DHFS-HIPAA COW Email Security Whitepaper- version 1.3.doc


Published on

  • Be the first to comment

  • Be the first to like this

No Downloads
Total Views
On Slideshare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

DHFS-HIPAA COW Email Security Whitepaper- version 1.3.doc

  1. 1. Disclaimer This “Email Security Whitepaper” is Copyright © 2003 and 2004 by the HIPAA Collaborative of Wisconsin (“HIPAA COW”). It may be freely redistributed in its entirety provided that this copyright notice is not removed. It may not be sold for profit or used in commercial documents without the written permission of the copyright holder. This “Email Security Whitepaper” is provided “as is” without any express or implied warranty. This “Email Security Whitepaper” is for educational purposes only and does not constitute legal advice. If you require legal advice, you should consult with an attorney. HIPAA COW has not yet addressed all state pre-emption issues related to Email Security. DRAFT E-MAIL SECURITY FOR THE HEALTH CARE INDUSTRY: A PROPOSAL FOR COLLABORATION IN WISCONSIN Draft Version 2.1 January 13, 2005 Version 1.0 addressed the need for secure E-mail, defined business requirements, discussed four approaches, and identified sample products. Version 2.0 adds a proposal for a collaborative, standards-based approach to secure E-mail between organizations in Wisconsin. Version 2.1 includes an additional product summary. © Copyright 2002-4 HIPAA COW DRAFT Page 1 of 35
  2. 2. Introduction Within the past ten years, we have experienced a significant change to the way that we communicate. We send electronic messages, referred to as e-mail, to communicate with friends and family and for business purposes. E-mail is an abbreviation for the term electronic mail, a way of transferring information electronically. E-mail users can send messages to others by specifying E-mail addresses. The message will travel from the sender’s computer through an internal computer network or for final delivery via the Internet. Is E-mail Secure? E-mail may be an efficient and cost effective way of transmitting data, but how secure is this method of information distribution? Many e-mail messages contain information that could be regarded as sensitive by either the sender or the receiver. In the case of the health care industry, messages may even include Electronic Protected Health Information (ePHI). ePHI is defined as being individually identifiable information that is maintained in any form by a health plan, clearinghouse, or provider and related to health condition, treatment, or payment. The Health Insurance Portability and Accountability Act (HIPAA) requires health care institutions to comply with information privacy and security standards. Many of these institutions have drafted policies that forbid the transmission of protected health information via e-mail. Other institutions which have local area networks have permitted the transmission of protected health information, but only to other employees on the institution’s local computer network. While neither the HIPAA privacy nor security rule expressly requires it, most security professionals believe secure Internet e-mail is a reasonable step for a health care institution to take in order to abide by the HIPAA requirement to “ensure the integrity and confidentiality” of ePHI. What Risks Exist? The most likely risk is that someone could mistakenly send information to the wrong individual. This risk can be best addressed through properly communicated policies and a thorough training program. Health care institutions have invested time and money on information privacy awareness for employees for good reason. Though a much slighter risk, e-mail sent over the Internet has the possibility of being read by others in addition to the intended recipients, especially at relay points. Some of the inherent risk of unencrypted e-mail is described below. Internet e-mail is sent to relay servers, saved for a period of time on the local drive, then sent to the final server of its intended recipient. Since the messages are sent unencrypted, they are also stored unencrypted on the relay server. Anyone with access to the relay server has the capability of reading the e-mail. © Copyright 2002-4 HIPAA COW DRAFT Page 2 of 35
  3. 3. Some relay servers store copies of the messages even after they have been sent off to the final recipient. Again, anyone with access to the relay server could read the message. If the message is stored on the system, it could remain in storage for months or years before someone actually reads the message. If the messages were encrypted, however, an unauthorized user would not be able to read the messages. Relay servers are also targets of intruders trying to break into other networks. The SMTP service which is used by a majority of mail programs is always listed on the SANS/FBI Top Twenty List as a favorite target of hackers. Intruders breaking into a relay server have the ability to read any messages that are stored on the system. Again, if the messages were encrypted, they could not be read. E-mail traverses the Internet through infrastructure equipment (routers, switches, hubs, etc). Often an e-mail will flow through multiple network devices before reaching its final recipient. Any e-mail that is sent unencrypted may be monitored while in transit. Encrypted messages are not able to be read. E-mail that is unencrypted could be intercepted, read, and altered at the junctures mentioned. Motivated intruders could intercept the message and alter it before it reaches its final destination. They could add or remove items in the message and then alter the original sender’s headers. A person replying to the altered e-mail would actually be replying to the intruder; the original sender would never receive the reply. The result is compromised critical protected health information. As previously mentioned, encrypting the contents of the e-mail could prevent this. What Are The Business Requirements For Secure Internet E-mail? Encryption Secure e-mail basically means e-mail that is encrypted at a sufficiently robust level, usually at least 128 bits. Most e-mail systems can encrypt e-mail in transit and at rest within the given system. Encryption is a mathematical way to scramble (encrypt) and unscramble (decrypt) digital information. Encryption helps ensure confidentiality and privacy of information. Strong encryption (128-bit key length or greater) provides sufficient assurance that e-mail transmitted over the Internet will not be disclosed to unauthorized third parties. Encryption strength is relative and a function of key size and encryption method. The bigger the number the longer it will take to crack the encryption code. For example, a 40-bit key can be cracked in a matter of hours, while a 128-bit key will take approximately 149 trillion years to crack, according to the National Institute of Standards and Technology.1 1 Computer Security Division, National Institute of Standards and Technology, “Advanced Encryption Standard,” URL: http://csrc.nist.gov/CryptoToolkit/aes/aesfact.html (January 28, 2002). © Copyright 2002-4 HIPAA COW DRAFT Page 3 of 35
  4. 4. B2B Focus The focus of this paper is organizations rather than individuals. The primary business use of Internet E-mail today is between organizations; thus the most pressing need is for a business-to- business (B2B) solution. Business-to-consumer (or client) (B2C) use of E-mail is growing but currently less common. There is also greater immediate pressure for secure B2B E-mail because B2C privacy concerns can be at least temporarily addressed by obtaining client authorization for the use of E-mail. The requirements and preferred solutions for these two kinds of use vary. Any solution for secure Internet e-mail should first meet the B2B requirements but not be inconsistent with supporting B2C needs. E-mail System Integration Most organizations have a legacy commitment to their e-mail systems and the messages within them. E-mail systems are not going away anytime soon. The secure Internet e-mail solution should recognize this commitment and work seamlessly with these existing systems. Simplicity of Use The e-mail system integration requirement dovetails with another requirement: use of secure Internet E-mail should be transparent to the user. The effective interoperability of most e-mail systems today has accustomed users to a high ease-of-use standard. Sending, receiving, reading, and storing secure Internet e-mail should be done through the organization’s current e-mail system with minimal complexity and training for the user and little need for desktop support. Enforcement The secure Internet e-mail solution should help ensure that e-mail that should be secure actually is. Rather than rely solely on the user at the desktop to always remember and to make correct decisions about selecting the secure option for individual e-mail, some products can manage encryption based on who the recipient or sender is or based on other business rules. Continued Protection From E-mail-Borne Threats It is nearly impossible to conduct virus checking or content filtering on encrypted e-mail. Some secure e-mail solutions interfere with these key activities. Record Management Most e-mail systems store e-mail on the user’s desktop and/or the organization’s servers. The organization thus controls the retention and disposition of these important records. Not all secure Internet e-mail solutions support this control. Some vendor solutions store sent e-mail on their servers, and sometimes recipients have no control over received e-mail. Also, some solutions encrypt in such a way that organizations cannot access stored e- mail of current or previous employees. Collaboration Among HIPAA security and privacy requirements, secure Internet e-mail is especially challenging because an organization cannot implement it alone. Secure Internet e-mail by its © Copyright 2002-4 HIPAA COW DRAFT Page 4 of 35
  5. 5. nature requires collaboration between sending and receiving parties. Every organization has multiple such parties. Solving secure Internet e-mail requires collaboration among business partners. Regional voluntary organizations formed to help covered entities comply with HIPAA, like the HIPAA Collaborative of Wisconsin (HIPAA COW), are well situated to promote such collaboration. Choice One outcome of collaboration could be agreement for all members to use the same product. This would be one approach to solving a continuing problem of limited interoperability of vendor secure Internet e-mail solutions. A better approach is to encourage purchaser choice via competition among multiple vendors with interoperability based on standards. Whether through the HIPAA security rule or otherwise, the federal government does not appear to be establishing a standard. Voluntary standards through vendor and purchaser collaboration will hopefully provide the needed interoperability. Future Requirements The immediate requirement of secure Internet e-mail for HIPAA compliance is encryption to avoid impermissible disclosure of ePHI. Some vendor solutions for secure Internet e-mail provide capabilities for other requirements to which organizations will need to attend in the future. One is authentication of sender and receiver of secure Internet e-mail. Related functions are digital signatures, proof of receipt, and non-repudiation (eliminating the ability to deny the identified party sent a valid message). Is there a solid technology foundation? Public key cryptography is a well-established technology that uses private and public “keys” to encrypt and decrypt information. For example, if X wants to send Y an encrypted e-mail, X first obtains Y’s public key. X encrypts his or her message with this public key and sends the encrypted e-mail to Y. Y decrypts the e-mail using his or her own private key. X needs to obtain a public key from everyone to whom he or she wants to send an encrypted e-mail. Y has to do the same. After awhile, these keys expire. There has to be a source for valid keys. This technology is sometimes called PKI for Public Key Infrastructure—all the technology and administration involved in distributing and managing valid public keys. This technology works well and is supported by most major e-mail systems today (with some vendor interoperability issues). It also addresses the identification, digital signature and nonrepudiation requirements. Most observers believe PKI will be the long-term solution for secure Internet e-mail. Multipurpose Internet Mail Extensions (MIME) is the standard that allows interoperability between e-mail systems. S/MIME (Secure MIME) is a standard on top of MIME that allows interoperability for secure e-mail using PKI technology. The State of Wisconsin has adopted S/MIME as a draft standard for secure e-mail for its agencies. The main reason S/MIME and PKI have not been widely adopted is the complexity of administering the keys. As implemented in e-mail systems, keys are managed by the individual users at their desktops. Most users find the process confusing. Managing revoked and expiring © Copyright 2002-4 HIPAA COW DRAFT Page 5 of 35
  6. 6. certificates (which contain the keys and support the “trust model” needed to ensure that a public key belongs to whom it says it does) is a significant task for individuals and organizations. What approaches are there? There are four principal approaches to securing Internet e-mail. A. End-to-end (desktop) encryption Desktop-to-Desktop (End-to-End) Client Decrypts Client E-mail encrypts client Internet ... Interior Firewall Exterior Firewall E-mail S/MIME server Exterior Firewall PGP This approach uses S/MIME or other standards such as Pretty Good Privacy (PGP). Each individual user has a digital certificate/key. The e-mail is encrypted at the sending desktop and remains encrypted until it is decrypted at the receiving desktop. Technically this can work well, but it has several disadvantages. • Managing the keys is burdensome. • Keys are no more secure than the desktops through which they are administered. • Because users can store e-mail encrypted with their personal key, management can lose control over these records, finding it extremely difficult if not impossible to decrypt messages deleted by employees or to access e-mail of separated employees. © Copyright 2002-4 HIPAA COW DRAFT Page 6 of 35
  7. 7. • It is nearly impossible to conduct virus or content filtering on encrypted messages. The Wisconsin Department of Health and Family Services (DHFS) is currently piloting S/MIME desktop encryption with a few Medicaid HMOs. It is using GroupWise version 6 desktop clients to encrypt and decrypt e-mail. A few additional HMOs that wanted to pilot could not because their e-mail system versions were too old or did not support S/MIME at all. Due to the small number of users in each organization and the small number of organizations that are involved, the key management burden on users has been acceptable. Once keys are exchanged, sending and receiving secure e-mail is little different from those that are unencrypted. Other communities, including the Commonwealth of Massachusetts and the New Zealand government, have attempted pilots of desktop S/MIME and have abandoned intentions to use the technology for broad-based deployment. Below is a short list of the many commercial products available that implement this approach to secure e-mail:  DespatchBox  CipherPackPro  Encryptek  MailMarshal Secure  Omniva  ShyFile  ZipLip  ZixMail © Copyright 2002-4 HIPAA COW DRAFT Page 7 of 35
  8. 8. B. Gateway-to-gateway (domain or server level) encryption Gateway-to-Gateway E-mail client Encryption/ Internet ... Decryption Interior Firewall Exterior Firewall E-mail Filtering, Secure server anti-virus, Messaging Exterior archiving, Gateway Firewall etc services This approach uses similar technology to desktop encryption but performs the encryption and decryption at a server rather than at a desktop client. Rather than assign each user a digital certificate/key, the keys are assigned at an organizational level. This has several differences from the desktop approach. • There are radically fewer keys to manage. • Users are not burdened with key management. • Messages are encrypted over the Internet between organizations but can be decrypted within the organization. • E-mail is stored on the servers of sending and receiving organizations and remains under their control. • Management retains control over its records. • Virus checking and content filtering are possible. • Applications can use gateways to send or receive messages. • “Trust” is established at the organizational rather than the individual level. © Copyright 2002-4 HIPAA COW DRAFT Page 8 of 35
  9. 9. This approach can work seamlessly with legacy e-mail systems—the user sends, receives, manages e-mail within their e-mail client. Administration is simpler, user burden is reduced, and organizational control over e-mail is retained. A major potential drawback is that identification occurs at the organization level rather than specific to individuals. For most business purposes, however, establishing “trust” at the organizational level should be sufficient. With this approach, business partners trust each other to manage their internal affairs such that specific users within each organization are reliably identified with means other than unique digital certificates (e.g., e- mail addresses). New Zealand’s SEE Mail initiative is a gateway encryption environment deployed in over 40 agencies, and Massachusetts has completed a pilot program that demonstrated the potential of this approach. A number of commercial products employ encryption of e-mail at the server level with some being deployed on an internal server, others on a third-party gateway. A few of these are listed below. ♦ MailX3 ♦ A-Lock ♦ HushMail ♦ IronMail ♦ Tovaris SecureMail Gateway ♦ ZipLip © Copyright 2002-4 HIPAA COW DRAFT Page 9 of 35
  10. 10. C. Secure Web Mail Secure Web Mail 3- send E-mail E-mail with url client 1- send 2- set clue E-mail and Internet ... as usual password Interior Firewall Exterior Firewall E-mail Web Mail server Server Exterior Firewall 5-User Secure Web Mail accesses secure 4-Sender web-site provides clue E-mail and passphrase client Internet ... Interior Firewall Exterior SSL Firewall E-mail Web Mail server Server Exterior Firewall © Copyright 2002-4 HIPAA COW DRAFT Page 10 of 35
  11. 11. In this approach, the sender posts a sensitive message to a secure Web site using an encrypted transmission.2 An unencrypted e-mail that points to an obscure URL is then sent to the recipient. The recipient accesses the sensitive message at the URL using a secured session. The recipient uses an ID and password to access the secure session. The password is provided through a separate contact such as a telephone call or through self-registration by the recipient. This approach has the following advantages and disadvantages: • The recipient only needs a Web browser and Internet access. • Users and organizations do not need to manage keys (beyond those used for session security). • Messages cannot be sent, read, or managed through existing E-mail systems. • The message resides on the provider’s server and  can be removed at any time by the sender.  in many systems cannot be downloaded, stored, or managed by the recipient except by cutting and pasting the text or saving the HTML page. • Users must manage IDs and passwords for each partner with whom they conduct e-mail this way. • Strong user identification, nonrepudiation and proof of receipt may be less rigorously supported. • Cannot perform virus scanning and content security checks due to use of SSL sessions for viewing and downloading. This approach has the noted disadvantages compared to approaches that preserve an integration with existing e-mail systems. On the other hand, its main advantage is that such systems are not needed. This approach is the best alternative for business-to-client (B2C) secure Internet e-mail. Some of its disadvantages are lessened where many of the recipients (such as patients) will conduct secure Internet e-mail with only a few partners (such as doctors). It also works reasonably where one party (e.g., a doctor) conducts secure Internet e-mail with many others (e.g., patients). Where this works less well is where many parties conduct secure Internet e-mail with many other parties. One such solution that utilizes a secure Web site for the retrieval of e-mail is EnsuredMail. D. HTML Attachment Approach 2 Session encryption uses either Secure Socket Layers (SSL) or Transport Layer Security (TLS), both of which use a server level digital certificate. © Copyright 2002-4 HIPAA COW DRAFT Page 11 of 35
  12. 12. In this approach, the message and any attachments to be secured are encrypted and placed in an HTML attachment to an unsecured e-mail. Java code in the attachment requires authentication of the recipient before it allows the attachment to be opened, decrypted, and the secured information read. The unsecured message is received by the recipient through his or her usual e- mail system and can be stored and later managed by the recipient in his or her Inbox. To access the secure information, the recipient opens the attachment which launches his or her browser and activates the Java code. This approach has several significant advantages and a couple serious disadvantages. • The recipient needs no additional software beyond a browser. • The recipient uses his or her existing e-mail system to receive, open, and manage received messages. • The recipient does not need a commercial e-mail system but can use Web services such as Hotmail (so this solution also works relatively well for B2C). • Proof of receipt can be supported in certain vendor products. • Through the Java code, senders can control the message after delivery, restricting access to the sender only or removing access after a predetermined period of time. • Because of the above sender controls, the recipient and his or her organization can lose control over the received message. 4-Java authenticates, HTML Attachment decrypts 2-Sender provides E-mail identifying info client 1-send E- ... Internet mail as usual Exterior Firewall E-mail Appliance server Exterior 3-Appliance encrypts Firewall in HTML attachment and sends as normal E- mail © Copyright 2002-4 HIPAA COW DRAFT Page 12 of 35
  13. 13. • This is primarily a one-way mechanism, and each partner must establish its own method of sending secure e-mail. • This approach is particularly proprietary, with different vendors using different encryption formats and algorithms. • Virus checking and content security checks cannot be performed on these encrypted attachments. What is the Secure Messaging Gateways (SMG) Initiative? The most pressing need, at least for health care organizations, is for a current capacity for secure Internet E-mail between organizations (B2B). If possible, the current solution should be consistent with the longer-term answer and provide a ready migration course to it. The long term secure E-mail answer appears to be based on digital certificates and the S/MIME standard, and will eventually offer individual authentication whether it is desktop based or not. For now, the best approach for inter-organization secure Internet E-mail seems to be the gateway-to-gateway option. The Gartner Group recognizes that “the market is moving toward a preference for server- side approaches”3. Giga “recommends S/MIME solutions with an option of Web-based or HTML-attachment delivery”.4 (Both advisory firms believe desktop S/MIME will be the long term standard). A specific type of gateway-to-gateway secure Internet E-mail holds special promise: Secure Messaging Gateways (SMG). SMG is an emerging protocol for server-to-server encryption using S/MIME. S/MIME provides the protocol and format for such encryption, but SMG provides additional conventions for organization-level certificates instead of individual certificates. At the March 2001 HealthKey Summit in Chicago, five vendors demonstrated the interoperability of their Secure Messaging Gateways. The Massachusetts Health Data Consortium (MHDC) is currently finalizing the SMG protocol and is piloting its production use in Massachusetts, where interoperability remains somewhat an issue. The Open Group (www.opengroup.org) is a voluntary organization that promotes open standards and operates a product certification service for protocols such as UNIX, WAP, and LDAP. The MHDC is currently collaborating with the Open Group to establish a product certification program for the SMG protocol. Their targets are to finish the SMG protocol5 and begin certifying products in the spring of 2004. The Commonwealth of Massachusetts and members of the MHDC are ready to purchase these products once they are identified. Several major vendors are currently involved in this effort.6 3 “Management Update: Tips on How to Implement Secure Messaging”; October 8, 2003. 4 “Secure E-Mail Creates New Model and Minimum Requirement for EBPP”; July 3, 2002. 5 The protocol will consist of a Gateway Message Profile of S/MIME Version 3.1 Message Specification, containing a standards message format, message processing conventions, and simple mechanism for Domain Certificate exchange. 6 Brute Squad Labs, BT Global Services, Syntegra, MailQube, Mitre Corp, Nexor, Novell, PostX, Sigaba, Tovaris, and Tumbleweed. © Copyright 2002-4 HIPAA COW DRAFT Page 13 of 35
  14. 14. How can we achieve secure Internet E-mail in Wisconsin? As noted earlier, secure Internet e-mail is not a challenge individual organizations can solve themselves. Instead, cooperation between business partners is necessary. Collaboration is needed between and among using organizations and vendors. Such collaboration can lead to consumer choice between competing vendor products, with interoperability assured by certification based on standards. The initial interest of this whitepaper was to take the first educational step toward the interchange of secure e-mail (often containing protected health information) between major health care business partners in Wisconsin: • county and municipal agencies. • public and private health care providers. • HMOs. • other public and private payers including Medicaid and Medicare. A limited but growing need to securely transmit e-mail to participants in programs and members of the general public is currently a lesser concern to secure business-to-business e-mail. The second purpose of this whitepaper is to facilitate a consensus approach to secure e-mail between a majority of health care business partners in Wisconsin. A Wisconsin Forum for Collaboration The Workgroup for Electronic Data Interchange (WEDI) was a principal behind the creation of HIPAA. WEDI encourages regional collaboration among entities covered by HIPAA through the Strategic National Implementation Program (SNIP). The nonprofit HIPAA Collaborative of Wisconsin (COW) is a WEDI SNIP affiliate serving private and public parties impacted by HIPAA. HIPAA COW is an ideal forum to establish a consistent approach to secure Internet e-mail in Wisconsin, based on the health care core that must address secure Internet e-mail for HIPAA compliance. An endorsement of the SMG approach by HIPAA COW and voluntary commitment by its participating organizations to acquiring products from SMG certified vendors can provide the necessary foundation for an interoperable solution in Wisconsin. Once organizations acquire certified products, their interoperation could be monitored by HIPAA COW and success heralded through it. A Core of Government Procurement Wisconsin state government agencies are currently consolidating IT resources. The Department of Administration has issued a bid for consolidated E-mail services for 40,000 users and 50 agencies. A mandatory requirement is that the solution must support server to server message encryption using the S/MIME Gateway Profile defined by The Open Group. © Copyright 2002-4 HIPAA COW DRAFT Page 14 of 35
  15. 15. Not only will this consolidation establish a large Wisconsin user base for SMG, but as is common with state contracts, the winning vendor has the option of extending the contract terms to municipalities and other public bodies having authority to award public contracts. The state contract will be a boost to at least one vendor that has obtained SMG certification and will support the national effort by adding another participating state. Disclaimer This “Email Security Whitepaper” is Copyright © 2002 by the HIPAA Collaborative of Wisconsin (“HIPAA COW”). It may be freely redistributed in its entirety provided that this copyright notice is not removed. It may not be sold for profit or used in commercial documents without the written permission of the copyright holder. This “Email Security Whitepaper” is provided “as is” without any express or implied warranty. This “Email Security Whitepaper” is for educational purposes only and does not constitute legal advice. If you require legal advice, you should consult with an attorney. HIPAA COW has not yet addressed all state pre-emption issues related to Email Security. Therefore, this form may need to be modified in order to comply with Wisconsin law. Authors Primary: Ted Ohlswager, Department Health and Family Services Contributing: Michael Pynch, Wipfli Larry Boettger, Inacom Information Systems Richard Bucheger, Department Health and Family Services Ralph Chapman, AEBS Bob Diehl, Department Health and Family Services Hema Vadodaria, MPC Solutions © Copyright 2002-4 HIPAA COW DRAFT Page 15 of 35
  16. 16. Appendix A E-mail Security Product Pricing End-to-end encryption Adhaero http://www.adhaero.com/E-mail_Protection.htm http://www.adhaero.com/WhitePapers/AdhaeroDocTechnicalOverview.pdf Features Encryption software built into Microsoft Office environment as a plug-in. Contents of e-mail encrypted prior to being sent across the Internet. E-mail cannot be copied (copy and paste or screen capture), printed, and can be set to be destroyed on a specific date. Message can be prevented from being read before the selected date. Message can be prevented from being forwarded to third party. • Encryption – 448 bit BLOWFISH algorithm • Secure key generation and management List Price The product costs $350 per user/computer. Volume discounts exist for 25 or more users. © Copyright 2002-4 HIPAA COW DRAFT Page 16 of 35
  17. 17. Gateway-to-gateway encryption A-Lock http://www.pc-encrypt.com/_site/alock/features.mhtml Features Encryption using the widely recognized BLOWFISH algorithm. The unregistered version of A-LOCK is limited to 56-bit encryption. The USA and Canada registered version allows passwords up to 448 bits (56 characters). Works with all e-mail programs. List Price Quantity Price 1 $29.00 2 - 10 $26.10 11 – 25 $23.20 26 – 50 $20.30 51 – 100 $18.85 100+ $17.40 Very large quantity Custom quote License is a one-time charge. Web site handles all automatically: 1. Purchaser can pay by credit card and Web site sends out a URL for the quantity of registrations purchased. 2. User visits the URL and enters the “client code” along with the Product Code and the e-mail address. 3. Web site sends a registration code until it reaches the quantity purchased. Alternate method of payment via Purchase Order or by check. Similar URL is established. For very large quantities, can package specifically with a set registration code. © Copyright 2002-4 HIPAA COW DRAFT Page 17 of 35
  18. 18. End-to-end encryption Authenex http://www.authenex.com/products.cfm?menu3variable=products http://www.authenex.com/products_asafe.cfm?menu3variable=asafe Features ♦ E-mail attachments are encrypted and can only be opened by the intended recipient. Security is managed via two factor authentication, a password, and a USB token (Authenex A-Key). ♦ 128-bit Advanced Encryption Standard (AES) ♦ User must know the ESN number of the sender’s token in order to decrypt an e-mail’s attachment. ♦ Difficult to use with third parties who do not own an Authenex A-Key. ♦ Contents of e-mail are not encrypted. List Price Contact Vendor for pricing. © Copyright 2002-4 HIPAA COW DRAFT Page 18 of 35
  19. 19. End-to-end encryption CipherPack http://www.cipherpack.com/overview.htm Features CipherPack creates a single Windows executable (.EXE) file which contains the decryption and decompression code as well as the encrypted file itself. The user just runs it, and when the correct key is supplied, the file decrypts. Without the correct key, the original file contents can never be seen. CipherPack Pro contains all the features and advantages of CipherPack but with even greater encryption strength by implementing the industry recognized and approved SHA-1 secure hashing algorithm and the Federal Information Processing (FIPS) Advanced Encryption Standard FIPS-197 (AES). CipherPack Pro also includes a secure file wipe option. List Price CipherPack without media is $39.99 CipherPack with media is $49.99 + $5 Worldwide Airmail CipherPack Pro without media is $69.99 CipherPack Pro with media is $79.99 + $5 Worldwide Airmail Please contact CipherPack for corporate pricing details (Orders of over 10 units) © Copyright 2002-4 HIPAA COW DRAFT Page 19 of 35
  20. 20. End-to-end encryption DespatchBox http://www.youritsecure.com/index.pl?s=product&item=160 http://www.youritsecure.com/referrer.pl/ps/160 Features Protects e-mails and attachments through the application of encryption and digital signatures, providing confidentiality, guaranteed message integrity, authenticity, and nonrepudiation. • Ensure client confidentiality is met • Protect sensitive or confidential mail • A secure channel between sender and recipient • Guarantee e-mail authenticity • Seamless integration with popular e-mail clients • Encryption and digital signature technology without the administration headache • Tracking and audit reports to guarantee delivery • Move large files with ease DespatchBox combines PKI technology (Baltimore Technologies as standard) with a hybrid end-to-end encryption capability. All of the cryptography that secures the file/message occurs on the client machine through the use of a client plug-in. (MS Outlook, Lotus Notes, or Web based). This plug-in is a digitally signed, scriptable COM object that uses 1024 bit keys or larger and Triple DES encryption to create a wrapper around each file/message. Each file/message is signed and encrypted using a public/private key system so that the data is completely confidential. Only the recipient can decrypt the message at their client machine. List Price Contact Vendor for pricing. © Copyright 2002-4 HIPAA COW DRAFT Page 20 of 35
  21. 21. End-to-end encryption Encryptek http://www.mailx3.com/ Features • E-mail enhancement service for Windows 95/98/NT/2000 that provides a secure method for e-mail communication. • Strong security and encryption options. 1024 bit encryption. (Was unable to find description of exact encryption used.) • Destroy your e-mail after a set date, after a number of days after the message was first read, or after a specific number of times the message was read. • The ability to password-protect an encrypted e-mail message. • Works with the computer's existing e-mail program. Other e-mail programs besides your primary e-mail program can also be specified to work with MailX3. • Optional message tracking. List Price Contact Vendor for pricing. © Copyright 2002-4 HIPAA COW DRAFT Page 21 of 35
  22. 22. Secure WebMail EnsuredMail by Critical Mass Mail, Inc. http://www.ensuredmail.com/index.html Features E-mail Encryption Gateway: Enables secure messages, attachments, and replies. EnsuredMail software products provide peace of mind for clients ranging from small businesses to Fortune 500 companies to the United States Air Force and the ATF. The company has corporate customers in the US and the UK and end-users in over 70 countries. Currently Ensuredmail’s patent-pending software is one of only a handful of security products to be awarded the US Government’s most stringent security certification (FIPS 140-1). EnsuredMail provides federally certified security and reliable read-receipts, covering two of the most critical needs for HIPAA compliance: • Encrypt confidential patient information easily and effectively, in accordance with new laws • Track e-mails sent and the identities of parties accessing them • Comply with new regulations to avoid large fines and punitive measures • Sign e-mail messages with industry standard X.509 digital signatures List Price Licensing for the product is generally based upon the number of people initiating encrypted e-mail. It is sold as a one-time purchase with software maintenance being the only ongoing expense. Many of our customers license software for only a portion of their employees. For example, it is fairly common for us to see a company of a few thousand people only need a few hundred licenses for our Gateway. Despite the fact that external recipients can securely reply with or without attachments, they have no impact on the licensing cost. Our typical minimum licensing cost is $10,000 for a 100-user perpetual license, but we will sometimes sell a 50-user license for $5,000. Maintenance is an additional 15%. Installation services can be done by the end-customer, but are generally done by EnsuredMail or one of our resellers. A typical installation requires 2-3 man days of professional services, including the time for advance preparation and administrator education. The installation itself is generally done in one day. The per-user licensing cost drops substantially after the first 100 users. For installations over a few thousand © Copyright 2002-4 HIPAA COW DRAFT Page 22 of 35
  23. 23. seats, we switch over to a site license. © Copyright 2002-4 HIPAA COW DRAFT Page 23 of 35
  24. 24. Secure Web Mail MOVEit DMZ by Standard Networks, Inc. http://www.stdnet.com/moveit/ Features MOVEit DMZ is a web based, secure messaging and file transfer system. It resides on a secure server in your "de-militarized zone" attached to your firewall. This enables it to be accessed through the firewall from both inside and outside of your network. MOVEit DMZ improves productivity and collaboration between employees, partners and patients by enabling easy and secure messages or file transfers. It is easy to implement as there is no buying user licenses, installing client software, managing encryption keys, burdening e-mail systems with files, or allowing e-mail attachments through firewalls. MOVEit DMZ includes important capabilities that low-cost secure ftp servers lack, and for far less money than high-end e-mail encryption solutions charge. • Secure Messaging enables authorized users to exchange messages, with or without attachments, using their existing Web browsers. • E-mail notifications can automatically alert users that specific files and messages have arrived or been viewed/deleted/downloaded. • MOVEit DMZ allows users to securely transfer files up to 4 gigabytes in size. Most organizations have restrictions on the size of e-mail file attachments they allow. • Supports web browsers like Firefox, Internet Explorer, Mozilla, Netscape, Opera, and Safari via HTTPS (HTTPS Secure). Use of Java, ActiveX, plugins, or third- party encryption apps such as PGP are not required. • An optional, free, MOVEit Wizard can be used to provide advanced file transfer capabilities, including integrity checking for file non-repudiation. • Secure Storage. Files are encrypted while at rest using built-in US government FIPS certified 256-bit AES encryption. Secure ftp servers typically store files 'in the clear' meaning anyone hacking the server can read the file. MOVEit DMZ automatically re-encrypts all the files and messages it receives, before writing them to disk, eliminating the need to use PGP. • Failover and Scalability to provide the same high availability in multi-server load- balanced environments that MOVEit DMZ has earned a reputation for on single servers. © Copyright 2002-4 HIPAA COW DRAFT Page 24 of 35
  25. 25. • Automatic File Compression reduces file transfer times by 50% on average when using MOVEit clients. • Automatic Resume supports MOVEit and third-party file transfer clients that are able to automatically resume interrupted transfers (aka Checkpoint Restart). • NAT-friendly Encrypted FTPS to and from networks using Network Address Translation. • Firewall-friendly passive FTPS using as few as 4 open firewall ports, not the typical 64,000 ports. • Supports secure web form data collection and management, including data conversion to CSV and XML file formats. • Has comprehensive audit trails in a built-in ODBC accessible database contains each user, file, message, web form posting, and administrative action. • Has built in reporting capabilities (audit data can be easily exported for use by third party report and tracking applications). • Authorization: MOVEit DMZ enables administrators to set specific authorizations on a per user basis that govern which folders on MOVEit DMZ an end-user can access, and what actions they can and cannot take in regard to the files in each folder. • Authentication: MOVEit DMZ requires a valid user name and password in order to log in. The user name and password are tied to the authorizations listed above. MOVEit DMZ offers a variety of password management options to the administrator, including aging, length, characters, and an old password history file. These can be used to force users to adopt robust passwords. • Supports external authentication options with LDAP, Secure LDAP, RADIUS Server, and ODBC databases. • Session Aging: MOVEit DMZ can be set to automatically logout users whose sessions have not been active for a configurable period of time. This means users need to re-authenticate/login again. • Caching: MOVEit DMZ restricts the browser from caching MOVEit DMZ pages. List Price © Copyright 2002-4 HIPAA COW DRAFT Page 25 of 35
  26. 26. MOVEit DMZ with Secure Messaging licensing is $12,000-$15,000 depending on the customer’s requirements. This price includes maintenance and support and unlimited users, messages, file transfers, and storage. MOVEit DMZ runs on a dedicated Windows 2003 Server or Windows 2000 Server. © Copyright 2002-4 HIPAA COW DRAFT Page 26 of 35
  27. 27. Gateway-to-gateway encryption HushMail https://www.hushmail.com/about.php? PHPSESSID=3f481d4d0bf7edd93687fcaa505a24c6&subloc=how http://corp.hush.com/info_center/document_library/hush_patent_wp.pdf Features HushMail uses industry standard algorithms as specified by the OpenPGP standard (RFC 2240). The Hush Encryption Engine™, gives the company exclusive ownership of a revolutionary process that combines PKI with secure roaming capability. In addition, the Hush Encryption Engine™ automates the exchange of public and private keys, thus eliminating the complexities associated with traditional PKI transactions. Hush Key Server Network is a global distribution of networked servers and is the repository for the management of Hush Key records. A Hush Key record includes a Hush Key pair, which is the digital identity of the user, required for encryption, decryption, digital signing and verification along with the user sign-up information. Hush Communications will command a fee for the management of these records. Different e-mail services: HushMail, HushMail Private Label, and HushMail Professional List Price Account Type Setup* Cost** Premium $9.99 $3.99 32MB Storage © Copyright 2002-4 HIPAA COW DRAFT Page 27 of 35
  28. 28. Standard $9.99 $1.99 5MB Storage Additional Features Customization $240 $0 customize the mail client with your logo, colors Administration $240 $0 retrieve usage statistics, administer e-mail accounts within your domain * one-time fee ** monthly fee per account © Copyright 2002-4 HIPAA COW DRAFT Page 28 of 35
  29. 29. Gateway-to-gateway encryption IronMail by CipherTrust http://www.ciphertrust.com/ironmail/policy_enforcement.htm Features • E-mail gateway appliance • Anti-Spam – Control volume of unwanted, offensive, and constantly evolving spam • Anti-Virus – block known and unknown viruses and worms before they get to the mail server • Web-enabled e-mail protection prevents intercept, redirect, or modification of Web-based e-mail • Secure Delivery - Create a trusted e-mail network beyond the firewall with server- to-server and server-to-client encryption • Secure Platform - Detect and block suspicious, mischievous, or unauthorized activities within the mail system and secure the entire e-mail infrastructure • Policy enforcement – possible to define, monitor and enforce, e-mail policies List Price $15,500 direct; software, support, and licensing for first year, 500 users, $9,575 © Copyright 2002-4 HIPAA COW DRAFT Page 29 of 35
  30. 30. End-to-end encryption MailMarshal Secure http://www.messagingsolutions.com/MarshalSoftware/Marshal_Brochure_2001.pdf http://www.messagingsolutions.com/MailMarshal_Secure.htm Features • Uses industry standard S/MIME protocols, making it compatible with encryption capable desktop applications including Microsoft Outlook and other S/MIME compatible gateways • Offers a variety of encryption options up to and including the industry recommended 168-bit triple DES • Also supports RC2 (40 or 128 bit) and DES (56 bit) encryption • Provides signing authentication, confirming the sender’s identity • Allows separate encryption of messages for Escrow archiving (proof of sending) • Supports SHA1 and MD5 signing algorithms • Detects whether the content of a signed or encrypted e-mail has been altered • Can retrieve certificates from a remote store through LDAP List Price Contact Vendor for pricing. © Copyright 2002-4 HIPAA COW DRAFT Page 30 of 35
  31. 31. End-to-end encryption Omniva http://www.disappearing.com/ http://www.disappearing.com/products/policy_manager/policy_manager_ds.pdf Features Exchange secure e-mail and control access and retention with suppliers, customers, and partners – independent of their e-mail systems. Control access to company confidential e-mail and prevent forwarding of sensitive e-mail. Enforce e-mail retention policies and enable compliance with complex retention policies. • Encryption during delivery and authentication after delivery secures the message over its lifecycle. • Preventing forwarding, copying, printing, and/or expiring, the message ensures post-delivery confidentiality. • Preventing deletion even by the sender for pre-set periods helps meet internal or mandated retention policies. • Policy enforcement is extended to include offline and wireless handheld access. List Price Contact Vendor for pricing. © Copyright 2002-4 HIPAA COW DRAFT Page 31 of 35
  32. 32. End-to-end encryption ShyFile (developed and solely owned by Dr. Bootz GmbH, Germany) http://www.cipher-encryption.com/encryption-software.html Features 6144bit Text and E-mail Encryption Software • Make up a 32-character symmetric key • Enter the text you wish to encode • Attach secure ShyFile to your e-mail • Recipient simply uses a browser to decode • That's it. No fuss. No Trusted Third Party. No Public Key. • Keep your current e-mail settings. • Any recipient of a harmless HTML file encoded by ShyFile containing your text does NOT need to have the software installed to be able to decode. List Price $59 Per User © Copyright 2002-4 HIPAA COW DRAFT Page 32 of 35
  33. 33. Gateway-to-gateway encryption Tovaris SecureMail Gateway http://www.tovaris.com/products/ Features A network appliance e-mail proxy positioned at the e-mail server level, it performs encryption and decryption of e-mail and attachments for users. List Price Tovaris' solution suite integrates into existing IT infrastructures. Therefore, capital commitments are low, implementation costs are small, and end users require very little, if any, training. "Entry-Tier" One (1) SMG-1000X appliance* Up to 250 user seats Remote installation/training services (6 hours) List Price: $9,995 (* w/ redundant server: $14,995) "Mid-Tier" Two (2) SMG-1000X appliances Up to 1,000 user seats Remote installation/training services (6 hours) List Price: $27,995 "Top-Tier" Two (2) SMG-2000X appliances Up to 2,500 user seats On-site installation/training services (1 day) List Price: $49,995 + T/E © Copyright 2002-4 HIPAA COW DRAFT Page 33 of 35
  34. 34. End-to-end AND Gateway-to-gateway encryption ZipLip https://www.ziplip.com/ps/app/services/home.jsp Features ZipLip provides the most comprehensive suite of secure delivery methods in the market, providing solutions for all of the following types of users with a full range of options for senders and recipients of enterprise e-mail. ZipLip supports both desktop or gateway software for senders of secure e-mail. By providing both PKI and Non-PKI mechanisms for secure delivery, the ZipLip Secure E-mail Gateway provides as much security as is necessary for organizations with or without PKI in place. Moreover, based on industrial security standards, J2EE and Web services (SAML, S/MIME v.3, x.509.v.3 certificates, XKMS, PKCS #7, PKCS #12, LDAP, etc.), ZipLip interoperates and leverages any existing PKI deployment or certificate authority. Secure Storage The security architecture of ZipLip is built on top of the Java Security and the Java Cryptography Engines (JCE). The two main modules within this framework are the Symmetric Security framework and Encryption Service Provider (ESP) framework. Policy-Based Storage Each application can provide policy-based storage by having a storage router that routes user data to appropriate storage unit based on parameters such as account type, type of application data (secure mail, insecure mail, etc.), and user domain. The storage unit enforces the policy on the data and stores it appropriately. List Price +1000 Users = $50,000 Yearly >500 Users = $32,000 Yearly >50 Users = $10,000 Yearly © Copyright 2002-4 HIPAA COW DRAFT Page 34 of 35
  35. 35. End-to-end encryption ZixMail http://www.zixcorp.com/solutions/ Features Offers a portfolio of secure e-messaging encryption and protection services Compliant to existing systems: available as a stand-alone application or integrates with existing Internet or Intranet confidentiality as a point-to-point desktop encryption service that ensures that a message arrives unaltered and unable to be opened by anyone but the intended recipient. Authentication and non-repudiation with third party time stamping. Currently used by a number of health organizations, including Humana. (Was unable to find description of exact encryption used.) Also ZixWorks : address all your e-messaging needs, from secure e-mail to integrated anti-virus, anti- spam, content scanning, and archiving. List Price $50 Per User or Custom Price for Gateway = Averages $30 Per User © Copyright 2002-4 HIPAA COW DRAFT Page 35 of 35