Secure Email
Your email is the front door to everything. In Ohio it is also a legal obligation.
Encryption, phishing and ransomware protection, backup, archiving and data loss prevention — with the written program Ohio law rewards you for having. Built for attorneys, physicians, realtors, engineers, architects, brokers, and for the Ohio cities, villages, townships and school districts that hold more personal information than any of them.
Ohio gives you 45 days from discovering a breach. The average breach is not discovered for months. Tell us what you are running and we will tell you where you stand.
45-day clock
ORC 1349.19 starts when you become aware.
Encryption exemption
Encrypted data may not require notice at all.
Safe harbour
A written program is a legal defence.
Three tiers
Advanced, Premium and Premium Plus.
Why Email First
Every breach you have read about started somewhere. Usually it was an inbox.
Email is how your business keeps track of what was agreed, with whom, and when. It is also where the attackers go first, because it is the one system every single person in your organisation uses and the one place your client data arrives unprotected by default.
Phishing, business email compromise, credential theft, ransomware delivered in an attachment, a QR code that goes somewhere it should not — these are not exotic. They are the ordinary daily traffic hitting your domain right now.
We stop them at the door, back up what gets through, encrypt what goes out, and document the whole arrangement — which is the part that matters when somebody asks you to prove it.
Close the front door first. Everything else is easier afterwards.
Two ways to work with us
We can manage your email security for you, or we can configure it, hand it over, and answer questions as they come up. Both are legitimate — it depends on whether you have anyone internally who wants the job.
Ohio Law
Ohio does not treat a data breach as an accident. It treats it as a failure.
Two pieces of Ohio law reach almost every business in this state, whatever your profession. ORC § 1349.19 applies to any business entity conducting business in Ohio. If you hold an Ohio resident’s name together with their Social Security number, driver’s licence or state ID, or a financial account number with its access credentials, you are covered — and you have 45 days from discovery to notify every affected resident. The clock starts when you become aware, not when your investigation finishes.
The Ohio Attorney General enforces it independently, under ORC §§ 1349.191 and 1349.192, with civil penalties that escalate the longer notification is late.
ORC Chapter 1354, the Ohio Data Protection Act, runs the other way — it rewards you. A written cybersecurity program that reasonably conforms to a recognised framework gives you an affirmative defence against tort claims alleging your security was unreasonable. It is voluntary, and it is one of the few places in law where doing the work in advance is worth something concrete.
Encrypt it, document it, and the worst day of your year gets considerably shorter.
The encryption exemption
Under ORC § 1349.19, data that was encrypted, redacted or otherwise made unreadable is excluded from the definition of personal information. Encrypt it properly and a breach may not trigger the notification duty at all.
That single sentence is the strongest argument for email encryption that exists in Ohio law.
What Late Notification Costs
The penalty escalates the longer you wait
Under ORC § 1349.192 the Attorney General may bring a civil action where a party intentionally or recklessly failed to notify. The penalties are tiered, and each day is a separate violation.
| Days late | Civil penalty, per day | Who brings it |
|---|---|---|
| Days 1–60 | Up to $1,000 | Ohio Attorney General |
| Days 61–90 | Up to $5,000 | Ohio Attorney General |
| Day 91 onward | Up to $10,000 | Ohio Attorney General |
Penalties under ORC 1349.192 stack with any professional discipline and any civil claim — there is no offset between them. The Chapter 1354 safe harbour covers tort claims only; it does not cover licensing boards, the Attorney General, or the duty to notify.
Sixty days of drift is the difference between a fine and a catastrophe.
Who This Applies To
Your profession adds its own duty on top of Ohio law
ORC 1349.19 and Chapter 1354 apply to essentially all of you. What changes by profession is the second rulebook sitting above them.
| Profession | What also governs your email |
|---|---|
| Attorneys and law firms | Ohio Rules of Professional Conduct 1.1, 1.6 and 5.1–5.3, plus ABA Formal Opinions 477R, 483 and 498. Encrypted email or a secure portal is expected for sensitive material. See IT for law firms. |
| Physicians, dentists, therapists, clinics | The HIPAA Security Rule — and HIPAA is itself a qualifying framework for the Ohio 1354 safe harbour. We sign Business Associate Agreements. See compliance. |
| Insurance agents and agencies | ORC Chapter 3965 requires a comprehensive written information security program, scaled to the size and complexity of your business. This one is mandatory, not voluntary. |
| Mortgage brokers, lenders, CPAs, tax preparers | The Gramm-Leach-Bliley Safeguards Rule, which the FTC applies broadly to anyone handling consumer financial data. GLBA Title V also qualifies for the 1354 safe harbour. |
| Realtors and title agencies | Every transaction file holds names with Social Security numbers and financial account details — the exact combination ORC 1349.19 defines as personal information. |
| Engineers, architects, surveyors | Client drawings, bid documents and project records are commercially sensitive, and any personnel data you hold puts you squarely inside ORC 1349.19. |
| Cities, villages and townships | A different statute — ORC § 1347.12 governs agencies of a political subdivision, with the same 45-day deadline. Municipal email is also a public record under ORC § 149.43 and subject to your retention schedule. |
| School districts and boards of education | ORC § 1347.12 as a political subdivision, plus FERPA for student education records. Staff and student data sit in the same mailboxes. |
| Police, fire and courts | ORC § 1347.12, records retention, and — wherever criminal justice information touches email — the FBI CJIS Security Policy on top. |
| Everyone else conducting business in Ohio | ORC 1349.19 does not have a profession test or a headcount threshold. If you hold the data, the 45-day duty is yours. |
If you hold an Ohio resident’s personal information, this is already your problem. Let us make it a small one.
Cities & Municipalities
Public entities get the same 45-day deadline and none of the legal shield.
If you run technology for a city, village, township, school district or public board, your breach duty comes from ORC § 1347.12 rather than 1349.19. The deadline is the same forty-five days from discovery, and the definition of personal information is identical — a resident’s name with a Social Security number, driver’s licence or financial account credentials.
Here is the part most public officials have not been told. The Ohio Data Protection Act safe harbour in Chapter 1354 defines a covered entity as a business. Political subdivisions are not businesses under that definition, so a municipality cannot claim the safe harbour at all. The affirmative defence that a private firm can earn by writing a cybersecurity program is simply not available to you.
Which leaves prevention and the encryption exemption doing all of the work. Both statutes exclude encrypted and redacted data from the definition of personal information — and for a public entity that exemption is not one protection among several. It is the main one you have.
No safe harbour, a public record obligation, and the same clock. Encryption is not optional here.
And your email is a public record
Under ORC § 149.43 municipal email is a public record, subject to your records retention schedule and producible on request. Archiving is not an optional upgrade for a public entity — it is how you answer a records request without a scramble.
That is also the honest reason most public bodies end up on Premium Plus: indexed archiving, legal hold and export in one place.
What We Turn On
The protections doing the actual work
Phishing & business email compromise
An AI engine learns your organisation’s normal communication patterns and flags the anomalies — which is how targeted social engineering gets caught.
Spam, malware & ransomware
Virus scanning, spam scoring, real-time intent analysis, URL reputation checks and link protection on every message.
Account takeover protection
Detects anomalous mailbox behaviour, alerts, then finds and removes the fraudulent mail already sent from the compromised account.
Attachment sandboxing
Suspicious attachments are detonated and observed in isolation before they ever reach a desk — which is what catches zero-day attacks.
Email encryption
Encrypted in transit and at rest, with secure retrieval over HTTPS. Policies can encrypt automatically based on sender, recipient or content.
Data loss prevention
Content policies that stop Social Security numbers, card numbers, HIPAA data and client lists leaving by email — encrypt, quarantine or block on the way out.
Email continuity
An emergency mailbox keeps you sending and receiving through a mail server outage, so a bad afternoon does not become a lost week.
Cloud archiving & e-discovery
An indexed archive with retention policies, legal hold, role-based auditing and export — the thing you need when somebody asks for records.
Also available: QR-code attack protection, dynamic warning banners, DMARC reporting, automated incident response and SIEM/SOAR/XDR integration.
Most of this is off by default on the mail platform you already pay for.
Choose Your Level
Three plans, and the honest differences between them
Every plan carries the full threat-protection stack. What the higher tiers add is backup, recovery, archiving and staff training.
| Capability | Advanced | Premium | Premium Plus |
|---|---|---|---|
| Flexible deployment — API, in-line or MX record | Available | Available | Available |
| AI-powered detection and response | Available | Available | Available |
| Spam, malware and ransomware protection | Available | Available | Available |
| Phishing and business email compromise protection | Available | Available | Available |
| Account takeover protection | Available | Available | Available |
| QR-code attack protection | Available | Available | Available |
| Link protection | Available | Available | Available |
| Attachment sandboxing | Available | Available | Available |
| Dynamic warning banners | Available | Available | Available |
| DMARC reporting | Available | Available | Available |
| Automated incident response | Available | Available | Available |
| SIEM / SOAR / XDR integrations | Available | Available | Available |
| Email encryption | Available | Available | Available |
| Email continuity | Available | Available | Available |
| Data loss prevention | Available | Available | Available |
| Unlimited Microsoft 365 backup | — | Available | Available |
| Point-in-time data recovery | — | Available | Available |
| File scanning for PII and malware | — | Available | Available |
| Remediation of improper file shares | — | Available | Available |
| Cloud archiving for e-discovery and retention | — | — | Available |
| Security awareness training | — | — | Available |
| Attack simulation | — | — | Available |
Regulated professions and public entities generally want Premium Plus: archiving covers retention, e-discovery and public records duties, and documented staff training is an administrative safeguard under HIPAA, the Ohio 1354 frameworks and CJIS alike.
Tell us your profession and we will tell you which tier actually satisfies it.
How We Get You There
Four steps, and you are covered by the end of them
01
We look at what you have
Your mail platform, who has access, what is already switched on, and what your profession requires of you. Usually more is possible on your current licence than anyone told you.
02
We turn on the protection
Deployed by API, in-line or MX record — whichever fits your stack. No migration, no new mail platform, no disruption to your day.
03
We write the program down
We write the program down
The written cybersecurity policy that Ohio Chapter 1354 asks for, aligned to a recognised framework and scaled to your size. Verbal policies do not qualify.
04
We keep it current and answer the phone
Tuning, reporting, and a written record you can hand to a client, an insurer or a licensing board without assembling it in a panic.
Protected in days. Documented in weeks. Defensible from then on.
Questions
Questions about email and Ohio compliance
Does ORC 1349.19 really apply to a small practice?
Yes. The statute reaches any business entity conducting business in Ohio. There is no headcount threshold and no profession test. A two-person firm holding client Social Security numbers has the same 45-day duty as a hospital system.
If our email is encrypted, do we still have to notify?
Possibly not. ORC 1349.19 excludes data that was encrypted, redacted or otherwise rendered unreadable from its definition of personal information. That exemption is the single best financial argument for encrypting client email.
What exactly does the Ohio safe harbour protect us from?
Tort claims — civil lawsuits alleging your security was unreasonable. It does not cover Attorney General enforcement, your licensing board, or the duty to notify. It is valuable, but it is not a shield against everything, and anyone telling you otherwise is selling.
Which framework should our written program follow?
ORC 1354.03 names NIST CSF, NIST 800-171, NIST 800-53 and 800-53a, FedRAMP, the CIS Controls and the ISO 27000 family. Regulated businesses can instead conform to HIPAA, GLBA Title V, FISMA or HITECH. PCI DSS counts only alongside one of the first group. We will pick the one that fits your profession.
Do we have to move off Microsoft 365 or Google Workspace?
No. This layers on top of what you already run, by API, in-line or MX record change. Nobody changes their address and nothing stops during the switchover.
Can you just turn it on and leave us to it?
Yes. We can manage it, or configure it and hand it over with the documentation while staying available for questions. Plenty of firms take the second option.
We are a village with three office staff. Does this really apply?
Yes. ORC 1347.12 covers agencies of a political subdivision with no size threshold, and small public bodies are targeted precisely because attackers assume the defences are thinner. The records retention duty under ORC 149.43 applies at any size too.
Can our city use the Ohio safe harbour?
No, and this catches people out. ORC 1354.01 defines a covered entity as a business, and a political subdivision is not one. The affirmative defence is unavailable to you, which makes prevention and the encryption exemption considerably more important than they are for a private firm.
How does archiving fit with public records requests?
An indexed archive with retention policies and export turns a records request into a search rather than a project. It also keeps you inside your retention schedule automatically, instead of relying on staff to remember what may be deleted.
We are not in a regulated profession. Is this overkill?
The threat protection is not — phishing does not check your licence. The written program is genuinely optional for you, though it is what converts a breach from an open-ended liability into a defended one.
Ask us the one you are worried about. That is usually the one that matters.
Legal sources: Ohio Revised Code §§ 1349.19, 1349.191 and 1349.192; ORC § 1347.12 (state agencies and political subdivisions); ORC § 149.43 (public records); ORC Chapter 1354 (Ohio Data Protection Act), §§ 1354.01, 1354.02 and 1354.03; ORC Chapter 3965 (cybersecurity requirements for insurance licensees); Ohio Rules of Professional Conduct; ABA Formal Opinions 477R (2017), 483 (2018) and 498 (2021); the HIPAA Security Rule at 45 CFR Part 164 Subpart C; and the Gramm-Leach-Bliley Safeguards Rule.
This page is provided for informational purposes only and does not constitute legal advice. Chas Enterprise Group is an IT provider, not a law firm. Consult your own counsel or licensing board about how these obligations apply to your practice.
Backup & Security Compliance
SOC 2 Type II platforms
The backup and security platforms we deploy are independently SOC 2 Type II audited.
HIPAA controls, BAAs signed
Configured to the HIPAA Security Rule, and we sign Business Associate Agreements.
PCI DSS aligned
Cardholder environments segmented, encrypted and logged to PCI DSS requirements.
Whenever You Are Ready
Forty-five days is not very long. Setting this up does not take nearly that.
Tell us your profession and what you run your email on. We will tell you what the law asks of you, what is already covered, and what it costs to close the rest. No pressure, no scare tactics — the deadlines are quite motivating enough on their own.
Encrypt it. Document it. Stop worrying about it.
Chas Enterprise Group · Grafton, Ohio 44044 · (440) 364-3596 · charley.george@chasenterprisegroup.com