And our support@ mailbox kept snagging PHI, so we set an O365 transport rule to auto-redirect anything with MRN/DOB patterns to a restricted folder and send a portal-only reply; took about 20 minutes and cut incidents by half last week. Anyone else doing fast triage like this while the “real” solution gets budget?
Did something similar but added a ‘soft block’ — if MRN/DOB regex hits, we append a banner with a one-click portal link and delay send by 2 minutes, like a speed bump not a roadblock. Did you add domain exceptions or a thread-ID header so validated case replies don’t get detoured? Requiring a second signal (e.g., “patient” or an attachment) and excluding calendar invites cut our false positives a lot.