Email Security

Moraph resells, implements and runs Proofpoint email security for hospitals, health systems and other healthcare organizations. We configure Proofpoint to filter malicious mail, flag messages that impersonate your executives or vendors, and remove dangerous messages after delivery, and our analysts triage what your staff report. Proofpoint provides the platform; Moraph operates it; your organization decides the policies and whether any incident is a reportable breach.

The problem it solves

Email is still the most common way attackers reach a healthcare organization. Messages that pose as the CEO asking the CFO for an urgent wire, a vendor announcing new bank details, or an IT notice asking a nurse to sign in again are written to get past people, not just filters. Small security teams often own a capable email platform but lack the time to tune impersonation rules, work the queue of reported messages, pull a bad message from every mailbox it reached, and keep evidence for a breach assessment.

Who it’s for

• CISOs and information security teams at hospitals and health systems
• CFOs, finance and accounts payable teams who handle payment and banking requests
• HIPAA privacy officers who assess possible breaches
• Messaging and Microsoft 365 or Google Workspace administrators
• Internal audit and compliance teams who need evidence of email controls

1. FilterInbound mail passes through Proofpoint before it reaches your mail system. Proofpoint filters spam and malware, checks links and attachments, and applies the policies Moraph configures for your organization.
2. Protect executivesYour executives, finance staff and other high-risk people are named in the policy, so messages that impersonate them, or that ask them to pay or change bank details, are flagged or held for review.
3. RespondMessages your staff report, and messages Proofpoint flags after delivery, are triaged by Moraph analysts. Confirmed malicious messages are removed from every mailbox that received them, and anything touching patient data is escalated to you.
4. Review and improveEach month Moraph reviews what was blocked, reported and escalated with your security owner, and brings the policy changes and decisions that are due.

Inbound filtering

Proofpoint filters spam, malware and phishing before mail reaches your mailboxes, using policies Moraph configures for your domains and departments.

Executive impersonation rules

Proofpoint flags messages that use a protected executive's name from an outside address, configured with the people your security owner names.

Lookalike domain rules

Messages from domains that imitate yours or your key vendors' are held or tagged, with the vendor list maintained with your finance team.

Link and attachment checks

Proofpoint Targeted Attack Protection rewrites links so they are checked when clicked, and tests attachments before delivery, where licensed.

External sender warnings

A banner on messages from outside your organization, with stronger wording for messages to finance staff that ask for payment or banking changes.

Removal after delivery

When a delivered message is found to be malicious, Proofpoint's automated removal pulls it from every mailbox that received it, including forwarded copies, where licensed.

Reported message triage

Moraph analysts review the messages your staff report, decide whether they are malicious, act under the agreed runbook and tell the reporter the outcome.

Sender authentication

Moraph plans your SPF, DKIM and DMARC records with your DNS team and moves DMARC toward enforcement in stages, so others cannot easily send as your domains.

Outbound encryption

Proofpoint Encryption is applied to outgoing messages that match your PHI rules or a staff keyword, where licensed.

Quarantine management

Quarantine folders and staff digests configured by message type, with rules on who may release what.

Most-targeted people

Proofpoint's reporting shows who in your organization receives the most targeted attacks, so protection and training can focus there.

Breach assessment evidence

For any incident that may involve PHI, a record of the message, recipients, clicks and actions taken, ready for your privacy officer's assessment.

Security owner (your organization)

Decides email security policy, the protected people and what Moraph may do without asking

Privacy officer (your organization)

Decides whether incidents involving patient data are reportable breaches

Messaging administrator (your organization)

Runs your mail system and DNS, and makes routing and record changes

Moraph email security engineer

Configures and tunes Proofpoint policies and applies approved changes

Moraph security analyst

Triages reported and flagged messages, removes confirmed threats and escalates the rest

Auditor (read-only)

Reviews policies, incidents and evidence without changing anything

Microsoft 365, Google Workspace or Exchange

Mail for your domains is routed through Proofpoint and delivered to your mail system, which also grants the access needed to remove delivered messages.

DNS

SPF, DKIM and DMARC records are planned by Moraph and published by your DNS administrators.

Directory

Users, groups and departments from Microsoft Entra ID or Active Directory drive policies and the protected-people list.

Report button

Staff report suspicious messages from their mail client, and reports arrive in Moraph's triage queue.

SIEM

Proofpoint message and click events forwarded to your security information and event management system.

Service desk

Quarantine release requests and escalations flow between Moraph and your IT service management tool.

Single sign-on

Your administrators and reviewers sign in to the Proofpoint console and Moraph's service portal through your identity provider (SAML).

Single sign-on

Your staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Changing policies, triaging messages and seeing message content are separate roles, granted only as you approve.

Business associate agreement

Because email can contain PHI, Moraph signs a business associate agreement with you; your agreement with Proofpoint covers its own handling.

Encryption and keys

Incident records held by Moraph are encrypted, and Moraph staff cannot reach them without your explicit, time-bound authorization.

Complete audit trail

Every policy change, removal, release and content view is logged with the person and time, and cannot be edited.

Data residency

Records Moraph keeps stay in the hosting region you choose: the United States, the United Kingdom or Australia. Proofpoint's data locations follow its own terms.

Proofpoint cloud service

Proofpoint operates the email security service in its cloud; Moraph configures and runs it for you.

Existing deployment

Where you already own Proofpoint, Moraph takes over its operation and tuning without a fresh setup.

With other Moraph services

Run alongside Moraph's Secure Messaging, Cloud Content or Identity Governance services.

Scoping

We agree the domains, mailboxes, modules and protected people in scope, and review any existing Proofpoint deployment. We need contacts from security, messaging, finance and privacy.

Routing and connection

Moraph specifies the mail routing, connectors and directory connection, and your administrators make the changes in your mail system and DNS.

Policy baseline

Filtering, impersonation, tagging, quarantine and encryption policies are configured from a documented baseline and reviewed with your security owner.

Monitoring period

Policies run with tagging and quarantine before stricter actions apply, so false positives can be found and legitimate senders allowed.

Sender authentication

SPF, DKIM and DMARC are reviewed for each domain and a staged plan agreed for moving DMARC toward enforcement.

Runbook and handover

The triage runbook, escalation routes and service desk process are agreed, the report button is deployed, and Moraph's analysts take over the queue.

• Moraph is not Proofpoint. Proofpoint's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to Proofpoint's licence terms, and some features described here depend on the modules you license.
• No email filter stops every phishing or impersonation message. Staff awareness and a verification procedure for payment and banking changes are still needed, and those procedures belong to your organization.
• Removal after delivery depends on the permissions your mail system grants and on messages still being in mailboxes Proofpoint can reach.
• Moraph does not run your mail system or DNS; changes there are made by your administrators.
• Breach determination and any notification to patients, HHS or the media remain your organization's decisions.
• Security awareness training and simulated phishing are not included unless added to the scope.
• Moraph supports your HIPAA risk analysis and audits with evidence; it does not certify your compliance.

• List the executives and finance staff you would protect and ask how impersonation of each would be handled
• Review the triage runbook and decide what Moraph may do without asking
• Walk through a reported message from report to removal and escalation
• Check which modules your current or proposed Proofpoint licence includes
• Review your SPF, DKIM and DMARC status for each domain with Moraph
• Confirm who on your side approves policy changes and who makes breach determinations