Resource
The 12 questions an auditor asks about email.
Use this as your practice’s email section in the risk analysis. Each question has the answer you should be able to give — and what to do if you can’t.
- Do you have a signed BAA with your email provider? Google and Microsoft sign one on specific plans; free accounts have none. Keep the signed copy in your file.
- Is email encrypted in transit, always? “Usually” isn’t an answer. You need enforcement and a fallback for recipients who can’t negotiate TLS.
- What happens when someone emails PHI to the wrong place? Detection and a policy that encrypts, warns or blocks — and a log showing it happened.
- Can you produce every message to and from a given patient? Archive with search, independent of individual mailboxes.
- Who has access to mailboxes, and how is it controlled? Named accounts, multi-factor authentication, prompt offboarding, no shared logins.
- What is on staff phones, and what if one is lost? Device PIN and encryption policy, remote wipe, and a device inventory.
- How long do you keep email, and can you prove it wasn’t altered? Written retention policy; immutable storage for the retention period.
- Can you place a legal hold? Freezing a person or date range without relying on staff not to delete.
- Where is the data, and who can see it? Region, encryption at rest, who at the vendor can access content, and whether any of them are offshore.
- Did you train staff, and when? Annual training with records; phishing awareness.
- What is your breach process for email? Who decides, the four-factor assessment, the 60-day clock, and how you’d list affected people.
- Is your domain authenticated? SPF, DKIM and DMARC published, so your practice cannot be impersonated in phishing against patients.
Answer all 12 with PXCMail Check question 12 now
A printable PDF version with space for your answers is produced at launch.