Secure email

Question

We are a Canadian healthcare application evaluating Azure Communication Services Email for delivery of patient-generated health information.

Our ACS resource would use Data Location = Canada. The application would generate a password-protected PDF containing personal health information in memory and submit the PDF as an attachment through the ACS Email API.

Before using this service for production health information, we need written clarification regarding data residency and retention:

1. Data residency: When ACS Email Data Location is Canada, are the email body and attachments processed exclusively within Canada, including queuing, malware/security scanning, retry processing, failed delivery handling and other transient processing?

2. Cross-border processing: Microsoft documentation states generally that ACS data may transit or be processed in other geographies. Does this statement apply to the actual email body or attachment content for ACS Email when Data Location = Canada? If so, under what circumstances and in which geographies?

3. Retention: After successful or failed delivery, does Microsoft retain any copy of the email body or attachment? If yes, for how long, for what purpose, and in what geography?

4. Logging: Do ACS Email service or diagnostic logs contain email body content, attachment content, patient names, recipient addresses, or other message content? What logging can the customer disable or control?

5. Contractual/privacy requirements: What Microsoft contractual documentation applies when ACS Email is used by an Ontario healthcare application processing personal health information subject to PHIPA? Does the Microsoft Products and Services DPA cover Azure Communication Services Email?

We are not asking Microsoft to certify our application as “PHIPA compliant.” We need the above technical and contractual information so that we can perform our own privacy assessment.