MDVault

HIPAA Compliant Email Security

1

MDVault for End-to-End Encryption

Making all your email recipients secure & HIPAA Compliant.

A person can send a secure message from a secure email account using SSL/TLS technology. This message is secure provided the recipient’s email account is on the same server or with any other secure server/service like MDofficeMail. However, if the recipient’s email address is hosted by a non-secure server, there is NO guarantee for the secure receipt of your message. As you are aware, the majority of individuals use free accounts with no security at all.

To handle this critical issue that happens so often without notice, that is, to maintain the end-to-end security of emails, MDofficeMail is presenting MDVault, a technological innovation for encrypting email messages and delivering them securely over the internet, with end-to-end security, to any email account whether it is secure or not. In addition, this process doesn’t involve the hassle of installing additional software or certificates.

2

How does MDVault work?

  1. 1While composing a message using the webmail of MDofficeMail, as soon as the recipient’s email address (in the To/CC/BCC field) is typed, MDofficeMail automatically detects whether that email address is a “Safe Recipient” or not.
  2. 2In case of Safe Recipients, the message is sent securely with SSL/TLS encryption.
  3. 3In case of other recipients, the message is locked and held in the MDVault of the MDofficeMail secure server without delivering it to the recipient. Instead, a notification is sent to the recipient informing them that a secure, encrypted message has been received.
  4. 4By clicking the https web-link (key to unlock) within the notification, the recipient can log into the MDVault (MDofficeMail) secure server to decrypt, view the message and download attachments, if any.
3

What are the other security features of MDVault?

Some of the state-of-the-art security features provided by MDVault are:

  • Authentication Request: The sender can authenticate a new recipient. If this option is selected while composing, the recipient not only needs a password to decrypt the message, but also a security code which can be provided only by the sender. The recipient needs to contact the sender to fetch the security code to decrypt and view the message.
  • Force expiration of sent messages: In case incorrect information is emailed by error, the sender can force expire the message. A force-expired message will no longer be available to the recipient.
  • Fixed life of sent message: Messages are automatically deleted from MDVault after 30 days irrespective of whether they have already been viewed by the recipient or not.
  • Downloading and storing: If the recipient wants to save important messages for future reference, they can download and save the message on their computer.
  • Secure reply: The recipient of a secure message can send a secure encrypted reply.
  • Automatic session timeout.
  • Change-Password Reminder: Users are reminded to change their password every 90 days to maintain HIPAA compliance.
4

Do I need to do anything to activate MDVault encryption while composing messages?

NOTHING TO DO
Absolutely nothing. While using Webmail, “Safe Recipients” and “Other Recipients” are automatically segregated. A secure but plain message is sent to a “Safe Recipient”. The MDVault feature is implemented in case of an “Other Recipient” as explained above.
While using MS Outlook / Outlook Express / Windows Mail, you need to type the word encrypt, secure, or “::” anywhere in the subject line while composing the message to send a plain message.
5

Is there a way for my patients to send a secure message to me?

Yes, there are two easy ways:

  • Your patient can browse https://EmailYourDoc.com, compose and send a secure message to you (MDofficeMail user).
  • If your patient has already received a secure message from you, there is an option to send a secure reply by clicking on the “Secure Reply” tab.
6

Attachments and limitations

Are attachments supported by MDVault?
Yes, attachments are encrypted and may be downloaded from the MDVault secure site. The recipient can include an attachment in their replies as well.

Are there any limitations with MDVault?
Message headers, including the subject, are not encrypted and get delivered with the MDVault notification, so be careful not to include sensitive information in the subject. Also, email held by MDVault may be removed after 30–60 days, so we don’t recommend using it as a long-term secure message or file store.

8

Charges and encryption technology

Is there any additional charge for MDVault?
No. All MDofficeMail plans include MDVault encryption by default. You can subscribe to our CryptnSend if you wish to purchase MDVault as a standalone service for your existing email account.

How secure is MDVault, and what encryption technology does it use for HIPAA compliance?
MDVault uses industry-standard AES-256 encryption in CBC mode with MD5 hash. Many federal agencies and financial institutions around the globe use the same class of encryption to protect very sensitive data. AES-256 encryption is so secure that there are no publicly known attacks that will recover anything useful from an AES-256 encrypted file in any remotely reasonable amount of time.