Re: E-mail

[Peter Coffin <phcoffin@xxxxxxxxxx>]

Joanie writes:

> Perhaps just a general policy statement saying that all e-mail is NOT
> confidential and we (the hospital in my case) reserves the right to view
> any e-mail for it's content.

This is a very complex issue, and some of the best conclusions are
counterintuitive. One very serious risk of of annoucing a right to review
e-mail for content is a possibility that a court may decide that this
implies a responsibility to do so. In essense, if the off-color jokes are
sent using ABC Company's e-mail, then since ABC Company is patrolling for
content, then ABC Company *allowed* this to happen, and is therefore
either responsible or negligent. A strong policy of "We don't ever look at
e-mail unless there's a technical problem", then the sender alone is the
one that can be held liable.

> My biggest concern is my users sending confidential information via e-mail,
> this could range from patient test results and/or diagnosis, to the wage
> rate of an employee......   maybe I'm too worried, but I'd prefer to think
> that my e-mail system is just scheduling meetings/lunches, or asking simple
> questions, not sending patient information .....

"Sending Patient, Personnel, or other confidential information over e-mail
is forbidden." Having forbidden it, if you have reason to believe that
confidential information has been sent by means *other than* sniffing
packets or scanning user mail boxes, then you can still nail the user to a
tree. A policy about appropriate methods of delivering confidential
information is a *different* issue from a policy about appropriate uses
of e-mail, and letting yourself get confused over which statement goes into
which policy is serious trouble.


Peter H. Coffin
phcoffin@us.ibm.com
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to "MIDRANGE-L@midrange.com".
| To unsubscribe from this list send email to MAJORDOMO@midrange.com
|    and specify 'unsubscribe MIDRANGE-L' in the body of your message.
| Questions should be directed to the list owner/operator: david@midrange.com
+---