The Background

The Challenge

The hospital has a robust in-house email system and a complete email compliance policy in place to shield against internal data leakage. With the alliance with specialists, the hospital found it necessary to address the following data security issues:

• Exposure to man-in-the-middle attacks: As affiliated doctors are not employees of the hospitals, they are not included in the hospital’s internal email system. Yet, there are needs to share confidential medical data with these doctors via emails. These outbound emails containing highly confidential medical data could be exposed to man-in-the-middle attacks during electronic transmission via Internet.
• Diverse security settings: The affiliated doctors received emails containing confidential medical data via various email clients and platforms with diverse security settings. Exposure of its confidential medical data to these unknown email systems brought about rising security concerns.
• User authentication: The medical record containing in outbound emails should only be read by the responsible specialist. It was necessary to authenticate the identity of the user who opened and read the emails.
• Prevent data transmission to third party: Illegitimate copying and forwarding of the emails should be prohibited.

The Needs

The client looked for a solution that could:

• Protect outbound emails that contain confidential medical data without compromising efficiency
• Ensure content integrity of medical records
• Shield against man-in-the-middle attacks
• Prevent leakage of confidential medical data by keeping the medical data within its own trusted and safe server
• Authenticate the users who open and read the emails
• Prevent copying and forwarding of confidential medical data to third parties

The Solution

In view of their needs, we implemented a solution for the client making use of TrustSafe® Email Compliance Manager.

The solution has enabled the client to:

✓ Implement auto signing of emails to authenticate outbound emails.

✓ Deploy Mail Guard Plus to ensure that:

• Confidential outbound email is sent as a hyperlink, while retaining the original email content including attachment in senders’ own secure mail server
• Recipient has to click on the hyperlink and goes to sender's email server to read the email
• Recipient can only read the email content by input the (one-time) password he / she received in another separate email
• The email content is set as "Read Only" and cannot be copied / forwarded
• Malicious or accidental disclosure of email content through copying or forwarded is prevented

✓ Keep records of recipients' email access.

✓ Keep good track of the flow of confidential data for auditing.