When Twin Cities Pain Clinic settled class action litigation following a business email compromise attack in July 2025, the financial toll included a $385,000 cap for cash payments, plus attorneys' fees, administration costs, and service awards. The breach affected 3,572 patients after a cybercriminal accessed an employee's email account, exposing everything from Social Security numbers to treatment notes.
This checklist helps you implement technical and administrative controls to reduce your organization's exposure to email-based attacks. Each item maps to specific HIPAA Security Rule requirements where applicable.
Prerequisites
Before starting this checklist, confirm:
- You've designated a Security Official (45 CFR § 164.308(a)(2)) with authority to implement these controls.
- You have an accurate inventory of all email accounts with access to Electronic Protected Health Information (ePHI).
- Your organization has completed a Security Rule risk analysis (45 CFR § 164.308(a)(1)(ii)(A)) that identifies email as a potential vulnerability.
Email Security Checklist
Authentication and Access Controls
1. Multi-factor authentication (MFA) is enforced on all email accounts that access ePHI
45 CFR § 164.312(a)(2)(i), Unique User Identification
What good looks like: Every workforce member must provide two factors (password + authenticator app, hardware token, or biometric) before accessing email. No exceptions for executives or physicians.
2. Password requirements meet or exceed 12 characters with complexity rules
45 CFR § 164.308(a)(5)(ii)(D), Password Management (Addressable)
What good looks like: Your password policy enforces minimum length, requires a mix of character types, and blocks common passwords. Passwords expire every 90 days or are managed through single sign-on with continuous authentication.
3. Privileged email accounts (IT admins, compliance officers) use separate credentials
45 CFR § 164.308(a)(3)(ii)(B), Access Authorization
What good looks like: Your IT director has two email accounts: one for daily communication and one for administrative functions. The admin account requires additional authentication steps and logs all activity.
4. Automatic logoff terminates inactive email sessions
45 CFR § 164.312(a)(2)(iii), Automatic Logoff (Addressable)
What good looks like: Email sessions on web browsers and mobile devices lock after 15 minutes of inactivity. Users must re-authenticate to resume access.
Technical Safeguards
5. Email encryption is enabled for all messages containing ePHI
45 CFR § 164.312(e)(1), Transmission Security
What good looks like: Your email system automatically encrypts outbound messages containing patient data using TLS 1.2 or higher. Recipients receive secure portal links if their email servers don't support encryption.
6. Advanced threat protection filters inbound email for malicious content
45 CFR § 164.308(a)(5)(ii)(B), Protection from Malicious Software
What good looks like: Your email gateway scans attachments in a sandbox environment, rewrites URLs to check for phishing sites, and quarantines suspicious messages before they reach inboxes.
7. Domain-based Message Authentication, Reporting, and Conformance (DMARC) is configured to reject spoofed emails
What good looks like: Your DNS records include DMARC policies set to "p=reject" for your domain. You receive daily reports showing attempted spoofing attacks and can verify that legitimate emails aren't being blocked.
8. Email retention policies automatically delete messages after your designated record retention period
45 CFR § 164.316(b)(2)(i), Retention of Documentation
What good looks like: Non-record emails purge after 90 days. Emails that constitute part of the Designated Record Set are retained for six years from creation or last effective date, then automatically deleted.
Monitoring and Audit
9. Audit logs capture all email access, forwarding, and deletion events
45 CFR § 164.312(b), Audit Controls
What good looks like: Your security information and event management (SIEM) system collects email logs showing who accessed which messages, when, and from what IP address. Logs are retained for six years and reviewed weekly for anomalies.
10. Automated alerts notify security staff of suspicious email activity
What good looks like: You receive real-time alerts when: an account sends more than 100 messages in an hour, someone logs in from a new country, forwarding rules are created, or bulk downloads occur.
11. Regular reviews identify inactive accounts and excessive permissions
45 CFR § 164.308(a)(3)(ii)(C), Access Establishment and Modification
What good looks like: Quarterly audits flag email accounts that haven't been accessed in 60 days. Your process automatically disables these accounts and notifies managers to confirm termination or leave status.
Workforce Training and Awareness
12. Annual security awareness training includes email-specific phishing scenarios
45 CFR § 164.308(a)(5)(i), Security Awareness and Training
What good looks like: Every workforce member completes interactive training that simulates business email compromise attacks. You track completion rates and retest anyone who fails the phishing simulation.
13. Simulated phishing campaigns test workforce vigilance quarterly
What good looks like: You send realistic phishing emails to random workforce members each quarter. Anyone who clicks the malicious link receives immediate remedial training. Your click rate has decreased below 5%.
14. Clear reporting procedures empower staff to flag suspicious emails
What good looks like: A visible "Report Phishing" button appears in every email client. Reported messages route to your security team within 60 seconds, and the reporting employee receives confirmation that their alert was received.
Common Mistakes
Treating email security as an IT-only responsibility: Your Privacy Official and Security Official must collaborate on email policies. Business email compromise attacks often exploit clinical workflows, not just technical vulnerabilities.
Assuming encryption solves all transmission risks: Encryption protects data in transit, but it doesn't prevent an authorized user from forwarding ePHI to unauthorized recipients. You need data loss prevention rules that block sensitive content from leaving your organization.
Skipping MFA for "low-risk" accounts: The Twin Cities Pain Clinic breach began with a single compromised employee email account. Every account with ePHI access is a potential entry point.
Ignoring mobile email access: Workforce members who access email on personal devices create shadow IT risks. Your Business Associate Agreements must extend to mobile device management platforms, and your acceptable use policy must address bring-your-own-device scenarios.
Delaying incident response planning: Class members in the Twin Cities case could claim up to $450 for ordinary losses and up to $4,500 for extraordinary losses. Your breach response plan should include communication templates, forensic investigation contacts, and legal counsel on retainer.
Next Steps
- Schedule a tabletop exercise that simulates a business email compromise attack affecting your organization.
- Review your current email security configurations against this checklist and document gaps.
- Prioritize remediations based on your most recent Security Rule risk analysis.
- Update your incident response plan to include email-specific breach scenarios.
- Verify that your cyber liability insurance policy covers business email compromise attacks and social engineering.
If you're pursuing HITRUST CSF certification, map these email controls to CSF domains 01.n (Access Control), 09.n (Communications and Operations Management), and 10.n (Information Security Incident Management). Your assessor will expect documented evidence that email security controls are implemented and tested annually.
