Unnecessary and legacy protected health information (PHI) in email systems continues to plague Health Insurance Portability and Accountability Act (HIPAA)-covered entities and business associates facing otherwise minor business email compromise events. Due to enhanced security technologies and effective incident response policies, fast‑acting and diligent IT staff can often contain email incidents within hours or even…