secure email sending button on keyboard

Protect Your Accounts With A Secure Email Gateway

Secure email gateways are an excellent way to strengthen the security of your email accounts without a costly switch to a new email provider. They layer on top of your existing email accounts to encrypt messages, scan for threats, and even capture messages for archival or backup purposes. They can also hide the sender’s IP address because messages are routed through another email infrastructure before delivery to the recipient. If you are concerned about increasing risks to sensitive data, secure email gateways offer a simple and effective way to enhance your email security.

How Do Secure Email Gateways Work?

When using a secure email gateway, your messages are routed to a separate server before being sent or received. When sending an outbound message with LuxSci’s Secure Connector, it is routed through our SecureLine encryption before being securely delivered to the recipient. A copy of the message may also be sent to an independent email archive to help meet compliance requirements for message retention.

 

LuxSci Secure Connector

 

For incoming messages, the gateway can employ email filtering technology to quarantine suspicious messages. These technologies can scan incoming messages and prevent spammers and scammers from reaching employee inboxes and wreaking havoc. Just like with outbound email sending, the gateway can also capture a copy of inbound messages and retain them in an independent message archive.

The exact features of a secure email gateway will vary from vendor to vendor, but these represent some of the core functions that these tools provide. Simply put, a secure email gateway protects both incoming and outgoing messages to ensure that sensitive data is guarded from threats.

Why Choose a Secure Gateway?

There are two main reasons to implement a secure email gateway: the security and compliance benefits and their ease of use. Let’s look at each.

Compliance and Security Benefits

Many companies, like healthcare organizations, must comply with regulations for protecting patient or customer data. Many organizations grapple with the best way to secure potentially sensitive communications without interfering with or slowing down critical business workflows. Because secure email gateways layer on top of existing email accounts, they offer a speedy way to bring your organization into compliance with data security and retention guidelines.

As email continues to be an important channel for essential business communications, all organizations can benefit from protecting their employee accounts and reducing their risk and liability.

Easy to Administer and Use

Another benefit of using a secure email gateway is that your organization does not need to switch your primary email provider to enhance its security. Changing to a more secure email provider can be extremely challenging, especially if you have a lot of users with a lot of data that needs to be migrated to a new system. Add on the training time, and some organizations will find that switching email providers is a significant burden on the organization.

Installing a secure email gateway is very easy for account administrators and often does not require additional training or implementation for email users. Employees can continue to use their regular Microsoft or Google email accounts and do not need to take additional steps to learn an entirely new email program. With 73% of breaches in the healthcare industry caused by human factors, implementing tools that don’t rely on employee decision-making is essential.

Learn More About LuxSci’s Secure Connector

LuxSci’s Secure Connector is unlike other secure email gateways in that it encrypts every email automatically to reduce the risk of breaches caused by human errors. LuxSci provides the flexibility to opt-in to more secure methods of encryption for highly sensitive messages. Email filtering and archival tools are also available to reduce risk and improve resilience in the case of a cyber incident. Contact our sales team to learn more about our email security tools.

Tags: email archival, email encryption, email filtering, email security, hipaa compliance, secure connector, secure email gateway
Posted in Email, LuxSci Library: Email Programs and Devices
Comments Off on What is a Secure Email Gateway?

AI Threats to Email Security

Tuesday, October 17th, 2023

Artificial intelligence is a buzzy topic in the tech industry right now. Many experts are looking to AI to help solve some of the complex challenges of our times. However, besides this technology’s helpful and practical applications, there are some concerns that AI can be used for malicious purposes. In this article, we review some of the top threats to email security posed by AI and what you can do to prevent them.

person using ai tool

AI Threats to Email Security

In general, the biggest threat artificial intelligence poses to email is the ability to easily scale and increase the effectiveness of existing threats. The power of AI can be used to craft more effective phishing and business email compromise attacks and potentially cost businesses billions of dollars. Let’s review how artificial intelligence can increase the success of these types of cyberattacks.

AI and Phishing Attacks

In today’s world, phishing emails are often easy to identify. They are typically launched by criminals outside of the United States and use poor grammar, contain misspellings, or are poorly formatted in other ways. As a result, they are straightforward for the average email user to avoid. Artificial intelligence can help correct some of these common errors and make it easier for cybercriminals to create more convincing emails. As a result, we could see more phishing attacks succeed, wreaking havoc on our online security.

Let’s look at an example. Say a hacker from Russia wants to launch a ransomware attack on an American hospital. To do so, they need an email recipient to click on a link in the email that will install malware on their computer, enabling the hacker to gain access to restricted systems. The hacker does not speak English but has been able to launch attacks on other systems using an email drafted to resemble a password reset. Previously, he may have taken this email, ran it through an online translator, and then hit send on the email, unaware of any typos or strange translations that made it into the text. With AI, he can craft a much stronger email that will fool a busy hospital administrator into clicking on the link.

Some AI text generators have taken steps to prevent people from entering prompts that directly ask for prewritten phishing emails. However, artificial intelligence makes it incredibly easy to translate text from other languages in a grammatically correct manner. Scammers can create unique messages at scale that are more likely to fool email recipients.

AI and Business Email Compromise

Business email compromise attacks are one of the most effective email security threats. Still, because of the time and research they take to deploy, they don’t garner as much attention as phishing and ransomware. Artificial intelligence can help speed up essential research about a target to craft business email compromise attacks.

Let’s take another example. Say an individual wants to steal from a major corporation. The attacker decides to impersonate a company vendor and fool them into routing payments to the attacker instead of the legitimate contact. Artificial intelligence can reduce the time it takes to identify potential targets and possible attack vectors. Cybercriminals can use AI prompts to identify profitable companies, locate lists of vendors, and even research individuals in the roles that are likely to interact with the target.

AI can also use prompts like “generate an email asking for payment on a business invoice” to create legitimate seeming business emails. Using these technologies lowers the barriers to executing a successful business email compromise attack, meaning that more cybercriminals will likely attempt them more frequently.

How to Prevent AI Email Attacks

The good news is that the introduction of AI technology has not changed how we fend off these attacks. The first place to start is with policy and training. Business email compromise thefts are easily thwarted by having policies and procedures in place to prevent unusual cash transfers to unauthorized individuals. Ensuring your staff knows the types of threats and raising awareness of the risks can help protect your business.

Secondly, you can implement email filtering technology to help protect your inboxes from emails sent from suspicious sources. Although scammers can craft persuasive messages, they can’t hide their origin. Organizations can use email filtering software to quarantine or stop suspicious messages from reaching employee inboxes. This technology can prevent email domains without SPF or DKIM records from passing through your inboxes, alleviating a common spam tactic.

Conclusion

The threats to email security posed by artificial intelligence are quite serious. Nevertheless, organizations can take steps to protect themselves by implementing the proper defenses. Contact LuxSci today to learn more about our advanced email filtering solutions.

Tags: ai, artificial intelligence, bec, business email compromise, cybercrime, cybersecurity, email filtering, email security, phishing
Posted in LuxSci Library: Security and Privacy
Comments Off on AI Threats to Email Security

How to Secure SMTP Email Delivery with TLS

Tuesday, August 29th, 2023

Secure email sending is a priority for organizations that communicate sensitive data externally. One of the most common ways to send secure emails is with SMTP TLS. TLS stands for Transport Layer Security and is the successor of SSL (Secure Socket Layer). TLS is one of the standard ways that computers on the internet transmit information over an encrypted channel. In general, when one computer connects to another computer and uses TLS, the following happens:

  1. Computer A connects to Computer B (no security)
  2. Computer B says “Hello” (no security)
  3. Computer A says, “Let’s talk securely over TLS” (no security)
  4. Computers A and B agree on how to do this (secure)
  5. The rest of the conversation is encrypted (secure)

In particular:

  • The conversation is encrypted
  • Computer A can verify the identity of Computer B (by examining its SSL certificate, which is required for this dialog)
  • The conversation cannot be eavesdropped upon (without Computer A knowing)
  • A third party cannot modify the conversation
  • Third parties cannot inject other information into the conversation.

TLS and SSL help make the internet a more secure place. One popular way to use TLS is to secure SMTP to protect the transmission of email messages between servers.

hands on a keyboard sending secure email

Read the rest of this post »

Tags: AES256, email encryption, email security, opportunistic TLS, secure, secure email, smtp, smtp tls, ssl, ssl certificate, starttls, tls
Posted in AAA Featured Articles, LuxSci Library: HIPAA, LuxSci Library: Security and Privacy, Popular Posts
15 Comments »

HIPAA Email Rules: 8 Requirements for Secure Email

Tuesday, August 1st, 2023

The Health Insurance Portability and Accountability Act (HIPAA) is a complicated law that sets the standards for collecting, transmitting, and storing protected health information (PHI). When information is stored or exchanged electronically, the HIPAA Security and Privacy Rules require covered entities to safeguard its integrity and confidentiality. One of the most common ways that PHI is shared electronically is via email. Understanding how HIPAA rules apply to email is essential to meet HIPAA requirements and protect sensitive data.

hands on keyboard checking off tasks

The HIPAA Email Security Rule

It’s important to note that HIPAA does not require the use of any specific technology or vendor to meet its requirements. Generally speaking, the Security Rule requirements for email fall into four categories:

  1. Organizational requirements state the specific functions a covered entity must perform, including implementing policies and procedures and obligations concerning business associate contracts.
  2. Administrative requirements relate to employee training, professional development, and management of PHI.
  3. Physical safeguards encompass the security of computer systems, servers, and networks, access to the facility and workstations, data backup and storage, and the destruction of obsolete data.
  4. Technical safeguards ensure the security of email data transmitted over an open electronic network and the storage of that data.

Below, we discuss some of the main requirements that apply to email and the steps you need to take to secure email accounts that transmit and store PHI.

HIPAA Email Rules-Compliant Email Checklist

While email encryption gets most of the spotlight during discussions on email security, HIPAA regulations for email cover a range of behaviors, controls, and services that work together to address eight key areas.

1. Access: Access controls help safeguard access to your email accounts and messages. Implementing access controls is essential to keep out unauthorized users and secure your data. Some key steps to take include:

  • Using strong passwords that cannot be easily guessed or memorized.
  • Creating different passwords for different sites and applications.
  • Using two-factor authentication.
  • Securing connections to your email service provider using TLS and a VPN.
  • Blocking unencrypted connections.
  • Being prepared with software that remotely wipes sensitive email off your mobile device when it is stolen or misplaced.
  • Logging off from your system when it is not in use and when employees are away from workstations.
  • Emphasizing opt-out email encryption to minimize breaches resulting from human error.

2. Encryption: Email is inherently insecure and at risk of being read, stolen, eavesdropped on, modified, and forged (repudiated). Covered entities should go beyond the technical safeguards of the HIPAA Security Rule and take steps beyond what is required to futureproof their communications. Some email encryption features to adopt include the following:

  • The ability to send secure messages to anyone with any email address.
  • The ability to receive secure messages from anyone.
  • Implementing measures to prevent the insecure transmission of sensitive data via email.
  • Exploring message retraction features to retrieve email messages sent to the wrong address.
  • Avoiding opt-in encryption to satisfy HIPAA Omnibus Rule.

3. Backups and Archival: HIPAA email rules require copies of messages containing PHI to be retained for at least six years. To address these requirements, organizations must consider the following:

  • How are email folders backed up?
  • Are there at least two different backups at two different geographical locations? The processes updating these backups should be independent of each other as a measure against backup system failures.
  • Have you maintained separate, permanent, and searchable archives? While the emails should be tamper-proof, with no way to delete or edit them, they should be easily retrievable to facilitate discovery, comply with audit requests, and support business-critical scenarios.

4. Defense: Cyber threats against healthcare organizations are continually increasing. Some may be surprised to learn that HIPAA secure email requirements mandate that organizations take steps to defend against possible attackers. To defend against malicious messages, consider implementing the following technologies:

  • Server-side inbound email malware and anti-virus scanning to detect phishing and malicious links
  • Showing the sender’s email address by default on received messages
  • Email filtering software to detect fraudulent messages and ensure it uses SPF, DKIM, and DMARC information to classify messages
  • Scanning outbound email
  • Scanning workstations for malware and virus
  • Using plain text previews of your messages

5. Authorization: A crucial aspect of HIPAA secure email requirements is ensuring that bad actors cannot impersonate your company or employees. Configuring your domains with SPF and DKIM is essential to verify your identity as an authorized sender of mail from your domains. Also, ensure that users cannot send messages through your email servers without authentication and encryption.

6. Reporting: Setting accountability standards for email security is essential to establishing and improving your HIPAA compliance posture. Some important steps to take include:

  • Creating login audit trails.
  • Receiving login failure and success alerts.
  • Auto-blocking known attackers.
  • Maintaining a log of all sent messages.

7. Reviews and Policies: Humans are the greatest vulnerability to any security and compliance plan. Create policies and procedures that focus on plugging vulnerabilities and preventing human errors. Some ways to reduce risk include:

  • Inviting independent third parties to review your email policies and user settings. Fresh, unbiased eyes can weed out issues quickly.
  • Disallowing the use of public Wi-Fi for devices that connect to your sensitive email.
  • Creating email policies prohibiting users from clicking on links or opening attachments that are not expected or requested.

8. Vendor Management: Most people do not manage their email in-house. Properly vetting and researching whoever will be responsible for your email services is essential. Perform a yearly review of your email security and stay on top of emerging cybersecurity threats to take proactive action when necessary for sustained HIPAA compliance.

LuxSci’s secure email solutions were designed to help organizations tackle complicated HIPAA email rules. Contact us today to learn more how we can help you secure sensitive data.

Tags: email security, email security in the cloud, hipaa, hipaa security, hipaa-compliant email
Posted in Email, LuxSci Library: HIPAA
No comments »

« Older Entries
Newer Entries »