We send a growing volume of ServiceNow notifications, some containing PHI, and our current Exchange setup has hit a recipient limit. Would SendGrid handle S/MIME encryption, or should we look at another sending and encryption setup?
Does SendGrid support S/MIME for PHI emails?
Asked by
flicker7
Answers
Do not treat TLS from an email provider as equivalent to S/MIME. TLS protects a connection between mail systems, while S/MIME encrypts the message itself and generally depends on the recipient’s certificate. A sending service can relay mail securely without providing that message-level encryption.
Check whether ServiceNow can encrypt before sending, or whether a policy-aware mail gateway can apply encryption. Also verify how the design handles recipients who lack certificates.
Reply to this answer
For PHI, I would make the vendor and compliance requirements the first filter, not just throughput. Confirm the provider will sign the required agreement, and review logging, retention, access controls, and the exact encryption behavior. A high-volume SMTP service may be fine for ordinary notifications but still not fit your PHI workflow.
Microsoft’s high-volume options may have constraints for external delivery, so check the current product limits and supported encryption path before building around them. Azure Communication Services could be another option in a Microsoft-centered environment, but confirm it meets your specific message-encryption requirements.
Reply to this answer
There are really two separate problems here: sending more messages, and encrypting sensitive content. Switching the transport service may address the first but not automatically the second. Ask each candidate provider whether it supports S/MIME specifically, or only transport encryption, and get the answer in writing.
If S/MIME is required, make sure the sender has access to the right recipient certificates and decide what happens when one is unavailable. If your policy permits a different protected-message approach, compare that separately rather than assuming it is interchangeable.
lilac.drift:
We should also check whether ServiceNow can produce the encrypted message itself before it hands mail off to a relay.
Reply to this answer
SendGrid is aimed at high-volume email delivery, but that alone does not establish that it can apply S/MIME encryption. I would not send PHI through it until the provider’s current terms and technical documentation confirm the required safeguards and agreement.
A dedicated outbound relay can give you more control over routing and policy, but it does not solve encryption by itself. You still need a component that encrypts the message appropriately, plus a plan for external recipients and delivery failures.
Reply to this answer
Add your answer
Answers are reviewed before publication.
flicker7:
That distinction is what I was trying to pin down. We need a way to cover external recipients too, not just internal mail.