A four-hour window. That's all it took for an unauthorized person to access an employee email account at Integrative Emergency Services and view Protected Health Information (PHI). The company detected the intrusion and locked down the account within 24 hours, yet still faced formal breach notification obligations.
This checklist helps you build the technical controls, monitoring capabilities, and response protocols you need when an email account compromise occurs at your organization. Every item includes the specific outcome that defines "done."
Prerequisites
Before you work through this checklist, confirm:
- You have administrative access to your email platform (Microsoft 365, Google Workspace, or on-premises Exchange).
- Your organization has documented which staff members hold incident response authority.
- You know where your current Business Associate Agreements list email security obligations.
- You can access audit logs for your email system without waiting on vendor support tickets.
Email Security Hardening
1. Enforce multi-factor authentication (MFA) on all accounts that send, receive, or store PHI
HIPAA Security Rule § 164.312(a)(2)(i) requires you to implement a mechanism to verify that a person seeking access to Electronic Protected Health Information (ePHI) is the one claimed. MFA satisfies this as a technical control.
Done looks like: Zero email accounts can authenticate with username and password alone. Your MFA enrollment report shows 100% coverage for staff with PHI access, and you've disabled legacy authentication protocols that bypass MFA.
2. Configure conditional access policies that block sign-ins from impossible travel patterns or unfamiliar locations
These policies act as your first automated tripwire. If an account authenticates from Denver at 9 a.m. and from Romania at 9:15 a.m., the system should block or challenge the second attempt.
Done looks like: You've defined your organization's expected geographic footprint and set policies that require additional verification or block access entirely when sign-ins originate outside those boundaries. Test by attempting sign-in from a VPN endpoint in an unexpected country.
3. Validate that your email platform enforces TLS 1.2 or higher for all inbound and outbound connections
According to Paubox's analysis of healthcare email traffic, roughly 4% of connections went to servers with unverifiable certificates. When your platform accepts unverifiable or expired certificates, PHI can travel across an untrusted path.
Done looks like: Your transport rules reject connections that don't meet your certificate requirements, and your monthly connection logs show zero accepted messages over unencrypted or weakly encrypted channels.
4. Deploy mailbox auditing on all accounts
You can't investigate what you didn't log. Mailbox audit logs capture who accessed a mailbox, what actions they took, and when.
Done looks like: Auditing is enabled for all mailboxes (not just admin accounts), you're capturing SendAs, SendOnBehalf, and MailboxLogin events, and logs retain for at least 90 days. Run a test: access a colleague's delegated mailbox and confirm the event appears in your audit trail within 15 minutes.
Detection and Monitoring
5. Set up automated alerts for unusual sign-in activity
Your email platform can notify you in real time when it detects anomalous behavior: sign-ins from new devices, access outside business hours, or bulk message deletion.
Done looks like: Alerts route to a monitored inbox or Security Information and Event Management (SIEM), you've defined thresholds that balance signal and noise (start conservative: alert on any sign-in from a new country), and you've tested alert delivery by simulating a suspicious event.
6. Review forwarding rules and delegates weekly
Attackers who compromise an account often create inbox rules that forward messages to external addresses or auto-delete security alerts.
Done looks like: You run a weekly PowerShell or API query that exports all active forwarding rules and mailbox delegates, compare the output to the prior week, and investigate any additions you didn't authorize.
7. Monitor for bulk email sends or mass deletions
A compromised account might send phishing messages to your contact list or delete evidence of the intrusion.
Done looks like: Your monitoring tool flags any account that sends more than 50 messages in an hour or deletes more than 100 items in a session, and those flags trigger an immediate security review.
Incident Response
8. Document your account lockdown procedure with step-by-step commands
When you detect a compromise, you can't afford to troubleshoot syntax. Your runbook should include the exact commands or console steps to disable the account, revoke active sessions, and reset credentials.
Done looks like: A one-page procedure that any on-call admin can execute in under five minutes, tested quarterly during tabletop exercises. Include screenshots if your team isn't familiar with PowerShell.
9. Preserve forensic evidence before you remediate
The moment you reset a password, you lose visibility into what the attacker accessed. Capture logs first.
Done looks like: Your incident response plan requires you to export mailbox audit logs, message trace results, and sign-in logs to an immutable location before you change any credentials. Assign a specific team member this responsibility so it doesn't get skipped under pressure.
10. Define your 24-hour investigation timeline
IES secured the compromised account within 24 hours of detection. You need a clear timeline for determining what PHI the unauthorized person may have viewed.
Done looks like: A documented process that specifies who reviews audit logs, who interviews the account owner, and who makes the breach determination. Include decision points: if the intruder accessed fewer than X messages, proceed to step Y; if more, escalate to legal and notify OCR within 60 days of discovery.
Common Mistakes
Assuming MFA eliminates all risk. MFA significantly reduces account takeover risk, but attackers can still exploit session cookies, use MFA fatigue attacks, or compromise the second factor itself. Layer MFA with conditional access and anomaly detection.
Waiting for the email platform vendor to alert you. Microsoft and Google provide security signals, but they don't know your organization's normal patterns. You must configure the alerts and thresholds that match your risk tolerance.
Overlooking shared mailboxes and service accounts. These accounts often lack MFA because they don't have an assigned user, making them attractive targets. Either assign them to a specific owner who can MFA-protect them or use application-based authentication with certificate credentials.
Treating password resets as sufficient remediation. Changing the password stops the current intrusion but doesn't address how the attacker got in. If they phished the original credentials, they'll phish again. Retrain the user and review whether your anti-phishing controls failed.
Next Steps
Run this checklist as an audit of your current state, then prioritize gaps by likelihood and impact. Start with items 1, 4, and 8 (MFA, mailbox auditing, and incident response procedures) since they provide the foundation for everything else.
Schedule a tabletop exercise within 30 days: simulate a compromised account scenario and walk your team through the lockdown and investigation steps. Note where you lack tools, access, or clarity, and fix those dependencies before the next real incident.
Your goal isn't to prevent every possible intrusion. It's to detect and contain compromises fast enough that "just over four hours" of unauthorized access doesn't turn into days or weeks of undetected exfiltration.
