Corporate email for clinics and healthcare organizations
Clinic corporate email requires a setup in which patient correspondence can only be seen by authorised employees in the relevant department, who has access to what is recorded, and sensitive information can be checked before it goes to the wrong person. SmartMail establishes this setup with per-mailbox permissions, department assignment, send approval and an audit log.
Why is email sensitive in healthcare organizations?
A clinic, polyclinic, or laboratory manages appointment requests, questions about test results, correspondence with insurance companies, and supplier orders via email. A significant part of this correspondence contains health data. Article 6 of the Law on the Protection of Personal Data, No. 6698, classifies health data as special categories of personal data and stipulates additional precautions for processing this data. This page provides general information and does not constitute legal advice; consult your specialist regarding your organization's obligations.
The most common risks in daily practice are:
- Everyone can see every emailA single the shared mailbox reception, accounting and doctors who use it also see patient correspondence that does not concern one another's work.
- Wrong recipientBecause of address autocomplete, a patient's information may go to another patient with the same name or to the wrong organization.
- Access of a departed employeeWhen a shared mailbox password is shared, an employee who has left the company may still have access to the mailbox.
- Missing recordsWhen a patient asks who has accessed their information, no answer can be given.
- Fake organization emailsEmails impersonating an insurance company, laboratory or public institution may request credentials or payment.
How is access restricted in patient correspondence?
In SmartMail, each department can use its own mailbox: appointments, laboratory, accounting, and patient relations are kept in separate mailboxes. Each employee only sees the mailboxes assigned to them. Access is granted with nine separate permissions per mailbox: viewing, writing, deleting, tagging, quarantine management, rerunning analysis, chatting about email, writing notes and flagging. A reception employee can read and reply to the appointment mailbox but never sees laboratory correspondence. Delete and quarantine management permissions are disabled by default for new assignments.
Mailboxes can be assigned to a department, not a person. Employees joining the department automatically gain access; access is automatically revoked for those leaving the department. Mailbox passwords are generated by the system, stored securely, and not shared with employees; everyone logs in with their own credentials. The person leaving the job does not need to have their password changed.
How is it recorded who accessed what?
Every meaningful action on the administrator side — opening a mailbox, granting access, changing permissions, changing a setting — is written to the audit log with the actor's identity, time and IP address. Each email's activity log shows who read it, added a note and tagged it, and when. The question "who looked at this patient's correspondence?" is answered from the email itself.
How can sensitive information be checked before it goes to the wrong person?
In the preview screen that opens before every send, recipients, the sending mailbox, attachments and the body are shown together. Emails containing sensitive documents such as test results or reports can be submitted for approval by the responsible physician or department manager before they are sent. The approver sees the entire email; if they request a change, they must write what needs to be changed.
Internal notes about the patient are not written into the email sent to the patient; they remain alongside the email as a team note and are not sent to the recipient.
How to detect fake organization emails?
SmartMail measures every incoming email in terms of identity, structure and content; the SPF, DKIM and DMARC records of the sender domain are recalculated; addresses that resemble the organization's domain, display-name spoofing, replies going to another address and misleading links are flagged separately. Executable attachments are considered dangerous. Suspicious email is quarantined before it reaches the inbox, and the reason is stated.