Sendmail and PostX: Simplifying HIPAA Email Compliance Providing healthcare organizations with secure outbound, inbound and internal email October 5, 2005
About Your Hosts Sendmail Complete email security and infrastructure for large enterprises Serves over half of the Fortune 100 Deep strength in policy-driven email security Partnership with PostX to provide secure messaging solutions PostX Only vendor that solves 3 core messaging applications - Compliance - Document Delivery - Customer Interaction No client software required 10 years of leadership in secure messaging Only secure messaging solution endorsed for HIPAA compliance 2 COMPANY CONFIDENTIAL
Featured Speakers John Ore Director of Product Management Sendmail, Inc. Shawn Eldridge Director of Product Strategy PostX Brian Lane Brian Lane VP Technology American Hospital Association 3 COMPANY CONFIDENTIAL
Agenda HIPAA overview AHA endorsement Technical requirements Solution architecture HIPAA email policies Case study 4 COMPANY CONFIDENTIAL
HIPAA Email Overview Healthcare email: unprecedented opportunity Customer convenience, access to information Cost savings vs. postal mail, call centers Faster, more efficient partner communications HIPAA mandate for secure email Protected Health Information (PHI) individually identifiable info Must be protected to ensure privacy and confidentiality when electronically stored, maintained or transmitted Affects providers, payors and clearinghouses engaged in the electronic maintenance or transmission of PHI Roadblocks to adoption Usability Transparency to senders and recipients Automation 5 COMPANY CONFIDENTIAL
What is PHI? Health information includes: Patient s past, present, or future physical or mental health Condition of the patient Healthcare services provided to the patient Payment for these services PHI is subject to HIPAA regulations when combined with individual identifiers, for example: Patient s name Phone/fax numbers Email address Mailing address Social security number Medical record number Photographs Fingerprints Disclosures permitted With patient s permission When required by law 6 COMPANY CONFIDENTIAL
Brian Lane, American Hospital Association AHA overview Why endorse technologies The selection process Why PostX 7 COMPANY CONFIDENTIAL
American Hospital Association (AHA) About the AHA World s largest and most trusted association of hospitals and health systems Founded in 1898 Over 5,700 hospitals, 38,000 physicians, and many other health care organizations Primary focus is on policy, advocacy, and member services About AHA Solutions AHA Solutions is the endorsement arm of AHA Focused on providing answers and solutions for membership to aid with technology Maintains endorsement standards 8 COMPANY CONFIDENTIAL
The Selection Process Endorsement established to provide a standardized secure messaging solution for HIPAA compliance The AHA performed a thorough market assessment of secure messaging vendors, with support from Ernst & Young Assessment criteria included: Product: HIPAA specific capabilities, R&D roadmap, scalability, integration abilities with existing technologies, ease of use Company: Management team, company vision, health care focus and knowledge, financial strength and viability, partnerships Implementation: Services and support capabilities, project management, supported platforms Pricing: Ability to service all sized departments and/or organizations The AHA awarded its endorsement to PostX for their secure messaging solutions. 9 COMPANY CONFIDENTIAL
Key Technical Requirements Policy Enforcement Scan all outbound traffic for PHI, including attachment content Utilize HIPAA lexicon Transparent to end-users Secure Delivery Must provide multiple delivery options (Push and Pull) Support multiple encryption standards (S/MIME, OpenPGP, TLS) No client software for senders or recipients Allow customers/external users to send encrypted mail inbound Integration with Existing Email Infrastructure Leverage existing systems for routing, management, etc Integrate with anti spam, -virus, threat prevention systems System-wide visibility and reporting Multiple deployment options software or appliance 10 COMPANY CONFIDENTIAL
Solution Architecture 11 COMPANY CONFIDENTIAL
Email Policy Requirements HIPAA Policy is More than Keyword Checks Utilize HIPAA lexicon to identify PHI Check for regular expressions (account numbers, social security) Check attachment types and content Query directories for user attributes Quarantine for supervisory review Notify end-users and supervisors of selected actions Report on policy activity Write to log files for audit and forensics HIPAA: One Part of the Larger Policy Framework Coordination with spam and virus scanning Protection of confidential data Appropriate use policies Selective archiving 12 COMPANY CONFIDENTIAL
Case Study Regional healthcare provider 4 hospitals 24 outpatient centers 1,100 physicians Requirements: Comply with HIPAA PHI requirements Support for both message-level and connection-level (TLS) encryption Fast deployment Ease of use for internal and external users Integration with email routing infrastructure 13 COMPANY CONFIDENTIAL
Wrap-up Request more information http://www.sendmail.com/hipaa info@sendmail.com Purchase Healthcare Suite by December 30 for special pricing Call 1-888-594-3150 for details Thank you for attending 14 COMPANY CONFIDENTIAL