Email is an essential means of communicating in corporate settings. Sarbanes-Oxley Act (SOX) was enacted to guide public companies in establishing the necessary internal controls for the gathering, processing and reporting of corporate financial information. The control, reliability, effectiveness and performance of information technology systems used for financial controls require more than just the prevention of human manipulation. Prevention of the loss, disclosure, destruction or corruption of corporate financial information while circulating this information between corporate users is an essential requirement of SOX.

HIPAA calls for finalizing comprehensive privacy and security standards, which the Department of Health and Human Services (HHS) has established. Although the HHS privacy regulations became effective on April 14, 2020 and the security regulations had a compliance deadline of April 21, 2020, many entities covered by HIPAA have not completed compliance programs and are just now coming to grips with the privacy and security standards.

Covered Entities can meet these security controls by implementing the available technologies designed to protect data where it resides:

• Encryption of electronic PHI in transit or at rest
• Use authentication mechanisms to confirm the identity of users
• Implement integrity controls over electronic PHI to ensure that if any attacker or accidental process alters or destroys electronic PHI, the alteration or destruction would be detected.
• Manage security through tools for provisioning user access and for changing or removing access as needed.
• Maintain an audit trail of activity to detect and provide an evidentiary record of user activity.