Working with POLICY-BASED ENCRYPTED (PBE) EMAIL

How you can help - Shortly after sending a message. Should you receive an email from noreply@serverdata.net with the subject: "Your email has been encrypted."  • If you know that the email sent contained "Protected Information" (Credit Card, Driver License, SSN or other HIPAA Protected information) o Case 1- Recipient has received encrypted messages in the past. No action necessary, this was a "Valid Encryption" o Case 2 - Recipient has NOT received encrypted messages in the past. Contact them to insure that Your “Encrypted Email  Message” sent by the Portal has been received and accepted. • If you do not know why the message was encrypted o If you can, double check that the message to insure it does not contain "Protected Information" (see Useful Information below) o If you still don't know why or are not sure then ▪ Forward a copy of the "Your email has been encrypted." to staff@lr- assoc.com and type WHY? in the subject or body. No other information is necessary • If your sure there is no “Protected Information” in your document, resend your original message adding a "Do Not Encrypt Trigger Word" to the Subject (see below). Instructions below if needed: o From your email program, Select your “Sent” folder o Type (or copy & paste) your subject in the “Search Box” o From the results, find the sent message that matches the Time & Date “Sent” (note, sent times are in the PDT Zone) o Resend the message Useful Information • Do Not Encrypt Trigger Words -  Add bypass: or noencrypt: or decrypt:  anywhere in the subject (the ":" after word is required) • Force an Encrypt Trigger Words -  Add secure: or encrypt: anywhere in the subject (the ":" after word is required) • Never put protected information in the "Subject:" -  Doing so will cause the message to be returned from noreply@serverdata.net with the subject: "Delivery Status Notification(Failure)" • Avoid False Triggers -  Standalone numbers like #.## or ##.## are in a protected format and will be encrypted. When Possible, add a character immediately preceding or following such a number. $#.## or #.##” or #.##lbs. or 12.5hrs. or ##.##ft. • List of indicators/words for PHI or Protected Health Information - These words, when used will trigger a document Encryption. o Account number, beneficiary, Birth date, Birthplace, Claim Date, Claim Number, Drivers License, Emergency contact, Group Number, Health Number, Health Plan ID Number, ID Number, Insured Member, Patient ID, Patient Name, Patient Number, Plan Member, Plan Number, PNID, Primary caregiver, Record Number, RNID • Some Attachments are Analyzed by PBE -  Attachments that contain file names ending with extensions of doc, xls, ppt, docx, xlsx, pptx, vsd, mpp, pdf (That are NOT LOCKED), msg or txt will be analyzed by the PBE. If Protected Information is detected, the email will be encrypted. • Some Attachments CANNOT be Analyzed & by Default are Encrypted -  Attachments such as photos, graphics, LOCKED pdf’s  and any others not included in the above list cannot be read by the PBE. As a fail safe, UNRECOGNIZED/LOCKED messages that cannot be read will be encrypted. • Work Around for UNRECOGNIZED/LOCKED Attachments - With a little forethought encryption of attachments not containing protected information can be avoided. IF you know that the UNRECOGNIZED/LOCKED DOES NOT contain protected information: o Case 1: This is an isolated case and only happens once and a while. Use the Do Not Encrypt Trigger Words found above. o Case 2: This is an Attachment that is used repeatedly.  Add “p-a-s-s_” anywhere in the file name. Examples below: ▪ Change file name e-brochure.pdf to e-brochure-p-a-s-s_.pdf ▪ my-logo.gif to p-a-s-s_my-logo.gif

Understanding & Living with PBE

Why PBE and how you can use and help improve it - Your right to privacy is what we strive to protect. By use of PBE technology we examine documents, identify protected information, and if found we encrypt. However the PBE technology is designed to cover an extremely broad range possibilities and some may not apply to your company.

Working with POLICY-BASED ENCRYPTED (PBE) EMAIL

How you can help - Shortly after sending a message. Should you receive an email from noreply@serverdata.net with the subject: "Your email has been encrypted."  • If you know that the email sent contained "Protected Information" (Credit Card, Driver License, SSN or other HIPAA Protected information) o Case 1- Recipient has received encrypted messages in the past. No action necessary, this was a "Valid Encryption" o Case 2 - Recipient has NOT received encrypted messages in the past. Contact them to insure that Your “Encrypted Email  Message” sent by the Portal has been received and accepted. • If you do not know why the message was encrypted o If you can, double check that the message to insure it does not contain "Protected Information" (see Useful Information below) o If you still don't know why or are not sure then ▪ Forward a copy of the "Your email has been encrypted." to staff@lr-assoc.com and type WHY? in the subject or body. No other information is necessary • If your sure there is no “Protected Information” in your document, resend your original message adding a "Do Not Encrypt Trigger Word" to the Subject (see below). Instructions below if needed: o From your email program, Select your “Sent” folder o Type (or copy & paste) your subject in the “Search Box” o From the results, find the sent message that matches the Time & Date “Sent” (note, sent times are in the PDT Zone) o Resend the message Useful Information • Do Not Encrypt Trigger Words -  Add bypass: or noencrypt: or decrypt: anywhere in the subject (the ":" after word is required) • Force an Encrypt Trigger Words -  Add secure: or encrypt: anywhere in the subject (the ":" after word is required) • Never put protected information in the "Subject:" -   Doing so will cause the message to be returned from noreply@serverdata.net with the subject: "Delivery Status Notification(Failure)" • Avoid False Triggers -  Standalone numbers like #.## or ##.## are in a protected format and will be encrypted. When Possible, add a character immediately preceding or following such a number. $#.## or #.##” or #.##lbs. or 12.5hrs. or ##.##ft. • List of indicators/words for PHI or Protected Health Information - These words, when used will trigger a document Encryption. o Account number, beneficiary, Birth date, Birthplace, Claim Date, Claim Number, Drivers License, Emergency contact, Group Number, Health Number, Health Plan ID Number, ID Number, Insured Member, Patient ID, Patient Name, Patient Number, Plan Member, Plan Number, PNID, Primary caregiver, Record Number, RNID • Some Attachments are Analyzed by PBE -   Attachments that contain file names ending with extensions of doc, xls, ppt, docx, xlsx, pptx, vsd, mpp, pdf (That are NOT LOCKED), msg or txt will be analyzed by the PBE. If Protected Information is detected, the email will be encrypted. • Some Attachments CANNOT be Analyzed & by Default are Encrypted -  Attachments such as photos, graphics, LOCKED pdf’s  and any others not included in the above list cannot be read by the PBE. As a fail safe, UNRECOGNIZED/LOCKED messages that cannot be read will be encrypted. • Work Around for UNRECOGNIZED/LOCKED Attachments - With a little forethought encryption of attachments not containing protected information can be avoided. IF you know that the UNRECOGNIZED/LOCKED DOES NOT contain protected information: o Case 1: This is an isolated case and only happens once and a while. Use the Do Not Encrypt Trigger Words found above. o Case 2: This is an Attachment that is used repeatedly.  Add “p-a-s-s_” anywhere in the file name. Examples below: ▪ Change file name e-brochure.pdf to e-brochure-p-a- s-s_.pdf ▪ my-logo.gif to p-a-s-s_my-logo.gif

Understanding & Living with PBE

Why PBE and how you can use and help improve it - Your right to privacy is what we strive to protect. By use of PBE technology we examine documents, identify protected information, and if found we encrypt. However the PBE technology is designed to cover an extremely broad range possibilities and some may not apply to your company.