Sharing Documents using Secure Link (Beta)

Secure Link (beta) allows practices to securely send sensitive FYI documents to clients or contacts by email when the recipient needs to access and download the files for their own records. A code will be sent by email or SMS to allow recipients to verify they are the intended recipient before downloading the documents.

When sharing documents using Secure Link, users will be able to select Forms (Elite plan only), Word, Excel, PowerPoint, and PDF documents stored in FYI. Form Templates (Elite plan only), Phone Calls, Meetings, File Notes, or any documents currently being edited, including internally co-edited, cannot be shared. Documents must be finished editing before sharing.

Setting up Secure Link

Email Template

When emailing documents using Secure Link, a Merge Field is used to insert the link that recipients will need to click to access the documents. An Email Template must be created containing this merge field; otherwise, the link will not be sent, and recipients will be unable to access the documents.

An FYI Admin or a user with permissions enabled for Templates must first create the email template containing the relevant link. 

For instructions on creating Email Templates, refer to Creating Email Templates.

1. Create a new Email Template.
    
2. Position the cursor in the location in the Email Template or Signature where you want the information to appear.
    
3. Expand the Document section, and click Secure Link.
    
4. The Merge Field code will be added to the body of the Email Template, displayed as {{ DocumentSecureLinkURL | web_link }}.
   
   Note: When sending the email, the link will be displayed as "Click here".
   

Recipient Verification

When verifying the identity of the recipient accessing the files, FYI will check the following fields:

• The email address, phone, and mobile fields, displayed on the Client - Summary tab. If the phone and mobile fields are blank, the details for the Primary Contact will be used.
• The email address, phone, and mobile fields for contacts on the Client - Contacts tab.
• The email address of the recipient entered when sharing documents.

Where available, FYI will use the Phone and Mobile fields to send an SMS verification code when accessing documents. If a valid mobile number is not available, the code will be sent by email instead.

It's important to ensure these contact details are correct before sending documents using Secure Link. Incorrect or missing details will impact the ability for the recipient to enter a code and access the documents. Documents will need to be reshared if updating any of the email or phone number details above.

Note: For practices on the Elite plan with Forms enabled, FYI offers a Custom Automation Example for updating client details, allowing practices to share a prepopulated Form for clients to review and provide their details.

Sharing Documents via Secure Link

When sharing documents using Secure Link, you can send one or more documents stored in FYI, including Forms (Elite plan only), Word, Excel, PowerPoint, and PDF. 

Form Templates (Elite plan only), Phone Calls, Meetings, File Notes, or any documents currently being edited, including internally co-edited, cannot be shared. Documents must be finished editing before sharing.

Note: Files are limited to a maximum of 50 MB each. Up to 10 files can be shared at the same time.

To share a document using Secure Link:

1. Select one or more documents from the Documents list.
    
2. Click the Share button in the toolbar to display the Create Email drawer.
   
   Note: If the Share button is disabled, ensure that the selected documents are the correct Document Types, and have been finished editing before sharing.
    
3. You can select additional recipients to send the email to. Each recipient will be required to verify their identity separately to access the documents.
   
   Click the 1 Recipient link, and click the drop-down to display contacts or to enter a new email address.
   
   Recipients must be added as a "To" recipient. BCC and CC recipients cannot access documents shared via Secure Link.
   
   Note: If sharing a Form with multiple recipients, the form can only be submitted once, and will become unavailable to other recipients. A reminder message will be displayed to users for confirmation when creating the email. Refer to Using Forms with Secure Link below.
    
4. Select a Template from the drop-down. 
   Note: The selected template must have the Secure Link Merge Field included to ensure a link is sent to the email recipient.
    
5. Update any filing details as relevant.
    
6. Select Save or Send to save it as Draft in FYI, Draft in Outlook, or Send Immediately.
    
7. Change the Send Attachments option to Secure Link.
   Note: To select Secure Link as the default Send Attachments method when sharing documents for this client, update the Send Attachments field in Client Settings.
   
8. Click Create.
    
9. A notification will be displayed in the bottom right corner that the email is being sent.

Documents will remain available via the Secure Link for 30 days. Once expired, recipients will need to contact the practice to request a new link.

Accessing Documents using Secure Link

To ensure that shared documents are only opened by the intended recipients, the client or contact will be asked to verify their identity before they can access shared documents.

These steps will need to be completed each time the link is used to access the files.

1. The client or contact receives an email notification with a link to the shared documents.
   
    
2. The recipient clicks on the link and is prompted to enter their email address. 
   
   The email address must be the same email address that the documents were shared with. If the email address does not match, an error will be displayed. 
   
   If a recipient's email address is changed after documents have been shared, the documents will need to be re-shared using the new address.
   
   Note: If the user enters an incorrect email address 3 times, access will be denied. The recipient will need to contact the practice to confirm their details and request a new link.
   

3. Click Continue.

   A Multi-Factor Authentication (MFA) code will be sent to the recipient. By default, an SMS text message will be attempted first. If a matching mobile number cannot be found in FYI for the recipient, an email will be sent instead. 
   
   The verification code will be valid for 5 minutes.
   
   Note: If more than one contact in FYI uses the same email address, the recipient will be asked to select their mobile number before the code is sent. Click "My number is not displayed" to send the code by email instead.
   
   Click the sections below to view more details.

   SMS

   An SMS will be sent to the recipient when a mobile phone number is stored in FYI in either the Phone or Mobile fields.

   

   If more than one contact in FYI uses the same email address, the recipient will be asked to select their mobile number before the code is sent. Select "My number is not displayed" to send the code by email instead.

   

   When the SMS is received:

   • The sender will be displayed as "FYI".
   • The practice's name will be displayed at the start of the message.
   • The message will be displayed as follows:
     
     "(Practice name) has shared documents with you. Your verification code is (Code). This code expires in 5 minutes. Do not share this code with anyone."

   Email

   If a mobile number cannot be found in FYI for the entered email address, or the recipient selects "My number is not displayed", the code will be sent by email.

    

   When the email is received:

   • The email will be sent by FYI Docs, from the email address no-reply@fyi.app.
   • The email subject will be "Your FYI verification code".
   • The message will be displayed as follows:
     
     "(Practice name) has shared documents with you securely via FYI. Your verification code is:
     
     (code)
     
     This code expires in 5 minutes. If you did not request this code, you can ignore this email - no further action is required.
     
     Do not share this code with anyone.
4. The recipient enters the verification code and clicks Verify.
   
   The verification code is valid for 5 minutes, with the expiry date and time displayed in the recipient's local time. If the recipient doesn't enter the code before the expiry time, they can click the Resend Code link. A new code can be requested once the current code expires.
   
   If an invalid code is entered 5 times, the recipient will be locked out for 30 minutes. After the lockout time expires, they will be able to request a new code. 
    

5. A link will be displayed to download the documents or open the form. If only a single form is shared, recipients will be automatically redirected to the form. Click on the examples below for details.

   Single Document

   The following is an example of when only a single document has been shared using Secure Link.

   

   Single Form

   The following is an example of where a Form has been shared using Secure Link.

   

   Multiple Documents

   The following is an example of when multiple documents have been shared using Secure Link.

   

   Multiple Forms

   The following is an example of when multiple forms have been shared using Secure Link.

   

   Documents and Forms

   The following is an example of when both a document and a form have been shared using Secure Link.

   

Working with Secure Link

Activity Tracking

The Activity section of the Document Drawer will display various updates when using Secure Link. This includes when:

• A Secure link is generated.
• A Secure link MFA Code is requested.
• The shared document has been accessed using the link.
• There have been 3 unsuccessful email attempts.
• An incorrect code has been entered more than 5 times, and the user is locked out for 30 minutes.
• If the verification code could not be delivered by SMS or Email.

Using Forms with Secure Link

Form names will only be displayed to the recipient after they have verified their identity and accessed the shared documents. 

Where multiple forms have been shared, the recipient can click on the Open Form link to open and complete the form in a new window.

If sharing a form with multiple recipients, the form can only be submitted by one recipient. Once submitted, the form will become unavailable to the remaining recipients.

A reminder will be displayed to the user in FYI prior to sending the email. 

If the form is required to be submitted by each recipient, you will need to create and share a separate form for each recipient.