Sophos Email customers using IP-based mailflow rule connectors must migrate to certificate-based configuration by March 31st. To see if you're affected Click Here.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 0 replies
  • Subscribers 16 subscribers
  • Views 428 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Email DLP Rules - HIPAA

Steve Spragg

We are seeing false positives for the rule "Protected health information (PHI) related terms [USA] ", specifically because it it looking for terms related to or near PHI and not necessarily the PHI itself. I have tried combining several PII CCLs with this one, but have not seen anything consistent.

We have attempted to work with support and professional services previously, and the answer is that we need to test and apply changes to our environment for number of instances or matching multiple CCLs. They will not give guidance beyond using the DLP rules that are enabled out of the box.

I wanted to see if there is anyone that has been successful in finding a combination that will identify and encrypt PHI with fewer false positives?



Added tags
[edited by: Raphael Alganes at 9:21 AM (GMT -7) on 2 Jun 2023]
Unfiltered HTML