Technology to e-mail: Make yourself scarce
Does this have a place in health care?
Every hospital has employees who let e-mail messages sit in the system, refusing to delete them. Now a company in San Francisco is offering the equivalent of an e-mail paper shredder. It’s technology that causes an information security expert to issue this warning: Health information management professionals must ensure that all documentation needs have been met before wiping the e-mail slate clean.
The technology offered by Disappearing Inc. is a form of e-mail policy, not just e-mail security, says Jeff Ubois, marketing director and co-founder of Disappearing Inc. The technology permanently deletes e-mail after a predetermined amount of time and is intended to help people who want to keep their messages confidential.
"It’s like a phone call," he explains. "With a phone call, the presumption is that when you and I hang up, the conversation is gone. One of us can opt to record that phone call, but that is not the presumption. The deceptive thing about e-mail is that it lasts forever and you don’t expect it to."
The paper-shredder aspect of the technology is a way of ensuring that messages go away or are destroyed routinely, just as people do with paper records, he adds.
Abracadabra . . . Microsoft
To send "Disappearing E-mail" messages, the sender must be using Microsoft Outlook, Ubois says. "Anyone can receive these messages, but not everyone can send them. That’s a difference from security software that might require both parties to use the same program."
The user can specify when messages will d isappear or organizations can set policies that control all of the e-mail inside the organization. "They can say, Unless someone takes specific steps to save it, we want all of the e-mail to go away after 45 days,’" Ubois says.
To create a Disappearing E-mail, the company’s software:
• contacts a Disappearing Access Server assigned to the sender and requests a 128-bit key along with a special identification number for the message;
• encrypts the body of the message using the key and a standard Blowfish encryption algorithm;
• includes the key identifier and a URL pointing to the server holding the key in the message header data;
• packages the encrypted content inside of a self-unpacking html message so that recipients without Disappearing E-mail software can still read the message.
After encryption, the new e-mail message is routed through the existing e-mail server. If the message is stored on a backup tape, the technology will delete it from the tape, as well.
People who use the system are assumed to want to cooperate, Ubois says. "If one party of a phone call doesn’t want it to be private, the other party has a hard time making sure it is private." The other party, for example, could simply print out a copy of the message.
The need for documentation
Disappearing Inc. is still evaluating how the technology can be used in the health care industry, Ubois says.
One primary use, to delete e-mail that could be embarrassing to the sender, doesn’t apply as much to health care. Instead, many hospitals have more of a problem ensuring that e-mail messages relevant to patient care find their way into the permanent record, says Dale Miller, director of consulting services for Irongate Inc., an information security consulting firm in San Rafael, CA.
"It’s hard to imagine not wanting to keep a record of legitimate communication, at least for a certain time period," he says, especially since it is difficult to have an e-mail system that is not part of the inpatient care system.
Hospitals need to be aware of these new technologies, however. "People should get the heads-up so they can think carefully about implementing something like this. They should understand its pros and cons," Miller says.
At first glance, hospitals might think that technology that makes confidential information disappear is great, he explains. "As a caution, you need to ask if you will need that confidential information down the line sometime. Also, is the system installed properly and are you aware of any limitations or possibilities that the information might not disappear when you are counting on it being deleted?"
Ubois agrees in the importance of retaining critical information. "Our technology should be implemented in a way that supports an organization’s document retention policy as well as its requirements for security and confidentiality."
Even with new technology, the biggest issue regarding information security always involves the management of people, Miller says.
"There are good technologies that will help and that will need to be integrated into the overall information security plan," he explains. "But it is also just as important to train people."
Technology can’t stop people from inappropriately sharing confidential information. Security breaches such as this are "just as much of the problem as the failure to use good technology," Miller says.
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content