When your incident response plan meets a class action lawsuit, you find out which controls truly matter. DAP Health's $1.3 million settlement after a breach affecting 129,048 individuals shows what happens when preventive measures fail and your security posture is scrutinized in court.
The lawsuit alleged negligence and failure to implement reasonable cybersecurity measures. This shifts the question from "did you have a security program?" to "could a competent security team have prevented this?" Your goal is to ensure the answer is yes to the first and no to the second.
The Problem: Email Server Compromises Still Work
The DAP Health breach involved unauthorized access to an email server containing sensitive data like Social Security numbers and medical records. Email systems are prime targets because they aggregate sensitive data and often lack the segmentation controls of electronic health record systems.
You're dealing with two risks: the technical vulnerability allowing initial access and the legal exposure when your security allows lateral movement to high-value data. The California Confidentiality of Medical Information Act, California Consumer Privacy Act, and Health Insurance Portability and Accountability Act (HIPAA) all require you to implement appropriate safeguards for sensitive data.
What You Need Before Starting
Access to production systems: You can't secure what you can't inventory. Document every system that processes, stores, or transmits protected health information.
Budget authority for tooling: Effective email security requires endpoint detection, email gateway protection, and privileged access controls. Plan for $50,000-$200,000 annually depending on organization size.
Executive sponsorship: You'll need approval to disable legacy authentication protocols and enforce multi-factor authentication, which will generate user complaints.
Legal and compliance review: Your security controls must align with HIPAA Security Rule requirements (45 CFR §164.308-316) and state medical privacy laws.
Step-by-Step Implementation
Phase 1: Secure Email Infrastructure (Weeks 1-4)
Disable basic authentication on all email systems. Modern authentication protocols prevent credential replay attacks that bypass password policies.
For Microsoft 365 environments:
Connect-ExchangeOnline
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true
Get-CASMailbox -ResultSize Unlimited | Set-CASMailbox -ImapEnabled $false -PopEnabled $false
Enable multi-factor authentication for all accounts with mailbox access. Configure conditional access policies that block legacy authentication entirely:
- Require MFA for all users
- Block authentication from untrusted locations
- Require compliant or hybrid-joined devices for access
Implement email gateway controls. Configure your secure email gateway (Proofpoint, Mimecast, or similar) to:
- Quarantine emails with suspicious attachments
- Rewrite URLs and detonate links in sandbox environments
- Block sender domains that fail DMARC authentication
Phase 2: Segment High-Value Data (Weeks 5-8)
Email servers should not directly store sensitive patient data. Implement these architectural controls:
Move protected health information to dedicated repositories. Clinical data belongs in EHR systems with proper access logging, not in mailbox archives.
Apply data loss prevention policies. Configure DLP rules that:
- Detect Social Security numbers, Medicare IDs, and financial account numbers in outbound email
- Require manager approval before sending messages containing 10+ patient identifiers
- Block external sharing of files tagged as containing protected health information
Enable mailbox auditing. For every mailbox containing administrative or clinical data:
Set-Mailbox -Identity "username" -AuditEnabled $true -AuditLogAgeLimit 365
Set-Mailbox -Identity "username" -AuditOwner MailboxLogin,HardDelete,SoftDelete,Update
Phase 3: Implement Privileged Access Management (Weeks 9-12)
The DAP Health breach involved unauthorized access to an email server, suggesting compromised administrative credentials or unpatched vulnerabilities.
Deploy Just-in-Time Access for email administration. Administrative accounts should not have standing privileges. Use Azure AD Privileged Identity Management or CyberArk to:
- Require approval and business justification for admin role activation
- Limit activation duration to 4-8 hours
- Log every privileged session for audit review
Enforce phishing-resistant MFA for privileged accounts. FIDO2 security keys prevent real-time phishing attacks that bypass SMS and authenticator app codes.
Separate administrative and user accounts. Administrators should use dedicated accounts for privileged operations, never their daily email accounts.
Phase 4: Establish Detection and Response (Weeks 13-16)
Configure alerts for anomalous email access:
- Mailbox access from new geographic locations
- Mass download of mailbox contents
- Forwarding rule creation by non-owner accounts
- Access to 50+ mailboxes within 24 hours by a single account
Build runbooks for common scenarios. Your Computer Security Incident Response Team needs documented procedures for:
- Isolating compromised mailboxes while preserving forensic evidence
- Revoking refresh tokens and forcing password resets
- Identifying the scope of data exposure based on mailbox content analysis
Establish legal notification workflows. The Health Information Technology for Economic and Clinical Health Act requires breach notification within 60 days of discovery. Your incident response plan must include decision trees for determining if an incident constitutes a reportable breach under HIPAA.
Validation: How to Verify It Works
Test authentication controls monthly. Attempt to access email using:
- Accounts without MFA configured (should fail)
- Legacy authentication protocols (should be blocked)
- Credentials from anonymizing VPN services (should trigger conditional access denial)
Review mailbox audit logs weekly. Query for:
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -RecordType ExchangeAdmin
Look for administrative actions you didn't authorize: mailbox permission changes, forwarding rule creation, eDiscovery searches.
Conduct tabletop exercises quarterly. Walk through breach scenarios with legal, compliance, and communications teams. The DAP Health case required notification to 129,048 individuals starting in December 2024, four months after the July incident. Your notification process should support simultaneous mailing, email, and web posting within the regulatory timeframe.
Validate DLP policies. Send test emails containing synthetic patient data (generated test records, not real PHI) to external addresses. Your DLP solution should block or quarantine these messages.
Maintenance: Ongoing Tasks
Monthly: Review privileged access logs for anomalies. Audit mailbox forwarding rules. Update threat intelligence feeds in your email gateway.
Quarterly: Rotate service account credentials. Review and update incident response runbooks. Test backup restoration procedures for email systems.
Annually: Conduct penetration testing that includes email infrastructure. Review legal and regulatory changes affecting notification requirements. Update risk assessments to reflect changes in threat landscape.
After every security incident: Document lessons learned and update controls. The DAP Health settlement included claims for reimbursement up to $5,000 per class member, pro rata cash payments, statutory payments for California residents, and two years of credit monitoring. Your board will want to understand how your program prevents similar exposure.
Build your email security program to withstand the scrutiny of a class action complaint. When plaintiffs' attorneys allege failure to implement reasonable cybersecurity measures, your incident response logs, access control configurations, and monitoring dashboards become your defense. Make them count.
