How It Works
How HIPAA Email from MDOfficeMail Works
Majority of healthcare providers and patients use free email service or the one provided by the internet or web hosting service provider. Connection to most of these services is standard, unencrypted/unsecured (HTTP) and the servers may not be secure. Meaning any sensitive information like PHI sent using these email services can be intercepted and stolen.
HIPAA doesn’t prohibit using email as a medium for sending/receiving Protected Health Information (PHI) in spite of this potential threat. However, by setting up standards it has ensured that the security of patient information via email-based communication is not compromised.
MDOfficeMail has implemented these standards in their services and is fully compliant with HIPAA policies by following recommended procedures aimed at maintaining the integrity of PHI by restricting unwarranted access.
Maximum penalty per HIPAA violation under the HITECH Act (up from $250,000 before 2010) — fines and criminal penalties can apply to both the institution and the individuals involved. The fact is that, not only the sender, but also the recipient should use a secure service to protect the data sent through email.
Other Outstanding Facilities & Features
Facility to expire already sent message
When an encrypted message consisting of PHI is sent to wrong recipient sender can prevent the recipient from viewing that message by force expiring the message.
Legal Archival
All incoming and outgoing emails are stored in a secure remote server which cannot be edited or deleted. As long as the user is active archived messages can be viewed and downloaded.
Automatic Session
Automatic Session timeout for web browser and MDVault..
Access logs and Audit controls
Access logs can be viewed for each user.
Facility to validate new recipient
New recipient needs to enter a 6-digit code to access email received. This auto-generated code can be provided only by the sender of the message.
"Email Your Doc"
Anyone can initiate secure message to MDOfficeMail user.
Mobile phone access
Our service is HIPAA compliant with most of the smart phones.
BCC Archiving
Domain level BCC archiving can be configured so that all the incoming and outgoing messages of all users can be saved into a specific mail account.
Customization
MDOfficeMail offers very high level of UI customization. Custom logos, banners, and look & feel is possible for domain plans.
Calendar, a great planning tool
Set reminder messages for appointments and work deadlines. Since MDOfficeMail calendar automatically stores information on your email server, you can access your schedule from any computer you use. Optionally share your entire calendar or just particular events with other users.
Emergency Glass Break
Administrator can access the email messages of other users in their group in case of emergency.
Security is strictly enforced
MDOfficeMail can be accessed only with https and ports 995, 993, 465, and 25.
Encryption is enforced by default for all emails that are leaving MDOfficeMail server
Configurable to send plain msgs by default and encrypted msgs manually for domain accounts.
End-to-end protection
Secure access not only at sender's end, but also at recipient's end irrespective of the email service the recipient is using. Learn how...
Secure but plain message are sent to all MDOfficeMail users and "Family & Friends" automatically. MDOfficeMail is capable of detecting other users of MDOfficeMail. Plain messages are sent to these recipient. Email addresses of friends and family can be configured so that plain messages are sent to them.
Facility to send plain messages
Unencrypted emails can be sent just with a single click.
Advanced spam prevention and virus filtering
MDoffice Mail offers advanced features to identify undesirable spam email, block virus infected mail and prevent abuse of your mail server by spammers. These features can be individually configured.
Auto migration
Messages from the Inbox of other email account can be migrated with ease.
Change password reminder
User is prompted to change password after 80th day. As HIPAA compliance recommends to change password every 90 days, users are automatically reminded to change password.
Strict Privacy Policy
MDOfficeMail strongly believes in safe-guarding details of their client. Client information including name, address, and phone number will not be given to any third party. Credit card payments are processed by PayPal and details are securely saved by PayPal and MDOfficeMail doesn't have access to those details.
Security at both ends: SSL & MDVault
MDOfficeMail secures the sender's connection with SSL, then hands off to MDVault so the recipient's end is covered too — using VeriSign's RSA-powered SSL/TLS the whole way.
-
Webmail
SSL establishes an encrypted pipe to MDOfficeMail the moment you connect — well before your username and password are even entered.
-
Outlook & other desktop or mobile clients
MDOfficeMail only accepts secure ports:
995(POP),993(IMAP), and465/25(SMTP), plus AV and spam filtering on every message. Unsecured connections simply aren't allowed. -
Sent to someone outside MDOfficeMail
The message is encrypted automatically, stored securely, and a receipt notification is sent — no manual step required.
-
Sent to another MDOfficeMail user
Delivered directly without the extra MDVault layer, so colleagues aren't stuck decrypting every internal email.
-
MDOfficeMail user
The message just shows up like any other email — no password prompt, no extra decryption step.
-
Everyone else: the notification
The secure message stays in MDVault. The recipient instead gets a short email letting them know a secure message is waiting.
-
Opening it
Clicking the link opens a secure webpage over SSL. First-time recipients create a password (the sender can share a one-time verification code); after that, the same password unlocks every future message.
-
Reading, replying, saving
From that same secure window, the recipient can reply securely or download the message to their computer.
Need to send something with no PHI in it?
Type :: anywhere in the subject line and the message goes out plain — handy for quick, non-clinical notes to recipients outside MDOfficeMail. And if a secure message ever goes to the wrong person, the sender can force-expire it so it can no longer be opened.
Still wondering how it works?
Ready to send HIPAA compliant email?
Get started with MDOfficeMail and give your patients' information the protection it needs.
See Pricing & Signup