encrypted email options?
-
OME is what we use, we have rules setup to encrypt if you put [encrypt] in the subject line.
-
@Pete-S said in encrypted email options?:
@scottalanmiller said in encrypted email options?:
That's secure email. That it's transparent makes it even more powerful. My point has been for years - all standard email is fully secure.
Well, it doesn't prevent your email provider from reading your emails. Google and their ilk will use your emails to profile you and whomever you email. So when your doctor sends an email about your cancer treatment, you are going to start seeing ads about that on every site.
You'll get a much higher degree of security when you have real encrypted email and especially so when the email provider doesn't have your private key to decrypt. But then any web mail solution is out.
OpenPGP for instance requires both a private key and a passphrase to be able to decrypt emails. Works great with native emails clients that support OpenPGP. But I wouldn't want to be the guy supporting that for general end users.
Of course, but that's a choice by the end user to choose a service that they opted into to share that information.
With Zix, for example, they have your key.
PGP/GPG options are definitely way, way more secure. And they use real email to do it. But no one likes them.
-
@scottalanmiller said in encrypted email options?:
@Dashrender said in encrypted email options?:
OME - this works like most other secure email solutions out in the market today (I'm looking at you Zix), email contents are sent to a webportal, an email is sent to the recipient with a link to the webportal, they create a logon to the webport for now and future use of message retrieval.
This is the most common option... when this isn't what you want. You have to understand this is NOT email. So this is the same as "not doing what we were told to do." Now 99% of the time, the job is to treat end users as confused and do what they want, not what they say, but it's also important to know when you are doing that. This is no different, except it is automated, than moving people to DropBox or NextCloud, that's all that it is. It's cloud storage with a web interface, not email.
If your doctors asks you for secure email, the answer is "he's an idiot, just do this." If I ask you for secure email and you give me this, it's insubordination for intentionally avoiding the only requirement.
Exactly - You and I both know they don't want actually secure email - there is to much effort to make that work (see key discussion). They want the automated solution. But you try to explain that to most of them and they simply don't care, they just stop listening. Some might go so far as to say - you know how so and so's works? yeah I want that - which in 99% of cases is OME.
Now all that said - one local hospital system recently switched away from Zix. Their new provider verifies TLS, and if present at an allowable cypher, it just sends the message, otherwise, it portalizes it.
-
@Obsolesce said in encrypted email options?:
@scottalanmiller said in encrypted email options?:
@Obsolesce said in encrypted email options?:
@Dashrender said in encrypted email options?:
@Obsolesce said in encrypted email options?:
@Dashrender said in encrypted email options?:
The use of secure email is primarily with outside persons and companies. No home user (patient) is ever going to setup PKI to get an email from us.
I only listed it because I figured someone would blast me for not listing it. It's a complete non starter in our case. It's also why I specifically mentioned the typically used with gov'ts.
Oh yeah that's a totally different case. You're only real option then if dealing with patients and all that is the one built into O365, that takes you to a portal to decrypt it.
Right - this is what we see 90% of the time. Lately though, one of our hospitals have changed to a different secure email provider - and in this case, they no longer bother with the portal as long as TLS works. This provides the simplest solution for home/patient users.
Scott and I have discussed this, and believe that it fits the requirements of HIPAA as well.Thoughts?
I'm not familiar with that method, so I can't comment on it. I've never received an encrypted email that I didn't have to go to a portal/website link, or via S/MIME.
You likely get it 90% of the time. In Zoho it's just a little "secure" flag that shows up. Normal mail is already secure, but not generally enforced. But secure email is the universal default today.
Are you talking about something else? This "Secure Email" is not what we are referring to. Zoho "secure email" is just that it uses TLS in transit and is encrypted at rest on Zoho servers. This is all transparent and is the case with every major email service.
I think what is being asked here isn't obvious to you, but that the mail itself is encrypted, not just the transport of it. Basically in a way the OME and S/MIME ensures.
You'll need to show exactly where in Zoho you turn on this feature you speak of.
Nope, you'd be mistaken - I'm not asking for truly end user to end user secure email - almost no one ever wants that. They want the HIPAA requirement - that's all. Anything more, especially if it offers even one newton of additional friction to the process, is absolutely not wanted, though if it was friction free ( and I mean zero additional friction) they they would likely be willing to have it tacked on because why not?
-
@VoIP_n00b said in encrypted email options?:
@scottalanmiller said in encrypted email options?:
But secure email is the universal default today.
Yeah - I don't know what this means either.
Secure mail ?? If by Secure mail you mean - emails traveling across the internet between mail servers, and even between servers and mail clients, then sure, the default is TLS and has been for many years - though sadly, many ISPs still have legacy old shit systems that don't support it (though Cox finally pulled their heads out of their asses and now support it - BUT - they have also cut off email as a provided service with ISP access - likely because of low use and expense of managing it... so far they are continuing to support current users of the platform, but I expect that to even die at some point... -
@scottalanmiller said in encrypted email options?:
Are there cases where cloud storage with a web interface is a good idea and better than email for delivering files? Absolutely. Is there ever a time that we should pretend email isn't encrypted normally or that dropbox-style systems are just email? No.
email is secure end to end? what do you consider end to end? and again secured how, against whom? Now, as I already stated - it's likely TLS all the way from the client to the server to the other server to the client.. sure, so it's secure from the prying eyes of the internet, but not from admins on either sending or receiving systems - but I'm pretty sure that's not part of the requirement for HIPAA
Additionally I completely agree with you that there is no reason to lie to people - to "dumb down the technology" to call Zix's solution of a webportal "secure email." The problem is population education - who's job is it to educate normal users? I'm guessing you might say it's their employers - and I'll simply tell you they aren't willing to pay for that.
There's no reason that normal email can't just be used, it's secure. The issue that many places have is that they refuse to require this security and/or to understand IT and so feel, because of marketing, that they have to pay for something that isn't email to fix their "email", which obviously, makes no sense.
I have tried with the "require TLS" option in the past, and was required to turn it off because it prevented the ability for owners to email family who still used an email provider who didn't support TLS. Additionally - as mentioned above, now moving to O365, enabling this gives no feedback for 24 hours of failure with no option to shorten this timeout/failure issue.
-
@scottalanmiller said in encrypted email options?:
With Zix, for example, they have your key.
yep
PGP/GPG options are definitely way, way more secure. And they use real email to do it. But no one likes them.
Right, normal users, a cashier at the grocery store, will likely never setup a GPG key, support it, etc to get medical records via email from their doctor. that's to much work.
But they will create a logon to an EMR portal and a "secure email portal" to access/retrieve messages from their doctors. Of course, generally, they will use the same password they use everywhere else, but that's not my problem.
-
@Dashrender said in encrypted email options?:
@scottalanmiller said in encrypted email options?:
With Zix, for example, they have your key.
yep
PGP/GPG options are definitely way, way more secure. And they use real email to do it. But no one likes them.
Right, normal users, a cashier at the grocery store, will likely never setup a GPG key, support it, etc to get medical records via email from their doctor. that's to much work.
But they will create a logon to an EMR portal and a "secure email portal" to access/retrieve messages from their doctors. Of course, generally, they will use the same password they use everywhere else, but that's not my problem.
I know cases where communication between health care professionals and patients is done through a website that requires 2FA for the patients. It has absolutely nothing to do at all with email except that patients can get email and sms notifications. Patients can view their journals as well. I'm sure it's custom built but maybe there are COTS systems that are made for exactly this.
-
@Pete-S said in encrypted email options?:
@Dashrender said in encrypted email options?:
@scottalanmiller said in encrypted email options?:
With Zix, for example, they have your key.
yep
PGP/GPG options are definitely way, way more secure. And they use real email to do it. But no one likes them.
Right, normal users, a cashier at the grocery store, will likely never setup a GPG key, support it, etc to get medical records via email from their doctor. that's to much work.
But they will create a logon to an EMR portal and a "secure email portal" to access/retrieve messages from their doctors. Of course, generally, they will use the same password they use everywhere else, but that's not my problem.
I know cases where communication between health care professionals and patients is done through a website that requires 2FA for the patients. It has absolutely nothing to do at all with email except that patients can get email and sms notifications. Patients can view their journals as well. I'm sure it's custom built but maybe there are COTS systems that are made for exactly this.
COTS?
-
@Dashrender said in encrypted email options?:
@Pete-S said in encrypted email options?:
@Dashrender said in encrypted email options?:
@scottalanmiller said in encrypted email options?:
With Zix, for example, they have your key.
yep
PGP/GPG options are definitely way, way more secure. And they use real email to do it. But no one likes them.
Right, normal users, a cashier at the grocery store, will likely never setup a GPG key, support it, etc to get medical records via email from their doctor. that's to much work.
But they will create a logon to an EMR portal and a "secure email portal" to access/retrieve messages from their doctors. Of course, generally, they will use the same password they use everywhere else, but that's not my problem.
I know cases where communication between health care professionals and patients is done through a website that requires 2FA for the patients. It has absolutely nothing to do at all with email except that patients can get email and sms notifications. Patients can view their journals as well. I'm sure it's custom built but maybe there are COTS systems that are made for exactly this.
COTS?
"Commercial, Off The Shelf"
-
It's generally used as COTS vs Bespoke.
In between the two are things like SAP where it's premade, but can't be used until customized.
-
I posted this question to my supervisors this morning:
When you hear secure or encrypted email what do you envision? How do you envision that working?
answer 1
Secure or encrypted to me means that the content of the email is protected by a password and is not able to be opened by just anyone. I have several vendors that send me secure mail, so I am used to using it.
answer 2
I think of secure email as a means to send PHI or personal information without worrying that someone who shouldn’t see the information will be able to view it. Encrypted to me means that you need to sign in or have some sort of password to get into the email to view the contents. I may be way off base but….
-
answer 2
I think of secure email as a means to send PHI or personal information without worrying that someone who shouldn’t see the information will be able to view it. Encrypted to me means that you need to sign in or have some sort of password to get into the email to view the contents. I may be way off base but….
Interesting to see that someone considers secure and encrypted two different things.
-
@Dashrender said in encrypted email options?:
I posted this question to my supervisors this morning:
When you hear secure or encrypted email what do you envision? How do you envision that working?
answer 1
Secure or encrypted to me means that the content of the email is protected by a password and is not able to be opened by just anyone. I have several vendors that send me secure mail, so I am used to using it.
answer 2
I think of secure email as a means to send PHI or personal information without worrying that someone who shouldn’t see the information will be able to view it. Encrypted to me means that you need to sign in or have some sort of password to get into the email to view the contents. I may be way off base but….
Why does it matter what your non-IT supervisors think about the definition of encrypted email?
I would say they have a decent grasp of the concept, and who cares if they know the exact definition. It's not their job to know it.
-
I asked a followup question:
Could you be a little more in depth on how you envision it working – for say a patient, make a step by step list if you can.
answer 1
The secure mail would need to be initiated by TUC staff to send an email to patient, stating they have a secure message from TUC. Upon opening the message for the first time, they would be directed to create a password with whatever requirements we set up (number of characters, any special characters, Upper and lower case, etc.) Once password is approved by meeting criteria, the true message can be opened and responded to as needed. Future messages could be sent and opened by using the established password.
-
@IRJ said in encrypted email options?:
@Dashrender said in encrypted email options?:
I posted this question to my supervisors this morning:
When you hear secure or encrypted email what do you envision? How do you envision that working?
answer 1
Secure or encrypted to me means that the content of the email is protected by a password and is not able to be opened by just anyone. I have several vendors that send me secure mail, so I am used to using it.
answer 2
I think of secure email as a means to send PHI or personal information without worrying that someone who shouldn’t see the information will be able to view it. Encrypted to me means that you need to sign in or have some sort of password to get into the email to view the contents. I may be way off base but….
Why does it matter what your non-IT supervisors think about the definition of encrypted email?
I would say they have a decent grasp of the concept, and who cares if they know the exact definition. It's not their job to know it.
Because one of the things this thread is showing is that different people have different expectations.
The first two posts where talking about S/MIME, and while of course this could be the most original classic definition of secure/encrypted email, it's not what I, me - Dashrender - was really leaning towards.
Then Scott posts that real secure/encrypted email is basically nothing more more than TLS based transit encrypted delivery.
Now - none of that might matter at all - really, the only opinion that matters is that of the stakeholders, though frankly, I have no idea who those people are at this point. I could see an argument for me (the IT person) to be the stakeholder, but I could also see my boss, or those asking for it, but I could also see it being the BOD (the ones who will ultimately approve the spend - yeah because we don't have spending permissions on much that doesn't flow through them these days). yep, pretty terrible situation to be in.
-
Also - getting buy-in as I assume you know, it extremely helpful in getting things implemented. And even if we don't go with what they believe to be a product/process, at least I know I have to do education with them first to help sell it to the rest.
-
@Dashrender said in encrypted email options?:
Then Scott posts that real secure/encrypted email is basically nothing more more than TLS based transit encrypted delivery.
I wouldn't worry about Scott's definition of things. OME is well accepted as email encryption, even though Scott will argue that it technically isn't. We could get into the weeds about things technically and start an argument that doesnt matter or we could ask ourselves a few important questions.
1.) Is the data actually encrypted?
2.) Is authentication required to access the data?
3.) Is this an accepted industry standard?
4.) Can I bring my own key to ensure no one else can read the data, if I dont trust Microsoft?
5.) Will it easily integrate with my current solution?The answer to all those is Yes from OME. Why would you setup a more complicated solution just so it can be technically encrypted email? Who gives a shit about the email itself? It is the data you are trying to protect.
No IT department that I have ever seen functions as Scott claims. I have known a few IT people that like to argue about things like this, but in the end they end up wasting time and actually hurting the business. Bringing a more complicated solution in this case solves nothing and only creates issues.
-
@Dashrender said in encrypted email options?:
I posted this question to my supervisors this morning:
When you hear secure or encrypted email what do you envision? How do you envision that working?
answer 1
Secure or encrypted to me means that the content of the email is protected by a password and is not able to be opened by just anyone. I have several vendors that send me secure mail, so I am used to using it.
answer 2
I think of secure email as a means to send PHI or personal information without worrying that someone who shouldn’t see the information will be able to view it. Encrypted to me means that you need to sign in or have some sort of password to get into the email to view the contents. I may be way off base but….
Okay, so now we are back to what I was saying originally. Their goal is to ensure a given email is not able to be read by someone else (an attacker, admin, etc.) who could obtain access to the user's email.
You're back to a separate system controlling access like OME. If this is between the health place and patients, S/MIME is out of the question.
That said, I do remember you mentioning that doesn't matter because in the end they want to do the absolute minimum to obtain compliance, which may be nothing. That I don't know.
-
Believe me - I'm not in the weeds over Scott's post.
But it's likely that my only requirement is HIPAA, not encryption of data at rest, especially on the patient side, etc.
HIPAA doesn't require encryption at rest, even though I have it on my side with O365.
HIPAA doesn't require encryption at rest on the client side - it makes no mention of it.You mention authentication to access - does having access to their own email account count? I think it does, so I believe this is checked off.
Is TLS delivery an industry accepted standard - yes, check
Can I bring my own key - not a HIPAA requirement
Will it integrate into my current solution - well, TLS only itself will integrate seamlessly, but domains that don't support it won't fail for 24 hours, leading to complaints of delivery failure and extreme time for notice.Now I completely agree with your that OME is likely the solution we will employ, if for no other reason that it's what the novice world has come to know as secure/encrypted email.
Actually, one of the things I considering, is - Will management accept the 24 hour delay in notice on failed TLS connections AND do they consider TLS enough to sign off on the HIPAA requirement for secure/encrypted email?
In the past they rescinded the sign off because their family used accounts that didn't support it. Cox has finally moved to a solution that does support it, so that hurdle is removed.
