Bay State Employee Email System Guide For Professional Use

Employee Training and Best Practices for BayState Emails

Best Practices for Drafting Professional Emails in BayState’s Healthcare Context

• Subject Line Clarity Use concise, descriptive subject lines that include key details (e.g., "Patient Transfer Request – Smith, John – [Date]"). Avoid vague or overly broad subjects like "Urgent" or "Follow-Up."
• Tone and Professionalism Maintain a respectful, neutral, and patient-centered tone. Avoid informal language (e.g., slang, emojis, or abbreviations like "ASAP" unless defined in context). Example:

  ✗ "Hey, can you send me Jane Doe’s records ASAP?"
  ✓ "Could you please share the electronic health record for Jane Doe by EOD for review? Let me know if any access restrictions apply."

• Confidentiality and Data Handling
  • Never include patient names, medical record numbers (MRNs), or protected health information (PHI) in email subjects or bodies unless encrypted or sent via secure channels (e.g., BayState’s secure portal).
  • Use generic placeholders (e.g., "Patient X") when discussing cases internally, except in HIPAA-compliant systems.
  • Avoid forwarding emails containing PHI unless the recipient has a verified "need to know" and the email is encrypted or sent through BayState’s secure email gateway.
• Email Structure and Readability
  • Use short paragraphs (3–5 sentences max) and bullet points for clarity.
  • Highlight action items in bold or with numbered steps.
  • Include a clear call to action (CTA) with deadlines (e.g., "Please confirm receipt and next steps by 3 PM today").
• Attachments and File Security
  • Scan all attachments for malware using BayState’s endpoint protection tools before sending.
  • Use approved file formats (PDF, DOCX, XLSX) and avoid sending unencrypted files (e.g., raw images, unsecured databases).
  • Name files with descriptive but non-sensitive labels (e.g., "LabResults_20240515_SmithJ.pdf" instead of "Confidential1.docx").
• Blind Carbon Copy (BCC) and Reply All
  • Avoid using Reply All unless necessary to maintain chain integrity. For large distributions, use BCC to protect recipient privacy.
  • Explicitly state if an email is not for external distribution (e.g., "This email is for internal BayState use only").
• Legal and Compliance Disclaimers Include BayState’s standard email footer in all outgoing emails to remind recipients of confidentiality obligations:

  "This email and any attachments are confidential and may be privileged. If you are not the intended recipient, please notify the sender immediately and delete this message. Unauthorized use, disclosure, or copying is prohibited."

BayState’s Mandatory Email Security Training Modules for New Hires

• Module 1: Introduction to Email Security in Healthcare
  • Overview of HIPAA Security Rule requirements for email communication.
  • Definition of PHI and examples of prohibited email practices (e.g., sending unencrypted patient summaries).
  • BayState’s data classification tiers (Public, Internal, Confidential, Restricted) and corresponding email handling protocols.
• Module 2: Recognizing and Avoiding Social Engineering Tactics
  • Common phishing techniques in healthcare emails:
    • Impersonation: Fake "IT Support" or "Executive" emails requesting urgent action.
    • Urgent Threats: Messages claiming account suspension or legal action.
    • Malicious Attachments/Links: Emails mimicking internal requests (e.g., "HR Policy Update – Click Here").
  • Verification protocols:

    "When in doubt, do not click. Contact the sender via a verified channel (e.g., phone or in-person) before responding."

  • Reporting suspicious emails to BayState’s Security Operations Center (SOC) via the Phish Alert Button in Outlook.
• Module 3: Secure Email Forwarding and Metadata Management
  • Steps to scrub metadata from documents before forwarding (detailed in the script template below).
  • Use of BayState’s Secure Email Gateway for transmitting PHI externally.
  • Prohibited actions: Forwarding emails to personal accounts or unapproved third-party services.
• Module 4: Incident Response and Reporting
  • How to escalate suspected breaches (e.g., accidental PHI disclosure) using BayState’s Incident Reporting Portal.
  • Consequences of non-compliance, including disciplinary actions up to termination for willful violations.
  • Annual mandatory refresher training for all employees, with random audits of email practices.

Script Template for Forwarding Sensitive Emails Internally

Subject: [Original Subject] – [Your Name] Forwarding Request

Body:
Dear [Recipient's Name],

I am forwarding the following email for your review. Please note the following security instructions:
1. Metadata Scrubbing: All attached documents have been scrubbed of metadata using BayState’s Document Sanitizer Tool (Steps: File > Info > Check for Issues > Remove All Personal Information).
2. Access Restrictions: This email contains [briefly describe content, e.g., "confidential patient treatment plans"]. Access is limited to authorized personnel with a need to know.
3. Retention Policy: Delete this email and attachments after review unless otherwise instructed.
4. Non-Forwarding: Do not redistribute this email or its contents without prior approval from [Your Manager’s Name/Department Head].

Original Email:
[Paste email content below this line, ensuring no PHI is visible in the body.]

Attachments:
[List files with scrubbed names, e.g., "PatientConsent_20240515_Anon.pdf"]

Action Required:
[Specify next steps, e.g., "Please confirm receipt and any required follow-up by [date]."]

Regards,
[Your Full Name]
[Your Job Title]
[Your Department]
[Your Contact Information]