Swiss, encrypted e-mail for your practice: what it really protects, its limits, and our role
A dental practice's e-mails often contain health data: an appointment, a treatment plan, an X-ray. The law considers this sensitive data. That is why DentalSystems is a partner of Proton and installs its e-mail service in practices. We also use it for our own e-mail.
Proton in a few words
Proton AG is a Swiss company, based in the canton of Geneva. It was founded in 2014 by scientists who had met at CERN, and it is subject to Swiss law.
Its e-mail service, Proton Mail, encrypts your e-mails. Encrypting means making a message unreadable to anyone who does not have the key.
Your e-mails are stored encrypted on servers located in Switzerland, Germany or Norway. Once stored, they can no longer be read by Proton itself.
What your practice gains
- Between colleagues, everything is protected effortlessly. E-mails exchanged between Proton addresses are end-to-end encrypted: only the sender and the recipient can read them. No settings to change.
- To a patient, a password-protected message. To send a document to a patient who uses another e-mail service, you add a password to the message. The patient opens it without creating an account and can reply to you securely. The message remains readable for 28 days at most.
- A mailbox the host cannot read. The content of your stored e-mails stays encrypted at Proton, even in the event of an incident on its side.
- A subscription in your name. The practice subscribes directly with Proton. The contract, the accounts and the e-mails remain yours.
The limits to be aware of
No e-mail service does everything. Here is what you need to know before sending patient data.
- An ordinary e-mail to an outside address is not end-to-end encrypted. Without a password, a message sent to another e-mail service is protected in transit, but the recipient's e-mail provider can read it. For health data, add a password and pass it on by another channel, for example by text message or in person.
- The subject line is never encrypted. Never write a patient's name or a diagnosis in it: "Your document" rather than "X-ray of Mrs X".
- Encryption does not replace caution. It protects neither against a fraudulent e-mail nor against a stolen password. Two-factor authentication, that is, a code received on your phone in addition to the password, is essential.
- Your e-mails may be hosted outside Switzerland. Germany and Norway offer data protection that Switzerland recognises as adequate. The privacy notice intended for your patients must, however, mention these two countries.
- Proton is not part of the HIN network. HIN is the secure e-mail service specific to the Swiss healthcare sector. It remains the other route for writing to the doctors, hospitals and laboratories that use it. The two can coexist.
- Outlook can only be used under certain conditions. Proton Mail is best read in its own app, on a computer as well as on a phone. If you are attached to Outlook, let's talk about it before the switch.
- An e-mail service is not a backup. It protects neither your practice management software nor your X-rays against a breakdown. That is the role of backups.
What we do for you
You subscribe with Proton; we take care of setting it up.
- We install the Proton Mail app on the practice's computers and configure everyone's accounts.
- We bring over the e-mails from your old e-mail service, so that nothing is lost in the switch.
- We then remain your point of contact: a question, a new account, an access problem, you call us.
Proton does not on its own take care of data protection in your practice. We also look with you at how e-mail fits in with everything else: computers, access, backups.
To go further
Our FADP guide reviews the other measures that protect your patients' data.
Would you like to move your practice to Proton, or simply find out whether your current e-mail service is suitable? Contact us. The first visit is free of charge: we analyse your installation on site, discuss it with you, and give you a quote if you wish.