Email Encryption for HIPAA: What Is Required and How to Do

HIPAA does not name a specific email product, and it does not say "encrypt every message" in so many words. It does require you to protect electronic protected health information (ePHI) in transit, and encryption is the safeguard regulators expect you to use unless you can document a good reason not to. For nearly every practice, clinic, and business associate, the practical answer is to encrypt any email that contains PHI, sign a business associate agreement with whoever handles it, and train staff to avoid the mistakes that cause most email breaches.

This guide explains what the rule says, what a compliant setup looks like, and where organizations slip.

TL;DR

Under the HIPAA Security Rule, encryption of ePHI in transit is an "addressable" specification. That does not mean optional: you implement it, or you document why it is not reasonable and put an equivalent measure in place.
HHS has said that, because encryption is built into most software and affordable options exist, implementing it will generally be reasonable and appropriate.
Encryption alone is not compliance. You also need access controls, audit controls, authentication, a risk analysis, and a signed business associate agreement with any vendor that touches ePHI.
Wrong-recipient mistakes and phished mailboxes are as dangerous as an unencrypted connection, so staff training and verification habits matter.

What HIPAA actually says about email
Is encryption required or just recommended?
Two kinds of encryption you need to understand
Four practical ways to send encrypted PHI
What about patients who ask for regular email?
Safeguards beyond encryption
What goes wrong when PHI travels by unprotected email
A step-by-step setup checklist
Our perspective
Get your email setup checked
FAQ
Sources

What HIPAA actually says about email

HHS addresses this directly. The Security Rule allows ePHI to be sent by email over an open network as long as it is adequately protected, with policies and procedures that restrict access, protect integrity, and guard against unauthorized access.

The transmission security standard, 45 CFR § 164.312(e)(1), requires technical measures to guard against unauthorized access to ePHI sent over an electronic network. Email is an electronic network transmission, so it falls squarely under that standard.

Two points trip people up:

There is no approved product list. No product is "HIPAA certified" by HHS. A vendor can support compliance, but compliance is something your organization demonstrates.
The rule is technology neutral. You choose the method that fits your risk, your size, and your workflows, then document the choice.

Is encryption required or just recommended?

Encryption is classed as an addressable implementation specification under 45 CFR § 164.312(e)(2)(ii). HHS explains that addressable is not the same as optional. You must implement encryption if your risk assessment finds it reasonable and appropriate. If you decide it is not, you must document that determination and implement an equivalent alternative measure if one is reasonable and appropriate.

In practice, that decision is very hard to defend for email. In its 2025 proposed rule to strengthen the Security Rule, HHS noted that encryption is built into most software and affordable solutions exist, so it generally would be reasonable and appropriate for regulated entities to encrypt ePHI. That is a proposed rule, so check HHS for its current status, but it shows how regulators think.

If you do decide not to encrypt a given type of message, the paper trail is the thing auditors look for. A short, dated risk analysis entry, the reasoning, and the alternative control you adopted. A guide on documenting HIPAA compliance decisions can help your IT team structure that evidence.

Two kinds of encryption you need to understand

People say "encrypted email" and mean different things. A compliant setup usually covers both layers.

Encryption in transit

This protects a message as it moves between mail servers, typically through TLS. It stops someone on the network from reading the message mid-flight. Its weakness: it works only if both the sending and receiving servers support it. If the recipient's server does not, the message can fall back to plain text unless you enforce TLS or route around it.

Encryption at rest and message-level encryption

This protects the message or attachment itself, so it remains unreadable on a server or in a mailbox without the right key or login. Message-level encryption is what most portal-style "secure message" tools provide: the recipient gets a notice and opens the content through a secure link or a verified login.

For PHI, we recommend message-level protection for any email going outside your organization, with enforced TLS as a baseline underneath it.

Four practical ways to send encrypted PHI

The checked guidance gives you a good map of the options. ONC notes that organizations can use secure email-based solutions within certified health IT or through independent Direct secure email providers, and that you can ask your health IT vendor whether its system supports Direct secure email and connects with other providers.

Method	Best for	Watch out for
Policy-based encryption in your business email platform	Day-to-day messages with outside parties	Rules must trigger reliably, and the vendor must sign a BAA
Secure portal or secure message tool	Patients and one-off recipients	Patients must be able to open it easily, or they will ask for plain email
Direct secure messaging through your EHR	Provider-to-provider exchange of clinical information	Both sides need to be on the network
Secure file sharing for attachments	Large records, imaging, billing files	Links need expiry, access logging, and authentication

For large attachments, our guide to managed secure file sharing methods covers how to keep records out of the inbox entirely. If your team also wants to move care team conversations off standard email and texting, there are alternatives to standard email and texting worth comparing, though the same rules on BAAs and access controls apply to each one.

ONC also cautions that standard email and texting carry a risk of violating HIPAA policies if they are not encrypted, which is why dedicated secure messaging is common for care teams.

What about patients who ask for regular email?

The Privacy Rule permits providers to communicate electronically with patients and other providers for treatment purposes, as long as reasonable safeguards are applied. Patients also have a right to request alternative means of communication. If unencrypted email is not acceptable to a patient, you should offer a more secure method.

The same HHS guidance lists the common-sense precautions:

Check the recipient's email address for accuracy before you send.
Send an alert to the patient to confirm the address before sending sensitive information.
Limit the amount and type of information you disclose through unencrypted email.

If a patient insists on plain email, talk to your compliance officer or healthcare attorney about how to document the warning and the patient's choice. Do not improvise that process.

Safeguards beyond encryption

This is where articles that stop at "turn on encryption" fail readers. The Security Rule requires regulated entities, covered entities and business associates alike, to ensure the confidentiality, integrity, and availability of ePHI. For email, that translates into a handful of concrete controls.

Business associate agreements

Before a business associate can handle ePHI, you must have a compliant written agreement in place. If your email provider, secure messaging tool, archiving service, or managed IT provider can access mailbox content, you need a BAA with each. A vendor that will not sign one is not an option for PHI.

Access, audit, and authentication controls

The Security Rule calls for access controls, audit controls, and authentication procedures. On a mail system that means:

Unique user accounts, never shared mailboxes with a shared password.
Multifactor authentication on every mailbox.
Logging of sign-ins, forwarding rules, and message access, with someone responsible for reviewing it.
Prompt removal of access when staff leave.

A real risk analysis

Every decision above rests on a documented risk analysis. ONC's provider guide reminds practices that they are responsible for safeguarding patient health information whether it lives on a computer, in an EHR, or on paper. Email is one more place PHI lives, and it is often the least inventoried.

What goes wrong when PHI travels by unprotected email

The consequences are financial, regulatory, and reputational. HIPAA civil monetary penalties currently range from $145 to $2,190,294 per violation, depending on the level of culpability, and criminal penalties can apply to intentional violations. Those figures are adjusted for inflation, so confirm the current amounts with HHS.

Penalties are only part of it. A misdirected email or a compromised mailbox can trigger breach notification duties to patients, and the cleanup, legal review, and lost trust cost more than the fine in many cases.

In our experience, the breaches that start in email come from a few repeating causes:

Wrong recipient. Autocomplete picks the wrong "Smith."
Compromised mailbox. A staff member enters credentials on a fake login page, and an attacker reads the inbox. Encryption in transit does nothing here. Our post on how real emails can still be phishing explains why a message passing basic checks is not proof that it is safe.
Fraudulent requests. An attacker impersonates an executive or vendor and asks for records or a payment change. See our business email compromise prevention guide.
Missing BAA or audit trail. The technology is fine, but the paperwork and logs are not there when an investigator asks.

A step-by-step setup checklist

Use this order. It keeps you from buying a tool before you know what you need.

Inventory where PHI enters and leaves email. Look at billing, scheduling, referrals, records requests, and patient messages.
Run or update your risk analysis and record your encryption decision for each flow.
Choose your encryption method from the table above. Enforce TLS as a floor, and use message-level encryption for outside recipients.
Sign BAAs with every vendor that can access mailbox content.
Turn on multifactor authentication and conditional access for every account.
Set rules that trigger encryption automatically, for example on keywords, attachment types, or a subject-line tag, so staff do not depend on memory alone.
Enable logging and review it on a schedule someone owns.
Train staff on address verification, phishing, and what to do when they send something to the wrong person.
Write down the process and revisit it at least annually or when systems change.

If you manage mail across several accounts or shared inboxes, a tool for managing shared email inboxes can help with assignment and triage, but confirm any such tool is covered by a BAA before PHI touches it.

Our perspective

Most of the email problems we see in healthcare offices are not exotic. They are an encryption setting nobody verified, a shared mailbox with no multifactor, a vendor with no BAA, or a front-desk habit that nobody ever trained away.

That is why we treat email as part of the whole infrastructure rather than a separate product. At Collett Systems we manage the stack for a fixed cost per user, with 24/7 monitoring, security management, and compliance documentation included, so encryption, authentication, backup, and logging are handled together and documented in one place. When an auditor, an insurer, or a partner asks how you protect PHI, you hand over records, not a guess.

Our advice to any practice owner: do not start by shopping for an encryption tool. Start with a risk analysis and an honest look at who can read your mailboxes today. The right tool becomes obvious after that, and the documentation writes itself.

, Dustin Collett

Get your email setup checked

If you are not sure whether your mail system encrypts what it should, our IT & Security Assessment gives you a documented look at your current controls and the gaps to close. We serve small and mid-sized organizations in West Bend and Southeastern Wisconsin, including healthcare practices that handle PHI. You can read more about our healthcare IT services and HIPAA compliance support.

Book the IT & Security Assessment and find out where your email stands before someone else does. If you want a quick first read, the Free IT Risk Score takes about 60 seconds.

FAQ

Is regular Gmail or Outlook HIPAA compliant?

No email service is compliant by default. Compliance depends on how it is configured, whether the vendor signs a BAA for your plan, and whether you add encryption, authentication, and logging. Ask your vendor in writing and keep the agreement on file.

Does HIPAA require me to encrypt every email?

HIPAA requires safeguards for ePHI in transit, and encryption is an addressable specification. You must implement it when your risk analysis says it is reasonable and appropriate, which HHS has indicated is generally the case. If you choose not to, you must document why and use an equivalent measure.

Can I email a patient who asks for unencrypted messages?

The Privacy Rule permits reasonable-safeguard electronic communication with patients, and patients can request alternative communication methods. HHS suggests limiting the information sent and confirming the address first. Have your compliance officer set the process for documenting the patient's request.

What should I do if I emailed PHI to the wrong person?

Report it internally right away to your privacy or compliance officer. They will assess whether it is a reportable breach under HIPAA and handle notification. Do not delete the evidence or try to decide alone whether it counts.

Email Encryption for HIPAA: What Is Required and How to Do It