Vital Stats
Relevant Product Characteristics
- This product does not appear to have been designed specifically with healthcare in mind. Note that many products that are useful and appropriate for health care professionals are not designed specifically with health care in mind.
What Is This Product?
ProtonMail is a high-privacy secure messaging platform with both webmail and mobile apps. They also offer a BAA even with their FREE tier of service. This is rare, folks.
It’s Hosted in Switzerland. Is that okay for HIPAA?
For a long time, we weren’t sure about that. Luckily, HHS has been on a guidance-writing streak throughout 2016 and they dispelled this nasty rumor. Hosting information outside the US is fine so long as there is a BAA in place (citation). We also need to take the locale into account in our risk analyses. At the time of writing, we are not aware of any political unrest or problems of note in Switzerland that would impact the security of ProtonMail’s servers.
Downsides That Aren’t Caveats
Caveats are criticisms of the company or warnings about the product. None of these downsides meet those criteria, so we’re just calling them “downsides.”
- ProtonMail doesn’t offer an easy way for someone to initiate a secure message to you – of course they could still send a normal e-mail. In order for a client to send you a secure message through ProtonMail, they must either:
- Have their own ProtonMail account
- Find a ProtonMail message you sent to them that hasn’t already expired and then reply to it.
Okay, there was only 1 downside. That’s a good thing!
This product offers a free service tier or a free trial account:
We encourage all clinicians interested in this product to try out the free trial or experiment with the free tier to see if it suits your needs.
If you discover anything of concern that isn’t addressed in this review yet, please tell Liath about it at [email protected].
- Click here for the free trial or free service tier information→. Important note about Business Associate Agreements: This product offers a Business Associate Agreement with the free trial or free service tier. Be sure to get your BAA from the company before using client information while you test the product.
Caveats
Caveats are criticsms of the company or product that we feel are relevant to your risk management or other important considerations.
None
Notes
Notes cover points where the product can’t ensure compliance or ethical action for you. These help you know what your part of the compliance puzzle looks like when using this product. A high note count usually correlates with a feature-rich product, and not necessarily with a product that has problems.
1) Request Your Business Associate Agreement by Email
The BAA doesn’t come by default. You need to email them and ask for one. Our experience was that they were positive and responsive to requests for BAAs. Did we mention they even offer the BAA on their free account? You don’t see that often, if at all.
2) Set up two-factor authentication
ProtonMail supports two-factor authentication — that’s the deal where after you enter your password, you then also have to receive a text message and then type in the code you receive in the text message. ProtonMail and Person-Centered Tech both recommend you set up two-factor authentication.
ProtonMail used to require two passwords – a login password and a mailbox password – this is no longer the case, though older accounts may still have this set up.
3) Don’t forget your password!
If you forget your ProtonMail password, you lose everything. This is the downside of a high-privacy messaging service. So be sure you use a password management program to store your ProtonMail password.
4) Remember to click the encryption button before you send!
It’s a classic secure email blunder: you hit “send” before you hit “secure” and there goes all that shiny protected health information out into the unsecured, barbaric hinterlands of the Internet.
Like most email providers that can do secure messaging, ProtonMail messages are not secured by default. Be sure to click the button that makes your message a secured one before you send those sensitive messages!
5) Turn on “Advanced” authentication logs
The ProtonMail welcome email that covers security recommends that you activate logging of attempts to sign on to your account.
HIPAA also recommends — er, sorry — requires that. In fact, you should activate the “Advanced” logging, because it keeps a log of the IP addresses of those who attempted to log in. Your BAA with ProtonMail makes this legal and acceptable for you to do, and keeping those logs gives you the audit trail you need for meeting that part of HIPAA’s standards.
6) Make sure clients and colleagues know that your secure messages will expire after some time
In order to maximize the security of messages, ProtonMail secure messages become inaccessible to their recipients after a period of time. Make sure the people you send messages to know that before-hand. Otherwise they may delay opening your message until after it has expired.
You also need to consider this in your procedure for documenting emails.
7) Be sure you are following simple security measures like using appropriate passwords and computer/device security
ProtonMail has a mobile app that can display notifications that messages have arrived and some of the message content. This could potentially allow someone to see a client’s information even when the screen is locked. The app depends on you to keep your phone secure so that the app is secure, too. Our Device Security Instruction Center covers smartphone security in detail. Our video on how to use the security features of your smartphone is also quite helpful.