Exchange: security and privacy considerations

Email security

Whichever method you use to access your Exchange email, you'll need to authenticate (prove) your identity with your Medical ID and associated password.  Some email software provides these credentials automatically, once you have configured your email account profile.  For other access methods, your credentials must be provided each time (such as with Outlook Web Access). 

Some email access methods can only be used with secure (encrypted) connection methods.  For others, adding the encryption of a virtual private network connection is optional, but recommended.  (We discuss those options in each of the access methods for Exchange.)

Even with an encrypted connection, your email security still depends on the overall security of the computers by which you and those with whom you correspond, access it. For more on that, see the guides to computer security at work and at home.   Or see the courses on Safer Emailing and IM-ing.

Email sent to the Exchange system from outside the medical campus is filtered to reduce -- but, unfortunately, not eliminate -- the incidence of spam and other email-borne security threats.  Be sure you understand how to safely handle the spam that still gets through.  (Email sent within the Exchange system -- from one medical campus account holder to another -- is not filtered.)

Email privacy

Email is now regularly used for communications of all types -- including those containing sensitive information. To protect the privacy of the persons whose information we keep -- be they employees, patients, students or other types of customer -- use restraint and keep your exchanges of sensitive data using email to a minimum. The University employs the Securemail system to encrypt outbound email messages that contain credit card, medical record, or social security numbers.

As regards your own privacy -- be aware that  when you use a workplace email system you are creating an official document.  It is a document that may:

  • have legal consequences, including use in a civil or criminal proceeding;
  • live effectively forever on various file backup copies;
  • be viewed by many persons beyond those to whom it is addressed;
  • be subject to inspection by your employer at any time, and possibly by numerous legal and regulatory authorities too. 

Under the laws of the US and the State of Florida, you as an employee have essentially no privacy rights with respect to email sent from or received at a workplace email system.  Obtain a personal email account for your personal correspondence.