Securing E-Mail
Total Page:16
File Type:pdf, Size:1020Kb
Securing E-Mail Contents Chapter 1 – Introduction and Overview Chapter 2 – E-mail Programs Chapter 3 - What is PGP? Chapter 4 - Set Up Your Gmail Mailbox For IMAP Chapter 5 - Set Up the Mozilla Thunderbird E-mail Client On Your Computer Chapter 6 - Install and Configure PGP with Thunderbird Chapter 7 – Add Public PGP Keys to Thunderbird Chapter 8 – Backup All Your Keys Chapter 9 – Thunderbird and PGP Conclusion Chapter 10 – Confirm it Works Chapter 11 – Setting Up PGP On Another Computer With Thunderbird Chapter 12 – Frequently Asked Questions (FAQ) Chapter 1 – Introduction and Overview If you are in the medical profession then you’re already familiar with Health Insurance Portability and Accountability Act, otherwise referred to as HIPAA. Basically, it has nothing to do with Heath or Insurance. The primary purpose of HIPAA is the protection of personal sensitive medical information that is stored, transferred or transmitted over electronic devices and pathways. Of course, this also includes patient medical information sent via e-mail. Data encryption is one of the most common and effective ways to prevent serious information breaches, such as unauthorized access to PHI. Encryption is such a powerful security measure that breaches of encrypted health information are not considered reportable security incidents unless the encryption key has also been taken. Granted, e-mail encryption is not mandated under HIPAA regulations. However, if a company does not utilize encryption as a security measure, then it must implement an equivalent method for the transfer of sensitive patient information from one entity to another. Presently, many medical professionals utilize 3rd party websites that allowed for controlled protected access to patient information that is uploaded to the third-party server. The uploaded data may or may not be encrypted. Most don’t encrypt the data, but instead allow for controlled access to the data. This leaves the patient’s medical information on a third-party computer that is vulnerable to illegal and unauthorized access by hackers, as well as malicious software that may be on that computer. One method is where the providing MD creates a password protected account on the third-party server, uploads the patient data and then sends a separate notification either themselves or through the third- party server to the intended recipient. That notification contains access instructions for the intended recipient on how to access the uploaded patient data. Generally, this access will expire after a set period of time from say, one hour to 1 or more days. This is all fine and dandy. But the “how to access” instructions sent to the recipient are themselves vulnerable to unauthorized third-party access. There’s also the possibility of those access instructions being inadvertently sent to an unintended recipient. This would be a direct violation of the HIPAA requirements. There needs to be a better way. Well there is. Not only is this better way significantly more secure, it’s also more user friendly for both the sender and the recipient. Sending information via email has always been the most effective and efficient way of sharing data. But e-mail itself has never been a secure way of sending or receiving sensitive information – be it in the form of a text message or as an attachment to an e-mail message. Thanks to recent advances in encryption technology and the integration of this technology into e-mail, it’s now possible to use e-mail for sending and receiving sensitive information that is so user friendly, it’s practically seamless and unseen by either the sender or the intended recipient. Email encryption can be automatic on the sender’s end the instant they click the send button, as well as automatic decryption on the recipient’s end as soon as they open the received e-mail. Additionally, the e-mail remains in its encrypted form for as long as it resides on your e-mail server, as well as on your computer. The decrypted message and its associated attachments if any, are decrypted “on the fly”; meaning that the decrypted e-mail only exists on your viewable screen and not on your hard drive or remote mail server unless you take action to save it there in an unencrypted form. For some e-mail programs the initial setup for automatic encryption and decryption can be a bear. However, once it’s all set up and fine-tuned, you’re basically done. That’s what this document is intended to help you do – set it up and fine-tune it for your specific needs. Chapter 2 – E-mail Programs Many folks are using their web browser to access their email. Could be Internet Explorer, Microsoft Edge, Chrome or even Firefox. There are multiple issues with using a web browser to send and receive e- mail, with the major issue being that it’s just flat out not possible to afford any level of protection to sensitive data sent or received via e-mail. Due to the designed and intended functionality of a web browser to be used for multiple things other than just surfing the web, it’s just flat out not possible for a web browser interface to an e-mail account to provide the level of security necessary by HIPAA. The bottom line is, if you want to be HIPAA compliant you flat out have to stop using any web browser to send or receive email that contains sensitive patient information. You really don’t have a choice if you want to be in full compliance with the law. I highly encourage all medical professionals to use a third-party e-mail program that is designed and intended for primary purpose of sending and receiving e-mail. This will give both the sender and recipient better control over the management of e-mail. A third-party e-mail program also allows the implementation of e-mail security protocols that will meet, and more commonly exceed HIPAA requirements. Even the so-called built-in e-mail program included with Windows 10 is basically nothing more than a web browser, as it does use Microsoft Edge. The built-in e-mail of Windows 10 just can’t come anywhere close to meeting HIPAA requirements. Many third-party e-mail programs also include additional functionality you may find useful too. For example, calendar scheduling and to do lists. The two most commonly used e-mail programs are Microsoft Outlook and Mozilla Thunderbird. Both also include the added functionality of calendar scheduling and to do lists. Outlook comes as part of the Microsoft Office 2019 suite and is also included in the online Office 365 suite. Either one you use, the Outlook program gets installed on the local hard drive of your computer, and that’s what you want. Mozilla Thunderbird is another highly popular e-mail program used by many. Not only is this program free, but It too comes with the calendar scheduling as an added function. One can also elect to install many other add-ons that are available free of charge such as to do lists, reminders, and many more. Thunderbird is also considerably easier to set up, use and configure than Outlook is. For both of these programs the added functionality of e-mail encryption is also available. For Outlook, it can be installed and configured as an add-on in such a way that, once installation and configuration is complete it will handle all e-mail and attachments encryption and decryption in the background automatically with no user intervention. Whereas the basic Mozilla Thunderbird program comes by default with e-mail encryption built it. All you have to do is set it up. The most common as well as the most secure e-mail encryption out there is called Pretty Good Privacy, or PGP for short. Best of all it’s absolutely free. Set up of PGP while not intuitive, is somewhat easy with proper guidance. But once you have it set up and configured the way you want, you’re done! It’s all hands off with all the work done automatically in the background. The end user doesn’t notice anything different really. But you do have the piece of mind of knowing that protected patient information sent via e-mail does in fact, meet or exceed the HIPAA requirements for the protection of that information. Chapter 3 - What is PGP? PGP, which stands for Pretty Good Privacy is a software program used to encrypt information on your computer, before it leaves your computer. It also does the opposite and will decrypt encrypted data after it has been downloaded to your computer. PGP consists of two parts. There’s a private key and a public key. The public key is used to encrypt information. That’s the only thing it can do. There is no way possible for a public key to be used for decrypting and reading information that has already been encrypted. The public key is shared with anyone and everyone that you wish to share information with via e-mail. The private key is used to decrypt information which was encrypted with it’s corresponding public key. The private key is never shared with anyone. It remains only in the possession of the person who will be receiving information from others that was encrypted with the public key that corresponds to the private key. For two parties to send encrypted e-mail back and forth, each party must have their own private key which each party will never share with another. Likewise, each party must have the public key that corresponds to the private key of the individual they wish to send sensitive information to.