WhatsApp is not HIPAA compliant for healthcare communications containing protected health information. Despite offering end-to-end encryption, WhatsApp lacks several required elements for HIPAA compliance, including Business Associate Agreements, adequate access controls, and audit logging. Healthcare organizations cannot legally use standard WhatsApp to communicate patient information without risking regulatory violations and potential penalties under HIPAA compliant enforcement rules.
WhatsApp Encryption and Security Features
WhatsApp provides end-to-end encryption that protects message content during transmission between users. This encryption prevents even WhatsApp itself from accessing message contents, creating a basic level of confidentiality. Two-factor authentication adds protection against unauthorized account access. Message deletion capabilities allow removing content after sending. Screenshot blocking in disappearing messages mode prevents certain forms of message capture. Device linking requires biometric or PIN verification when connecting new devices to accounts. While these security features offer protection for personal communications, they fall short of the structured safeguards required for HIPAA compliant healthcare messaging.
Missing Business Associate Agreement
Meta (WhatsApp’s parent company) does not offer Business Associate Agreements for standard WhatsApp accounts. This absence creates an insurmountable barrier to becoming HIPAA compliant, regardless of any security features or usage policies implemented. Without a BAA establishing WhatsApp as a business associate under HIPAA compliant regulations, healthcare organizations cannot legally use the platform for communications containing protected health information. The WhatsApp terms of service make no provisions for healthcare regulatory compliance or protected health information handling. Healthcare organizations seeking compliant messaging must select platforms from providers willing to enter into appropriate contractual relationships governing healthcare data.
Access Control and Authentication Limitations
WhatsApp lacks the granular access controls needed for healthcare communications. The platform offers limited ability to manage which users can access specific conversations beyond simple group membership. Administrative oversight tools for organizational accounts fall short of healthcare requirements for managing user permissions. Account access remains tied primarily to phone numbers rather than organizational identity systems. The platform lacks integration with enterprise authentication systems used in healthcare settings. Message visibility cannot be restricted based on staff roles or need-to-know principles within healthcare teams. Organizations cannot implement the access management hierarchies typically needed for proper information governance in clinical environments.
Audit and Compliance Documentation Challenges
HIPAA compliance requires detailed records of who accessed information and when this access occurred. WhatsApp provides limited message delivery and reading confirmations but lacks comprehensive audit logs needed for regulatory compliance. The platform offers no administrative portal for reviewing user activities across an organization. Message history may be lost during device changes or app reinstallation. Organizations cannot generate compliance reports showing message handling patterns. Data retention controls do not align with healthcare recordkeeping requirements. Without proper audit capabilities, healthcare organizations cannot demonstrate compliance with HIPAA access monitoring requirements or investigate potential security incidents involving patient information.
Data Management and Retention Issues
WhatsApp creates several data management challenges that conflict with HIPAA requirements. The platform automatically saves received media to users’ personal devices, potentially exposing protected health information. Backup settings may send message history to personal cloud storage accounts outside organizational control. Message deletion features allow recipients to remove content without administrator knowledge. Data retention periods cannot be centrally managed to align with healthcare recordkeeping policies. The platform lacks classification tools for identifying which conversations contain protected health information. Organizations cannot implement consistent data lifecycle management across all communications containing patient information.
Compliant Alternatives to WhatsApp
Healthcare organizations requiring HIPAA compliant messaging should implement appropriate alternatives to WhatsApp. Platforms like TigerConnect, Spok, and Halo Health provide secure messaging designed specifically for healthcare environments. Many electronic health record systems include compliant messaging components within their patient care applications. Telehealth platforms offer secure communication channels as part of virtual visit workflows. Enterprise communication platforms like Microsoft Teams can support HIPAA compliant messaging when properly configured and covered by appropriate agreements. These alternatives provide the necessary security features, administrative controls, and compliance documentation needed for healthcare communications containing protected health information.
Limited Acceptable Use Cases
WhatsApp may have limited acceptable use cases within healthcare environments when properly restricted. Administrative communications that never include patient information can utilize the platform with clear policies prohibiting any protected health information. Public health outreach and general wellness information that contains no individually identifiable health data may be appropriate for WhatsApp distribution. Patient communications through WhatsApp should occur only when patients have been clearly informed of privacy limitations and have explicitly chosen this communication method despite its risks.
Erik Kangas
With 30 years engaged in to both academic research and software architecture, Erik Kangas is the founder and Chief Technology Officer of LuxSci, playing a core role in building the company into the market leader for HIPAA compliant, secure healthcare communications solutions that it is today. An international lecturer on messaging security, Erik also advises and consults on email technology strategies and best practices, secure architectures, and HIPAA compliance. Erik holds undergraduate degrees in physics and mathematics from Case Western Reserve University, and a doctoral degree in computational biophysics from MIT.
Erik Kangas — LinkedIn
Few terms in healthcare get thrown around as loosely as “HIPAA violation.” It gets invoked when a nurse mentions a patient’s diagnosis to a friend outside of work, when a technician talks about a well-known patient who came through the clinic, or when a physician casually brings up a person’s rare diagnosos at a backyard barbecue — situations that sound like violations but often have nothing to do with the actual law. That confusion isn’t just an oversight, but rather, it points to a gap in understanding what HIPAA covers, who it applies to, and what genuinely puts an organization at risk.
For health care providers, compliance officers and IT professionals, the stakes behind that confusion are anything but casual. The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has issued settlements ranging from a few thousand dollars to over $16 million for the same underlying failures, such as a missed risk assessment, an unencrypted laptop, a chart accessed by the wrong person. This guide breaks down what actually constitutes a HIPAA violation, the most common ways organizations end up on OCR’s radar, what genuinely falls outside HIPAA’s scope, and what to do if you’re managing risk or responding to an incident right now.
If your organization handles PHI over email — one of the highest-risk channels for exactly this kind of violation — our HIPAA Compliant Email guide is a useful next read once you’ve worked through this one.
What Is a HIPAA Violation?
A HIPAA violation occurs when a covered entity, business associate, or a member of either’s workforce fails to comply with a standard set out in the HIPAA Privacy Rule, Security Rule, or Breach Notification Rule — or fails to follow an internal policy implemented to support HIPAA compliance.
That definition matters because it draws a hard boundary around who can actually commit one. HIPAA applies to:
Covered entities — healthcare providers, health plans, healthcare suppliers, payers, and healthcare clearinghouses
Business associates — vendors and contractors that create, receive, maintain, or transmit protected health information (PHI) on a covered entity’s behalf
Workforce members — employees, volunteers, and contractors of either of the above
HIPAA does not apply to private individuals acting outside of a covered role — a distinction that trips up far more people than you’d expect, and one we’ll come back to later in this guide.
The Health Insurance Portability and Accountability Act (HIPAA) was designed to protect the confidentiality of medical records and patient data while still allowing healthcare organizations to function and share information when appropriate. A violation happens when that balance breaks down — when PHI is accessed, used, or disclosed in a way the law doesn’t permit, or when required safeguards simply aren’t in place.
The Three HIPAA Rules a Violation Can Break
Every HIPAA violation traces back to one (or more) of three core rules. Understanding which rule is in play helps clarify what actually went wrong — and what needs to be fixed.
Rule
What It Governs
Example Violation
Privacy Rule
Who can access, use, and disclose PHI, and under what circumstances
Sharing a patient’s diagnosis with someone outside their care team without authorization
Security Rule
Administrative, physical, and technical safeguards for electronic PHI (ePHI)
Failing to encrypt emails in transit or a laptop that stores patient information
Breach Notification Rule
Requirements for notifying affected individuals and HHS after a breach of unsecured PHI
Missing the 60-day deadline to notify patients after a data breach
Most real-world violations involve more than one rule at once, such as a stolen, unencrypted laptop is a Security Rule failure that can also trigger Breach Notification Rule obligations. Keeping the three rules distinct in your own documentation, though, makes it much easier to identify exactly where a gap exists.
Most Common Types of HIPAA Violations
These are the violation categories that show up most often in OCR settlements, and the ones every provider, payer, and supplier organization should actively guard against.
Unauthorized Access / Snooping
This is the violation most people have actually heard about, usually because of a celebrity or high-profile patient case that made headlines. A staff member accesses a patient’s medical record without a legitimate, job-related reason — often out of curiosity, not malice — and it still counts as a serious violation.
What’s easy to miss here: the violation is about the access itself, not just what happens to the information afterward. Looking at a chart you have no clinical reason to view is a violation the moment it happens, even if you never repeat, share, or act on what you saw. Hospitals take this seriously enough to flag high-profile patient charts automatically and audit access in real time — which is exactly why staff who snoop tend to get caught quickly, and why termination is the near-universal outcome when they do.
A useful way to think about it: the sensitivity of the underlying information isn’t what determines whether accessing it was a violation — the authorization to access it through that specific system is and if a job role requires it. Pulling PHI through a restricted system without a legitimate reason is a violation even in cases where the same information might, in theory, be available through some other, non-restricted channel. Improper access through the wrong door is still improper access.
Example: Dr. Huping Zhou was sentenced to four months in federal prison after accessing celebrity medical records 323 times with no legitimate reason. UCLA Health System was separately fined $865,000 related to similar unauthorized access incidents.
Failure to Conduct a Risk Analysis
The Security Rule requires covered entities and business associates to conduct an organization-wide risk analysis identifying vulnerabilities to the confidentiality, integrity, and availability of ePHI. Skipping this step — or doing a superficial version of it — is one of the single most commonly cited failures in OCR settlements, because it’s foundational: nearly every other safeguard depends on knowing where your actual risks are.
Example: Premera Blue Cross paid $6,850,000, and Excellus Health Plan paid $5,100,000, both tied in part to failures to conduct adequate risk analyses before major breaches occurred.
Insufficient Access Controls
Access controls determine who can view or modify ePHI, and they need to be granular enough that staff can only access the minimum information necessary for their role. When access controls are too loose, such as shared logins, no role-based restrictions, no automatic logoff, organizations lose the ability to actually enforce the “minimum necessary” standard HIPAA requires.
Example: Anthem Inc. paid $16,000,000, the largest HIPAA settlement to date, following a breach connected in part to access control failures affecting nearly 79 million individuals.
Failure to Encrypt ePHI on Portable Devices
Laptops, phones, and USB drives leave the building. When they’re lost or stolen without encryption, an isolated incident becomes a reportable breach — because unencrypted PHI on a missing device is, by definition, unsecured PHI.
Example: Children’s Medical Center of Dallas paid $3.2 million after multiple incidents involving lost, unencrypted mobile devices containing ePHI.
Missing or Incomplete Business Associate Agreements
Any vendor that creates, receives, maintains, or transmits PHI on a covered entity’s behalf — from a billing company to an email provider — is a business associate under HIPAA, and business associates are legally required to sign a Business Associate Agreement (BAA) before handling that data. Skipping this step, or using a vendor without one, is a violation regardless of whether anything actually goes wrong with the data itself.
Example: North Memorial Health Care of Minnesota paid $1.55 million after failing to enter into a BAA with a business associate that later experienced a breach.
Impermissible Disclosures of PHI
This category covers PHI shared with someone who wasn’t authorized to receive it — a press release naming a patient, a social media post, filming patients without consent, or telling family or coworkers more than they’re entitled to know.
Example: New York Presbyterian Hospital paid $2,200,000 after filming patients for a documentary without proper consent.
Improper Disposal of PHI
Paper records tossed in regular trash instead of being shredded, or old hard drives discarded without being wiped, both count as impermissible disclosures — PHI doesn’t stop being protected just because someone’s done using it.
Example: Parkview Health paid $800,000 after leaving patient medical records unattended in a driveway during a records transfer.
Exceeding Breach Notification Deadlines
Once a breach of unsecured PHI is discovered, the Breach Notification Rule sets a hard 60-day deadline to notify affected individuals (and HHS, for breaches involving 500+ records). Missing that window turns a bad situation into a compounding one.
Example: Presence Health paid $475,000 for failing to notify affected individuals within the required timeframe following a breach.
Denying Patient Access to Records
Patients have a right to access their own medical records, generally within 30 days of a request, without excessive fees or unreasonable barriers. Denying or delaying that access is one of the more consistently enforced violation categories in recent years.
Example: Cignet Health of Prince George’s County paid $4,300,000 for denying 41 patients access to their own medical records.
Every one of these categories comes back to the same underlying question: does your organization actually have documented, enforced processes for who can touch PHI, how it’s protected, and what happens when something goes wrong? If email is part of that picture — and for nearly every healthcare organization, it is — our HIPAA Compliance Checklist walks through exactly what needs to be in place.
What Is Not a HIPAA Violation (Common Misconceptions)
HIPAA gets invoked constantly in situations it has nothing to do with — and clearing up that confusion matters, because it helps healthcare professionals, IT and compliance teams focus their actual attention where it belongs.
A family member discussing your health isn’t a HIPAA violation. HIPAA governs covered entities, business associates, and their workforces — not private individuals speaking in a personal capacity. Your mother telling a relative about your diagnosis might be a breach of your trust, but it’s not a HIPAA violation, because she isn’t bound by HIPAA in the first place.
Confusing HIPAA with FERPA or the ADA is common, and usually incorrect. Educational records fall under FERPA (the Family Educational Rights and Privacy Act), not HIPAA — a teacher discussing a student’s grades or attendance isn’t a HIPAA issue. Similarly, questions about a disability accommodation, like a mask exemption or a service animal, generally fall under the Americans with Disabilities Act (ADA), not HIPAA.
Asking about someone’s health isn’t the same as disclosing it. HIPAA restricts what covered entities and their workforces can disclose, it doesn’t restrict what any individual, including a coworker, cashier, or stranger, can ask. Someone asking why you’re wearing a mask or requesting proof of a medical condition might be inappropriate or even illegal under a different law, but it isn’t itself a HIPAA violation.
Vague references aren’t the same as identifiable disclosures. HIPAA violations require that protected health information (PHI) be tied to an identifiable individual. Referring to “a patient” or “a young adult male” in casual conversation is too vague to trigger a violation. Naming a specific person — “my patient, Mike, who lives on Oak Street” — alongside health information crosses that line.
A simple way to keep the distinction clear:
A nurse telling friends a specific patient’s name, date of birth, and diagnosis → HIPAA violation.
A pharmacist telling a customer their prescription refill is delayed → not a HIPAA violation.
The line isn’t about whether something feels private. It’s about whether protected health information tied to an identifiable person was disclosed by someone bound by HIPAA in the first place.
HIPAA Violation Penalties: The 4-Tier Structure
OCR calculates civil penalties based on the violator’s level of culpability, not just the severity of the incident. Understanding which tier applies matters, because the same underlying mistake can result in wildly different consequences depending on whether it was a one-off oversight or a known, ignored risk.
Tier
Culpability Level
Fine Range (Per Violation)
Annual Cap
Example Scenario
Tier 1
No Knowledge
$100 – $50,000
$25,000
The organization could not have reasonably known about the violation
Tier 2
Reasonable Cause
$1,000 – $50,000
$100,000
The organization should have known, but the violation wasn’t due to willful neglect
Tier 3
Willful Neglect (Corrected)
$10,000 – $50,000
$250,000
Willful neglect occurred, but the issue was corrected within 30 days
Tier 4
Willful Neglect (Not Corrected)
$50,000 (fixed)
$1.5 million+
Willful neglect occurred and was not corrected in time
Penalty amounts are periodically adjusted for inflation, and current maximum penalties can exceed $2 million annually per violation category — figures worth confirming against HHS’s current published rates before citing specific numbers internally.
Criminal penalties sit outside this civil tier structure entirely. Knowing or willful violations can result in criminal fines ranging from $50,000 to $250,000, plus up to 10 years in prison for the most serious offenses — typically reserved for cases involving intent to sell, transfer, or use PHI for personal gain or malicious harm.
How Are HIPAA Violations Discovered?
Violations don’t usually surface because someone confesses. They’re found through a handful of consistent channels:
Audit logs and automated access-flagging. Most modern EHR systems automatically flag unusual access patterns — a chart accessed by someone outside the care team, or a spike in access to a high-profile patient’s record. This is precisely how most unauthorized-access violations come to light; systems are built to catch exactly this pattern.
Patient complaints. Patients can, and do, file complaints directly with HHS when they believe their information was mishandled.
Breach self-reporting. Covered entities and business associates are required to self-report breaches meeting certain thresholds.
OCR compliance audits. HHS periodically conducts proactive audits of covered entities and business associates, independent of any specific complaint or breach.
One nuance worth understanding: not every violation escalates the same way. A single, isolated mistake, such as an email sent to the wrong recipient or a chart accidentally opened, is often handled through internal correction and documentation. A repeated pattern of the same behavior is a different story entirely, and is far more likely to become something an organization is required to report to HHS. This is one of the most important distinctions for healthcare organizations and compliance teams to build into internal escalation policies: document every incident, but treat repetition as a signal that internal correction alone is no longer sufficient.
How to Report a HIPAA Violation
If you’re a patient, employee, or compliance officer who has identified a potential violation, there are two established paths ti report a violation, and they aren’t mutually exclusive.
Step 1: Report it to the employer or covered entity directly. Most healthcare organizations have an internal compliance officer or reporting process specifically for this purpose. Internal reporting is often the fastest way to get a genuine mistake corrected before it escalates.
Step 2: File a complaint with HHS’s Office for Civil Rights. If internal reporting isn’t appropriate, isn’t effective, or the violation is serious enough to warrant it, complaints can be filed directly through HHS’s official complaint portal. Complaints generally must be filed within 180 days of when the violation was discovered, though extensions are sometimes granted for good cause.
A few practical notes:
Anonymous reporting is possible, but limited. OCR accepts anonymous complaints, but the lack of contact information can restrict how thoroughly they’re able to investigate.
Retaliation against someone who reports in good faith is itself prohibited under HIPAA.
Not every complaint results in a formal investigation — OCR reviews each complaint to determine whether it falls within HIPAA’s scope before proceeding.
How to Avoid HIPAA Violations & Fines
For Organizations
Conduct — and document — a genuine risk assessment. This isn’t a one-time checkbox; risk assessments should be revisited whenever systems, vendors, or workflows change.
Sign a BAA with every vendor that touches PHI, including email, billing, and IT service providers — no exceptions.
Implement role-based access controls so staff can only access the minimum PHI necessary for their specific role.
Encrypt ePHI in transit and at rest, especially on portable devices and email, where enforced encryption remains one of the most consistently under-implemented safeguards.
Train staff regularly, not just at onboarding. A single training session at hire rarely holds up against years of evolving risk.
For Individual Staff Members
Only access patient records tied to a legitimate, job-related reason — never out of curiosity, even for patients you know personally.
Never discuss identifiable patient information outside of your care team, including with family, friends, or on social media.
Report suspected violations, including your own mistakes, immediately rather than waiting to see if anyone notices.
Treat every device and email containing PHI as if it could be lost, stolen, or misdirected tomorrow, because eventually, statistically, one will be.
Since email remains one of the highest-volume channels for exactly this kind of accidental exposure, secure, HIPPA compliant solutions, such as LuxSci’s SecureLine encryption technology, are built specifically to remove the guesswork — enforcing encryption automatically rather than relying on staff to remember to apply it correctly every time.
HIPAA vs. State Privacy Laws
HIPAA sets a federal floor, not a ceiling. States are free to enact privacy laws that are stricter than HIPAA, and when they do, the stricter standard generally governs. This matters for multi-state healthcare organizations especially, such as a provider, payer, or supplier operating across state lines may need to comply with HIPAA everywhere, plus additional, more stringent requirements in specific states.
This guide focuses on federal HIPAA requirements, but compliance officers should treat HIPAA as the baseline, not the finish line, when evaluating their organization’s full regulatory exposure.
What Should I Do Now?
Understanding what counts as a HIPAA violation is the first step. Actually closing the gaps that lead to one is the harder, ongoing work — and email is one of the most common places that work quietly falls through the cracks.
Here are three ways to keep moving forward:
Read our HIPAA Compliant Email guide to understand exactly what makes an email platform compliant — and where standard email tools like Gmail and Microsoft 365 fall short.
Work through our HIPAA Compliance Checklist to audit your organization’s current safeguards against what HIPAA actually requires.
Explore LuxSci’s SecureLine encryption technology to see how enforced encryption and a signed BAA work together to close the exact gaps that show up most often in OCR settlements.
The most common violations include unauthorized access to patient records, failure to conduct a risk analysis, insufficient access controls, failure to encrypt ePHI on portable devices, missing Business Associate Agreements, impermissible disclosures of PHI, improper disposal of records, and exceeding breach notification deadlines.
2. What’s the difference between a HIPAA violation and a FERPA or ADA issue?
HIPAA governs protected health information handled by covered entities and business associates in healthcare settings. FERPA governs education records, and the ADA governs disability discrimination and accommodation. A teacher discussing grades falls under FERPA, not HIPAA. A question about a disability accommodation typically falls under the ADA, not HIPAA.
3. How do I report a HIPAA violation?
Report it directly to the employer or covered entity first, if appropriate. If that isn’t effective or the violation is serious, file a complaint with HHS’s Office for Civil Rights within 180 days of discovering the violation, using the official HHS complaint portal.
4. Can I sue someone for violating HIPAA?
No. HIPAA does not provide a private right of action, meaning individuals cannot sue directly under HIPAA. Patients can file a complaint with HHS/OCR, and in some cases may have separate legal remedies under state privacy or negligence laws.
5. Is looking up a patient’s chart without a work reason a HIPAA violation, even if I don’t share the information?
Yes. Accessing a patient’s record without a legitimate, job-related reason is a violation the moment it happens — it doesn’t require sharing, saving, or acting on the information afterward. This is one of the most consistently enforced categories, particularly for high-profile or celebrity patients whose charts are routinely audited.
In healthcare IT, the term “secure email” gets thrown around loosely. Vendors slap the label on anything with a padlock icon, and internal teams often assume that because their provider offers TLS, they’re covered. They’re not, and the gap between what’s assumed and what’s actually required is where data breaches occur and HIPAA violations happen.
This guide breaks down exactly what secure email means from a technical and regulatory standpoint, why the email platform your staff uses every day probably isn’t compliant out of the box, and what to look for when evaluating a provider that needs to protect PHI at scale. If you want the full picture of what compliance requires beyond email specifically, our HIPAA Compliance Checklist is a useful companion read.
What Is Secure Email?
Secure email refers to an email system that protects the confidentiality, integrity, and availability of message content — specifically PHI — through a combination of technical safeguards and contractual protections. It’s not a single feature. It’s a stack of controls working together.
At minimum, secure email in a healthcare context includes:
Enforced encryption in transit, so messages can’t fall back to plaintext delivery
Encryption at rest, so stored messages remain protected on the server
Authentication protocols (SPF, DKIM, DMARC) that prevent spoofing and impersonation
Access controls and audit logs that track who accessed what, and when
A signed Business Associate Agreement (BAA) with the email provider
The distinction that trips up most organizations is this: encryption is a component of secure email, not the whole picture. A provider can offer encryption and still fail to meet HIPAA requirements if that encryption isn’t enforced, if there’s no BAA in place, or if audit logging doesn’t exist. Secure email is the combination of all these pieces functioning as a system, which is why it needs to be evaluated holistically rather than checked off feature by feature.
For healthcare provider, payer, and supplier organizations, this matters because email remains one of the highest-volume channels for PHI exposure, from clinical referrals to patient billing statements to routine staff communication. Getting the definition right is the first step toward closing the compliance gap.
Why Standard Email Is Not HIPAA-Compliant
Many healthcare organizations run on Gmail (Google Workspace) or Microsoft 365, and most assume they’re protected because encryption exists somewhere in the stack. That assumption is the single most common — and most dangerous — misconception in healthcare email security.
Here’s the problem: standard email services use opportunistic TLS by default. TLS is attempted between mail servers, but if the receiving server doesn’t support it, the message is delivered anyway — unencrypted, in plaintext. Neither the sender nor the recipient typically sees a warning. The email just goes through.
This isn’t a hypothetical edge case. IT professionals managing healthcare email infrastructure have flagged this exact issue directly: opportunistic TLS is often enabled by default and creates a false sense of security, since it offers no guarantee that a given message, including one containing PHI, won’t be transmitted in plaintext if the recipient’s mail server doesn’t support encryption. Organizations assume they’re protected simply because TLS is technically “on,” without realizing it isn’t enforced.
That gap has real consequences under HIPAA. The Security Rule currently treats transmission encryption as an “addressable” safeguard, meaning covered entities can, in theory, implement an equivalent alternative measure instead. In practice, regulators and auditors from the Office for Civil Rights (OCR) expect enforced encryption as the standard of care. “Addressable” has never meant optional — it means an organization needs a documented, defensible reason if it isn’t doing enforced encryption, and few reasons hold up under scrutiny. Finally, under OCR’s proposed changes to the HIPAA Security Rule for ePHI, scheduled for final publication in July 2027, email encryption moves from addressable to mandatory.
Beyond the encryption gap, standard consumer and even most business email plans typically lack:
A BAA that’s actually offered and signed (available on some enterprise tiers, but not automatic)
Audit logging sufficient to meet HIPAA Security Rule requirements
Built-in encryption at rest guarantees for stored messages
None of this means Gmail or Microsoft 365 are inherently insecure products. It means their default configuration is built for general business use, not for an environment where every misrouted or intercepted message carries breach notification liability. Making either platform HIPAA-appropriate requires layering on additional tools, policies, and critically, a provider relationship that includes a signed BAA covering the exact services in use.
The Technical Components of Secure Email
Secure email is built upon five technical layers. Understanding each one, and where it fails in standard email, clarifies exactly what a compliant solution needs to deliver.
Encryption in Transit (TLS)
Transport Layer Security (TLS) encrypts the connection between mail servers as a message travels from sender to recipient. There are two flavors, and the difference between them is the crux of most healthcare email compliance failures:
Opportunistic TLS attempts an encrypted connection but falls back to unencrypted delivery if the receiving server doesn’t support it. This is the default across most consumer and business email platforms.
Enforced TLS requires an encrypted connection for delivery to succeed. If encryption can’t be established, the message fails to send rather than going out in plaintext, or a link to secure portal can be sent to securely access the information.
HIPAA’s Security Rule lists encryption as addressable, but enforced TLS has become the de facto standard that auditors and OCR expect from covered entities and business associates handling PHI over email. As one healthcare IT professional put it while debating this exact tradeoff internally: the goal is to require TLS for all outbound email and then document the remaining controls around it, treating enforced TLS as the technical baseline, with policy and process built on top.
Encryption at Rest
Transit encryption only protects a message while it’s moving. Once it lands on a mail server — sender’s outbox, recipient’s inbox, backups, archives — it needs to remain encrypted in storage. This is encryption at rest, and it’s where many organizations underestimate their exposure.
Encryption in transit alone offers zero control over a message after it’s been delivered. If the destination server isn’t itself encrypting stored data, or if a backup snapshot is taken without encryption, PHI sitting in an inbox is exposed regardless of how securely it arrived. HIPAA’s Security Rule requires safeguards for ePHI both in transit and at rest, a compliant secure email provider needs to guarantee both, not just one.
End-to-End Encryption (S/MIME, PGP)
End-to-end encryption (E2EE) encrypts message content itself, not just the connection it travels over — meaning even the email provider can’t read the content. Two standards dominate here:
S/MIME uses certificate-based encryption and is common in enterprise environments, such as healthcare, particularly where organizations already manage a public key infrastructure.
PGP (Pretty Good Privacy) uses a public/private key model and is more common in technical or security-conscious communities, though it’s less frequently deployed at scale in healthcare due to key management complexity.
E2EE isn’t a baseline requirement for every PHI-containing email, enforced TLS plus encryption at rest satisfies most use cases. But it becomes necessary for especially sensitive communications, cross-organization data sharing where you don’t control the recipient’s infrastructure, or when a business associate agreement specifically requires it.
Authentication (SPF, DKIM, DMARC)
These three protocols work together to prevent domain spoofing and email impersonation, a growing attack vector against healthcare organizations specifically, given how often phishing campaigns impersonate providers, payers, or patients.
SPF (Sender Policy Framework) specifies which mail servers are authorized to send email on behalf of a domain.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature verifying a message wasn’t altered in transit.
DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers what to do when SPF or DKIM checks fail, and provides reporting visibility.
Without these configured correctly, an organization’s domain can be spoofed to send convincing phishing emails to patients or staff, creating a security failure that compounds the compliance risk of email interception.
Digital Signatures
Digital signatures verify sender identity and confirm a message hasn’t been tampered with between sending and receipt. Paired with encryption, they close the loop on message integrity, confirming not just that content was protected, but that it came from who it claims to have come from and arrived unaltered.
Standard Email vs. Secure Email: Feature Comparison
Feature
Standard Email
Secure Email (HIPAA-Compliant)
Encryption in Transit
Opportunistic TLS — attempted but not enforced
Enforced TLS — connection fails if encryption unavailable, can include delivery via secure portal option
Encryption at Rest
Not guaranteed; provider-dependent
Required — server-side encryption of stored messages
End-to-End Encryption
Not available
Supported via S/MIME and/or PGP
Digital Signatures
Not available
Included — verifies sender identity and message integrity
Authentication (SPF / DKIM / DMARC)
Optional, rarely enforced
Required — spoofing and impersonation protection
Business Associate Agreement (BAA)
Not provided on standard plans
Required — must be signed before sending PHI
Audit Logs
Basic or none
Full audit trail — required under HIPAA Security Rule
Access Controls
Basic password only
Role-based access, MFA, admin controls
Misdirected Email
Reportable HIPAA breach
Non-reportable if properly encrypted (safe harbor)
HIPAA Compliant by Default
No
Yes
What Makes Email HIPAA-Compliant Specifically
Technical safeguards alone don’t make email HIPAA-compliant. Compliance is a combination of technology, contracts, and documented processes — all four need to be in place simultaneously. This includes:
A signed BAA with your email provider – Any vendor that transmits, processes, or stores PHI on your behalf is a business associate under HIPAA, and business associates are legally required to sign a BAA before handling that data. Email providers have persistent access to ePHI — even end-to-end encrypted messages pass through their infrastructure at some point — which makes this requirement absolute, not situational. If a provider won’t sign a BAA, using them to send or store PHI isn’t a compliance risk you can mitigate; it’s a violation from the start.
Encryption as an addressable safeguard – Under 45 CFR §164.312(e)(2)(ii), the HIPAA Security Rule lists encryption of ePHI in transit as “addressable” rather than strictly “required.” In practice, this doesn’t mean optional, it means an organization must implement it, or document and justify an equivalent alternative safeguard. Enforced encryption has become the expected standard, and with the newly proposed HIPAA Security Rule planned for July 2027 publication, NPRM would formalize that expectation by making encryption of ePHI in transit and at rest mandatory rather than addressable. Organizations still relying on opportunistic TLS as their “equivalent alternative” should treat this as a closing window.
Access controls and audit logs – HIPAA requires the ability to track who accessed PHI, when, and what they did with it. This means role-based access permissions, multi-factor authentication, and a complete, retained audit trail — not just for compliance reporting, but for identifying and responding to incidents quickly.
The encryption safe harbor – This is one of the most consequential, and most underused, provisions in HIPAA. If PHI is sent via properly encrypted email and ends up misdirected to the wrong recipient, it is not a reportable breach under the Breach Notification Rule, because the encrypted content is considered unreadable and therefore not “unsecured PHI.” The exact same misdirection with unencrypted email is a reportable breach, triggering notification obligations to the individual and to HHS/OCR. Encryption isn’t just a security best practice here, it’s the line between a non-event and a formal breach investigation.
HITRUST certification as a trust signal – When evaluating vendors, HITRUST CSF certification is a strong external indicator that a provider’s security controls have been independently assessed against a recognized healthcare-specific framework. It’s not a HIPAA requirement in itself, but it meaningfully reduces the diligence burden on your side when vetting a provider.
Types of Healthcare Email That Must Be Secure
Not all internal debate here is about “should we secure email” — it’s about scope. Which specific email flows actually carry PHI, and therefore need to run through a compliant channel? In practice, the answer is broader than most teams initially assume.
The common thread: if a message references anything that could identify a patient in connection with health information — a name next to a diagnosis, an account number tied to a service date, an annual test reminder — it needs to move through a secure channel, regardless of whether it’s clinical, financial, or administrative in nature.
How to Evaluate a Secure Email Provider for Healthcare
Vendor evaluation in this category tends to go one of two ways: teams either take a provider’s “HIPAA-compliant” label at face value, or they get buried in RFP questions without knowing which answers actually matter. Ask these key questiosn to focus the evaluation on what’s operationally and legally significant.
“Does the provider sign a BAA? This is the first filter, not the last. If a vendor won’t sign a BAA — or offers a heavily limited one — everything else is irrelevant. Some organizations go a step further and negotiate indemnity or make-whole clauses into the BAA itself, seeking financial protection beyond the baseline liability allocation.
What encryption methods are supported? Confirm specifically whether the provider offers TLS only, or also supports S/MIME and/or PGP for end-to-end encryption where needed. TLS-only coverage is sufficient for most standard PHI communication; organizations with cross-border data sharing or especially sensitive use cases may need E2EE options available.
Is encryption enforced or opportunistic? This is the single most important technical question to ask directly, in those terms. A vendor that describes its encryption vaguely, without distinguishing enforced from opportunistic delivery, hasn’t answered the question. Push for specifics.
How are large attachments handled? Lab results, imaging files, and clinical documents often exceed standard attachment size limits. Confirm the provider has a secure, compliant method for large file transfer that doesn’t force users onto an unencrypted workaround.
What audit logging and reporting capabilities exist? You need visibility into delivery, access, and any failed encryption attempts, not just a generic sent/received log. Ask whether logs are retained for a period consistent with your organization’s HIPAA documentation requirements.
Do they support high-volume transactional email? Appointment reminders, billing notices, and patient communications at scale require infrastructure built for volume without sacrificing per-message compliance. Confirm the provider’s platform is built for this your specific pattern, not just person-to-person messaging.
Is the platform US-based with US data residency? For many healthcare organizations, where data physically resides — and under which jurisdiction — is a material factor in vendor risk assessment, particularly for payers and larger provider organizations with strict data governance policies.”
One operational factor worth weighing alongside these questions: secure email portals — the kind that require recipients to click through to a separate web page to read a message — solve the encryption problem but often create a real adoption problem. IT teams have reported a direct conflict between phishing-awareness training and portal-based workflows: staff and patients trained not to click suspicious links in emails are, understandably, reluctant to click the “secure link” a portal email contains. This is a legitimate reason many organizations increasingly prefer platforms that enforce encryption transparently in the background — like LuxSci’s SecureLine encryption technology — rather than routing every message through a separate portal experience.
Secure Email Checklist for Healthcare Organizations
Every safeguard covered in this guide comes down to a handful of concrete, verifiable actions. Use the checklist below as a working reference for what needs to be in place across your legal agreements, technical controls, and internal processes. This is not a one-time setup task, but something worth revisiting as your email volume, vendors, and regulations evolve. Share it across your compliance and IT teams as a starting point for an internal audit.
Legal and Contractual – BAA signed with email provider and all third-party vendors handling PHI.
Encryption – Forced TLS, not opportunistic only for emails in transit and all stored data encrypted with AES-256 bit encryption.
Access and Audit – Unique user IDs, role-based access, and login monitoring with advanced MFA enabled for all email accounts; audit logs active and maintained.
People and Processes – Staff trained in PHI handling, established breach response plan, annual email security policy review.
What Should I Do Now?
Secure email isn’t a single setting you switch on — it’s a combination of enforced encryption, a signed BAA, access controls, and documented process working together. Get any one piece wrong, and the rest doesn’t hold up under an OCR audit or a breach investigation.
If your organization is still relying on opportunistic TLS, an unsigned or incomplete BAA, or a patchwork of workarounds to move PHI through email, now is the time to close that gap, especially with the proposed 2025 HIPAA Security Rule update poised to make encryption a mandatory requirement rather than an addressable one in 2027.
Below are three ways you can continue your journey to securing your healthcare email:
Email can be HIPAA compliant, but only when the right safeguards are in place — enforced encryption, a signed BAA with your email provider, access controls, audit logs, and staff training on PHI handling. Standard email without these safeguards is not compliant.
2. Do I need to sign a BAA with my email provider?
Yes. Email providers have persistent access to ePHI — even encrypted messages pass through their servers — making them Business Associates under HIPAA. A signed BAA is required. If your provider won’t sign one, you cannot legally use them to send or store PHI.
3. What is the difference between opportunistic TLS and enforced TLS — and which does HIPAA require?
Opportunistic TLS attempts encryption but falls back to plaintext if the recipient’s server doesn’t support it. Enforced TLS stops delivery rather than sending unencrypted. HIPAA’s Security Rule treats transmission encryption as an addressable specification, in practice, enforced TLS is the standard auditors and OCR expect. The proposed 2025 HIPAA Security Rule NPRM would make encryption of ePHI in transit a mandatory requirement in 2027.
4. What happens if I send PHI in an unencrypted email?
It is an impermissible disclosure under HIPAA’s Privacy Rule and triggers the Breach Notification Rule, requiring you to notify the individual and HHS/OCR within 60 days. Penalties range from $100 to $50,000 per violation. Had the email been properly encrypted, the same incident would qualify for HIPAA’s encryption safe harbor, meaning no notification required.
5. Is Gmail or Microsoft 365 HIPAA compliant for sending patient emails?
Neither is compliant in their default configuration. Both use opportunistic TLS, meaning PHI can be sent in plaintext if the recipient’s server doesn’t support encryption. A signed BAA is available on enterprise plans but doesn’t close the technical gap alone. A purpose-built HIPAA-compliant email platform is the reliable solution.
If you’ve been waiting for the final word on the new HIPAA Security Rule before you touch your email encryption strategy, you now have an official reason to keep waiting.
Our advice: Don’t do it.
What is the new HIPAA Security Rule for ePHI?
The Department of Health and Human Services’ Office for Civil Rights had targeted May 2026 for a final rule implementing the most significant update to the HIPAA Security Rule in over two decades. The proposal eliminates the “addressable” standard and makes encryption of ePHI in transit and at rest mandatory for every covered entity and business associate. That deadline came and went quietly. Now we know why: an updated federal regulatory agenda shows OCR’s timeline has moved to July 2027, with the rule-making downgraded from “final rule stage” to “long-term action.” OCR is still working through more than 4,700 public comments on the January 2025 proposal.
For an industry that had been expecting a tighter deadline, a year-plus delay is the kind of news that invites a collective exhale — and a shelved project plan. At LuxSci, we think that would be a mistake, for three reasons:
The current rule already requires you to address encryption. “Addressable” was never “optional.” It has always meant you must implement the safeguard, implement an equivalent alternative, or document in writing why neither is reasonable for your organization. Most healthcare organizations have never done that documentation rigorously, and OCR’s existing enforcement authority applies today, not in 2027.
Breach costs haven’t waited for the rule.IBM’s 2025 Cost of a Data Breach Report puts the average healthcare breach at $7.42 million, still the highest of any industry. At the same time, email remains the number one attack vector into healthcare organizations. None of that risk is paused by a regulatory delay.
Delay is not withdrawal.OCR has not signaled it’s abandoning the encryption mandate, only that it’s taking longer to finalize it. Organizations that build now toward the standard already proposed will be ahead (and more secure) regardless of exactly when, or in what final form, the rule lands. Organizations that wait risk a compressed scramble once it does.
What should healthcare IT and compliance leaders actually do with this news?
Reevaluate your ePHI security posture, recalibrate its urgency, and use the extra runway to do the job right, instead of racing against a deadline. This includes:
Getting a real inventory of where ePHI moves by email today, inbound and outbound, and where encryption is inconsistent or absent.
Closing the documentation gap on “addressable” now, while you have time to do it well rather than defensively.
Pushing your email vendor for concrete answers on encryption standards, MFA enforcement, audit logging, and breach notification — the same technical controls the proposed rule would make mandatory.
Building (or updating) a written, enforcement-ready posture: policies, vendor agreements, certifications and verifications, test results, and training records that would hold up under an OCR investigation today, not just in a future compliance deadline.
Get LuxSci’s new Definitive Guide on the new HIPAA Security Rule
From Addressable to Mandatory: Email Encryption Under the New HIPAA Security Rule provides the latest update on the rule, what it means for healthcare email encryption, and what you can do now to properly prepare for what’s coming in 2027. The guide also includes an interactive scorecard that lets you evaluate your current email set up and vendor across seven security and compliance dimensions in under two minutes, no email address required.
If you want a second set of eyes on where your organization stands, our team offers a free 30-minute compliance assessment of your current email environment against the proposed rule’s requirements.
HIPAA email marketing involves digital promotional communications sent by healthcare organizations that must comply with federal privacy regulations when using Protected Health Information (PHI) to reach patients and prospects. Healthcare providers can engage in email marketing activities, but they encounter strict limitations when using patient contact information obtained through clinical encounters or when targeting recipients based on health conditions. The HIPAA Privacy Rule requires written authorization for most email marketing that involves individually identifiable health information, while permitting certain treatment-related communications and health plan activities without patient consent.
Healthcare organizations increasingly rely on email communication to reach patients efficiently while managing costs and improving engagement. Carrying out effective digital marketing while adhering to privacy compliance requires understanding when authorization is needed and how to implement compliant email marketing strategies.
Why Healthcare Organizations Use Email Marketing
Cost efficiency drives healthcare email marketing adoption as organizations seek affordable ways to communicate with large patient populations. Email campaigns cost significantly less than direct mail, print advertising, or telephone outreach while providing measurable engagement metrics. Healthcare systems can reach thousands of patients instantly with preventive care reminders, health education materials, or service announcements at minimal expense per recipient.
Patient engagement improves through targeted email communications that provide relevant health information and service updates. Email marketing allows healthcare organizations to segment audiences based on demographics, health interests, or service utilization patterns. Personalized email content generates higher open rates and click-through rates than generic mass communications, leading to better patient response and participation in health programs.
Competitive positioning requires healthcare organizations to maintain visibility in patient inboxes alongside other service providers and health information sources. Patients receive numerous health-related emails from insurance companies, pharmaceutical manufacturers, wellness apps, and other healthcare entities. Organizations that do not engage in compliant email marketing may lose mindshare and patient loyalty to more communicative competitors.
Revenue generation opportunities emerge from email marketing campaigns that promote elective services, wellness programs, or expanded care offerings. Healthcare organizations can use email to announce new service lines, highlight specialist capabilities, or educate patients about treatment options. Revenue-generating email marketing requires careful attention to HIPAA authorization requirements to avoid compliance violations.
Healthcare Emails Requiring Patient Authorization
Promotional emails for elective services or non-treatment programs require written patient authorization when using contact information obtained through clinical encounters. Healthcare organizations cannot email patients about cosmetic procedures, weight loss programs, or wellness services without explicit consent, even when using their own patient databases. The authorization must specifically address email marketing and describe the types of services being promoted.
Third-party product promotions sent via email require patient authorization regardless of the healthcare organization’s relationship with the product manufacturer. Organizations cannot send emails promoting pharmaceutical products, medical devices, or health-related consumer goods without written patient consent.
Targeted health campaigns that use diagnostic or treatment information to select email recipients require authorization under HIPAA marketing rules. Healthcare organizations cannot send diabetes management emails to patients with diabetes diagnoses or cardiac health information to patients with heart conditions without written permission. The targeting based on health status distinguishes these campaigns from general health education communications.
Social event invitations and fundraising appeals sent via email may require authorization depending on how recipient lists are compiled and whether health information influences targeting decisions. Healthcare organizations can send general fundraising emails to broad patient populations but need authorization when targeting based on specific conditions, treatments, or service utilization patterns.
HIPAA Compliant Treatment-Related Emails
Appointment communications qualify as treatment-related emails that do not require marketing authorization under HIPAA regulations. Healthcare organizations can send appointment confirmations, reminders, and rescheduling notices without patient consent because these communications support ongoing care relationships. Follow-up appointment scheduling and routine care reminders also fall under permissible treatment communications.
Care coordination emails between healthcare providers remain exempt from marketing restrictions when they facilitate patient treatment. Primary care physicians can email specialists about patient referrals, and care teams can coordinate treatment plans via email without authorization requirements. The communications must relate directly to patient care rather than promoting additional services or programs.
Health education materials related to conditions that patients are receiving treatment for do not require marketing authorization. Healthcare organizations can email diabetes management tips to diabetic patients currently receiving care or send cardiac rehabilitation information to patients enrolled in cardiac programs. The education must relate to active treatment relationships rather than general health promotion.
Prescription and laboratory result communications via email support treatment activities and do not trigger marketing restrictions. Healthcare organizations can notify patients about prescription readiness, laboratory result availability, or medication adherence reminders without written authorization. Patient portal notifications about available health information also qualify as treatment communications.
HIPAA Email Marketing Compliance Supports
Encryption protection is necessary for all email communications containing PHI, whether for treatment or marketing purposes. Healthcare organizations must implement appropriate safeguards to protect patient information during email transmission and storage. Email marketing platforms used by healthcare organizations need encryption capabilities and security controls that meet HIPAA Security Rule requirements.
Access controls within email marketing systems ensure that only authorized personnel can access patient contact information and send marketing communications. Role-based permissions limit which staff members can create marketing campaigns, access patient lists, or modify email content. Multi-factor authentication adds security layers that protect against unauthorized access to email marketing platforms containing patient data.
Audit logging capabilities track all activities within HIPAA email marketing systems to create compliance documentation. The systems must log campaign creation, email sends, list access, and user activities to provide audit trails for regulatory reviews. Automated reporting features help healthcare organizations monitor email marketing compliance and identify potential privacy violations.
Opt-out mechanisms are required for all healthcare email marketing communications to provide patients with control over future messaging. Unsubscribe processes must be easy to use and honor patient requests promptly to maintain compliance with both HIPAA and CAN-SPAM regulations. Email marketing systems need automated processing of opt-out requests and suppression list management capabilities.
Obtaining Valid Email Marketing Authorization
Authorization documents for email marketing must include specific elements required by HIPAA Privacy Rule regulations. The authorization must describe what patient information will be used, identify who will receive the information, and explain the purpose of the email marketing communications. Patients must understand their right to revoke authorization and any consequences of refusing to provide consent for marketing activities.
Timing considerations affect when healthcare organizations can request email marketing authorization from patients. Authorization requests should not be bundled with treatment consent forms or presented during medical emergencies when patients cannot provide informed consent. Organizations need separate processes for obtaining marketing authorization that do not interfere with treatment decisions or patient care activities.
Electronic signature capabilities allow healthcare organizations to collect email marketing authorization digitally while meeting HIPAA documentation requirements. Patient portal systems, website forms, or tablet-based signature capture can facilitate authorization collection. Electronic authorization systems must provide adequate authentication and maintain signed documents for audit purposes.
Renewal procedures help healthcare organizations maintain current authorization for ongoing email marketing campaigns. Authorization documents should specify expiration dates or renewal requirements to ensure patient consent remains valid. Entities need systems to track authorization status and remove patients from marketing lists when consent expires or is revoked.
List management complexity creates compliance risks when healthcare organizations use multiple sources of patient contact information for email marketing. Patient lists derived from treatment encounters require different handling than lists compiled from website registrations or health screenings. Organizations need clear policies about which lists can be used for marketing purposes and which require patient authorization.
Content classification challenges arise when determining whether specific email communications qualify as treatment-related or marketing activities. Healthcare organizations may struggle to distinguish between educational content that supports treatment and promotional content that requires authorization. Legal review processes help organizations evaluate email content and determine appropriate compliance requirements.
Vendor management issues emerge when healthcare organizations use third-party email marketing platforms that may not understand healthcare compliance requirements. Marketing vendors need Business Associate Agreements and must implement appropriate safeguards to protect patient information. Organizations remain responsible for vendor compliance with HIPAA requirements even when using external email marketing services.
Cross-platform integration difficulties occur when healthcare organizations attempt to coordinate email marketing with other communication channels or healthcare systems. Patient authorization status must be synchronized across email platforms, patient portals, and electronic health record systems. Data synchronization challenges can create compliance gaps or duplicate communication efforts that frustrate patients and waste resources.
The Health Insurance Portability and Accountability Act (HIPAA) is a complicated law that defines the standards for the secure collection, transmission, and storage of protected health information (PHI). When information is stored or exchanged electronically, the HIPAA Security and Privacy Rules require covered entities, i.e., organizations that handle PHI, to safeguard its integrity and confidentiality.
One of the most common ways that PHI is shared electronically is via email, so understanding HIPAA email rules is essential for achieving compliance and protecting sensitive data.
The HIPAA Email Security Rule
It’s important to note that HIPAA does not require the use of any specific technology or vendor to meet its requirements. Generally speaking, the Security Rule requirements for email fall into four categories:
Organizational requirements state the specific functions a covered entity must perform, including implementing policies, procedures and obligations concerning business associate agreements (BAAs).
Administrative requirements relate to employee training, professional development, and management of PHI.
Physical safeguards encompass the security of computer systems, servers, and networks, access to the facility and workstations, data backup and storage, and the destruction of obsolete data and HIPAA email archiving.
Technical safeguards ensure the security of email data transmitted over an open electronic network and the storage of that data.
Let’s move on to discussing some of the main requirements that apply to email and the steps you need to take to secure email accounts that transmit and store PHI.
HIPAA Email Rules: Compliance Checklist
While encryption gets most of the spotlight during discussions on email security, the HIPAA email rules, in contrast, cover a range of behaviors, controls, and services that work together to address eight key areas:
Access
Encryption
Backups and Archival
Defense
Authorization
Reporting
Reviews and Policies
Vendor Management
Let’s look at each aspect of HIPPA’s email rules in greater detail.
1. Access
Access controls help safeguard access to your email accounts and messages. Implementing access controls is essential to keep out unauthorized users and secure your data, with key steps including:
Using strong passwords that cannot be easily guessed or memorized – and changing them frequently, e.g. every 30 days.
Creating different passwords for different sites and applications.
Enabling multi-factor authentication (MFA).
Securing connections to your email service provider using TLS and a VPN.
Blocking unencrypted connections.
Pre-emptively installing software that remotely wipes sensitive email off your mobile device when it is stolen or misplaced.
Logging off from your system when it is not in use and when employees are away from workstations.
Emphasizing opt-out email encryption to minimize breaches resulting from human error.
2. Encryption
Email is inherently insecure and at risk of being read, stolen, intercepted, modified, and forged (repudiated). Covered entities should go beyond the technical safeguards of the HIPAA Security Rule and take steps that exceed what is required to futureproof their communications. Email encryption features to adopt include the following:
The ability to send secure messages to anyone with any email address.
The ability to receive secure messages from anyone.
Implementing measures to prevent the insecure transmission of sensitive data via email.
Exploring message retraction features to retrieve email messages sent to the wrong address.
Avoiding opt-in encryption to satisfy HIPAA Omnibus Rule.
3. Backups and Archival
HIPAA email rules require copies of messages containing PHI to be retained for at least six years. In light of this, organizations must consider the following:
How are email folders backed up?
Are there at least two different backups at two different geographical locations? Additionally, the processes updating these backups should be independent of each other as a measure against backup system failures.
Have you maintained separate, permanent, and searchable archives? While the emails should be tamper-proof, with no way to delete or edit them, they should be easily retrievable to facilitate discovery, comply with audit requests, and support business-critical scenarios.
4. Defense
Cyber threats against healthcare organizations are continually on the increase. Some may be surprised to learn that HIPAA compliant email rules mandate that organizations take steps to defend against possible malicious actors. With this in mind, consider implementing the following technologies:
Server-side inbound email malware and anti-virus scanning to detect phishing messages and malicious links.
Showing the sender’s email address by default on received messages.
Email filtering software to detect fraudulent messages and ensure it uses Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC) information to classify messages.
Scanning outbound email.
Scanning workstations for malware, i.e., viruses, ransomware, etc.
Using plain text previews of your messages.
5. Authorization
A critical aspect of HIPAA’s email rules is ensuring that cybercriminals cannot impersonate your company or employees. Configuring your domains with SPF and DKIM is essential to verify your identity as an authorized sender of mail from your domains. Also, ensure that users cannot send messages through your email servers without authentication and encryption.
6. Reporting
Setting accountability standards for email security is essential to establishing and strengthening your HIPAA compliance posture. Important steps to take include:
Creating login audit trails.
Receiving login failure and success alerts.
Auto-blocking known attackers.
Maintaining a log of all sent messages.
7. Reviews and Policies
Humans are the greatest vulnerability to any security and compliance plan, so creating policies and procedures that focus on plugging vulnerabilities and preventing human errors is essential. Strategies for reducing risk include:
Inviting independent third parties to review your email policies and user settings. Fresh, unbiased eyes can discover existing issues quickly.
Preventing devices that connect to sensitive email accounts from connecting to public WiFi networks.
Creating email policies prohibiting users from clicking on links or opening attachments that are not expected or requested.
8. Vendor Management
Most companies do not manage their email in-house, so it’s crucial to thoroughly research and vet whoever will be responsible for your email services. Perform an annual review of your email security and stay on top of emerging cybersecurity threats to take proactive action and for continued compliance with HIPAA email rules.
LuxSci’s secure high-volume email and marketing solutions are designed to help healthcare organizations tackle complicated HIPAA email rules and automate the compliance process. Contact us today to learn more about how our industry-leading HIPAA complaint email services can help you better secure your customer PHI and keep you in compliance.
Secure email sending is a priority for organizations that communicate sensitive data externally. One of the most common ways to send secure emails is with SMTP TLS. TLS stands for Transport Layer Security and is the successor of SSL (Secure Socket Layer). TLS is one of the standard ways that computers on the internet transmit information over an encrypted channel. In general, when one computer connects to another computer and uses TLS, the following happens:
Computer A connects to Computer B (no security)
Computer B says “Hello” (no security)
Computer A says, “Let’s talk securely over TLS” (no security)
Computers A and B agree on how to do this (secure)
The rest of the conversation is encrypted (secure)
In particular:
The conversation is encrypted
Computer A can verify the identity of Computer B (by examining its SSL certificate, which is required for this dialog)
The conversation cannot be eavesdropped upon (without Computer A knowing)
A third party cannot modify the conversation
Third parties cannot inject other information into the conversation.
TLS and SSL help make the internet a more secure place. One popular way to use TLS is to secure SMTP to protect the transmission of email messages between servers.
Secure SMTP Email Delivery with TLS
The mechanism and language by which one email server transmits email messages to another email server is called Simple Mail Transport Protocol, or SMTP. For a long time, email servers have had the option of using TLS to transparently encrypt the message transmission from one server to another.
When available, using TLS with SMTP ensures the message contents are secured during transmission between the servers. Unfortunately, not all servers support TLS! Many email providers, especially free or public ones, have historically not supported TLS. Thankfully, the trend is shifting. LuxSci found that most providers now support TLS- approximately 85% of domains tested as of July 2022.
Using TLS requires that the server administrators:
purchase SSL certificates
configure the email servers to use them (and keep these configurations updated)
allocate additional computational resources on the email servers involved.
For TLS transmission to be used, the destination email server must offer support for TLS, and the sending computer or server must be configured to use TLS connections when possible.
The sending computer or server could be configured for:
No TLS: never use it.
Opportunistic TLS: use it if available; if not, send it insecurely.
Forced TLS: use TLS or do not deliver the email at all.
How Secure is Email Delivery over SMTP TLS?
TLS protects the transmission of the email message contents. It does nothing to protect the security of the message before it is sent or after it arrives at its destination. For that, other encryption mechanisms may be used, such as PGP, S/MIME, or storage in a secure portal.
For sending sensitive information to customers, transmission security is the minimum standard for compliance with healthcare and financial regulations. TLS is appropriate to meet most compliance requirements and offers an excellent alternative to more robust and less user-friendly encryption methods (like PGP and S/MIME).
There are different versions of TLS- 1.0 and 1.1 use older ciphers and are not as secure, while TLS 1.2 and 1.3 use newer ciphers and are more secure. When an email is sent, the level of TLS used is as secure as can be negotiated between the sending and receiving servers. If they both support strong encryption (like AES 256), then that will be used. If not, a weaker grade of encryption may be used. The sending and receiving servers can choose the types of encryption they will support. If there is no overlap in what they support, then TLS will fail (this is rare).
What About Replies to Secure Messages?
Let’s say you send a message to someone that is securely delivered to their inbox over TLS. Then, that person replies to you. Will that reply be secure? This may be important if you are communicating sensitive information. The reply will use TLS only if:
The recipient’s servers support TLS for outbound email (there is no way to test this externally).
The mail servers (where the “From” or “Reply” email address is hosted) support TLS for inbound email.
Both servers support overlapping TLS ciphers and protocols and can agree on a mutually acceptable means of encryption.
Unless familiar with the providers in question, it cannot be assumed that replies will use TLS. So, what should you do? Ultimately, it depends on what compliance standards you must meet, the level of risk you are willing to accept, and the types of communications you send. There are two general approaches to this question:
Conservative. If replies must be secure in all cases, assuming TLS will be used is unreasonable. In this case, a more secure method should be used to encrypt the messages in transit and store them upon arrival. The recipient must log in to a secure portal to view the message and reply securely. Alternatively, PGP or S/MIME could be used for additional security.
Aggressive. In some compliance situations like HIPAA, healthcare providers must ensure that ePHI is sent securely to patients. However, patients are not beholden to HIPAA and can send their information insecurely to anyone they want. If the patient’s reply is insecure, that could be okay. For these reasons, and because using TLS for email security is so easy, many do not worry about the security of email replies. However, this should be a risk factor you consider in an internal security audit. Consider nuanced policies that allow you to send less sensitive messages with TLS while sending more sensitive messages with higher security.
What are the Weaknesses of SMTP TLS?
As discussed, SMTP TLS has been around for a long time and has recently seen a great deal of adoption. However, it has some deficiencies compared to other types of email security:
There is no mandatory support for TLS in the email system.
A receiver’s support of the SMTP TLS option can be trivially removed by an active man-in-the-middle because TLS certificates are not actively verified.
Encryption is not used if any aspect of the TLS negotiation is undecipherable/garbled. It is very easy for a man-in-the-middle to inject garbage into the TLS handshake (which is done in clear text) and have the connection downgraded to plain text (opportunistic TLS) or have the connection fail (forced TLS).
Even when SMTP TLS is offered and accepted, the certificate presented during the TLS handshake is usually not checked to see if it is for the expected domain and unexpired. Most MTAs offer self-signed certificates as a pro forma. Thus, in many cases, one has an encrypted channel to an unauthenticated MTA, which can only prevent passive eavesdropping.
The Latest Updates to Secure SMTP TLS
Some solutions help remedy these issues—for example, SMTP Strict Transport Security. SMTP STS enables recipient servers to publish information about their SMTP TLS support in their DNS. This prevents man-in-the-middle downgrades to plain text delivery, ensures more robust TLS protocols are used, and can enable certificate validation.
In addition, users can adopt TLS 1.3. NIST recommends that government agencies develop migration plans to support TLS 1.3 by January 1, 2024. LuxSci supports both SMTP MTA-STS and TLS 1.3.
How Secure SMTP TLS Email Works with LuxSci
Inbound TLS
LuxSci’s inbound email servers support TLS for encrypted inbound email delivery from any sending email provider that also supports that. For selected organizations, LuxSci also locks down its servers to only accept email from them if delivered over TLS.
Outbound Opportunistic TLS
LuxSci’s outbound email servers will always use TLS with any server that claims to support it and with whom we can talk TLS v1.0+ using a strong cipher. The message will not be sent securely if the TLS connection to such a server fails (due to misconfiguration or no security protocols in common). Outbound opportunistic TLS encryption is automatic for all LuxSci customers, even those without SecureLine.
Forced TLS
When Forced TLS is enabled, the message is either dropped or sent with an alternate form of encryption if the recipient’s server does not support TLS. This ensures that messages will never be sent insecurely. Forced TLS is also in place for all LuxSci customers sending to banks and organizations that have requested that we globally enforce TLS to their servers.
Support for strong encryption
LuxSci’s servers will use the strongest encryption supported by the recipient’s email server. LuxSci servers will never employ an encryption cipher that uses less than 128 bits (they will fail to deliver rather than deliver via an excessively weak encryption cipher), and they will never use SSL v2 or SSL v3.
Does LuxSci Have Any Other Special TLS Features?
When using LuxSci SecureLine for outbound email encryption:
SMTP MTA STS: LuxSci’s domains support SMTP MTA STS, and LuxSci’s SecureLine encryption system leverages STS information about recipient domains to improve connection security.
Try TLS: Account administrators can have secure messages “try TLS first” and deliver that way. If TLS is unavailable, the messages would fall back and use more secure options likePGP, S/MIME, or Escrow. Email security iseasy, seamless, and automatic when communicating internally or with others who support TLS.
TLS Exclusive: This is a special LuxSci-exclusive TLS sending feature. TLS Exclusive is just like Forced TLS, except that messages that can’t connect over TLS are just dropped. This is ideal for low-importance emails that must still be compliant, like email marketing messages in healthcare. In such cases, the ease of use of TLS is more important than receiving the message.
TLS Only Forwarding: Account administrators can restrict any server-side email forwarding settings in their accounts from allowing forwarding to any email addresses that do not support TLS for email delivery.
Encryption Escalation: Often, TLS is suitable for most messages, but some messages need to be encrypted using something stronger. LuxSci allows users to escalate the encryption from TLS to Escrow with a click (in WebMail) or by entering particular text in the subject line (for messages sent from email programs like Outlook).
Domain Monitoring: When TLS delivery is enabled for SecureLine accounts, messages will never be insecurely sent to domains that purport to be TLS-enabled, i.e., TLS delivery is enforced and no longer “opportunistic.” The system monitors these domains and updates their TLS-compliance status daily.
Double Encryption: Messages sent using SecureLine and PGP or S/MIME will still use Opportunistic TLS whenever possible for message delivery. In these cases, messages are often “double encrypted.” First, they are encrypted with PGP or S/MIME and may be encrypted again during transport using TLS.
No Weak TLS: Unlike many organizations, LuxSci’s TLS support for SMTP and other servers only supports those protocol levels (e.g., TLS v1.0+) and ciphers recommended by NIST for government communications and which are required for HIPAA. So, all communications with LuxSci servers will be over a compliant implementation of TLS.
For customers who can use TLS to meet security or compliance requirements, it enables seamless security and “use of email as usual.” SecureLine with Forced TLS enables clients to take advantage of this level of security whenever possible while automatically falling back to other methods when TLS is unavailable.
Of course, using Forced TLS as the sole method of encryption is optional; if your compliance needs are more substantial, you can turn off TLS-Only delivery or restrict it so that it is used only with specific recipients.
If your email use cases are complicated, LuxSci’s flexibility enables the secure sending of emails to any recipient, regardless of their email service provider’s support for TLS. Contact the LuxSci sales team to learn more about our secure SMTP TLS email sending.
For years, healthcare organizations have relied on click-to-encrypt email workflows and secure portals as a practical compromise between usability and compliance. Or in some cases, they simply thought most of their emails did not need to be compliant. In regulated industries where data security and privacy are paramount, this approach was still considered “good enough.”
That era is ending.
As we progress into 2026 and beyond, regulators, auditors, and cyber insurers are sending a clear and consistent message: encryption that depends on human choice is no longer acceptable. It’s already happening. Encryption optional email isn’t merely raising concerns, it’s failing audits outright.
An Email Threat Landscape That’s Changing Faster Than Email Habits
Historically, email encryption was treated as a best practice rather than a hard requirement. If an organization could demonstrate that encryption tools existed and that employees had access to them, auditors were often satisfied. The box was checked, everybody moved on.
Today, the questions auditors ask are fundamentally different. Instead of asking whether encryption is available, they are asking whether sensitive data can ever leave the organization unencrypted. If the answer is yes, even in rare cases, or even accidentally, that’s no longer viewed as an acceptable gap. It’s viewed as inadequate control.
Why 2026 Is a Tipping Point for Email Security
Several forces are converging here in 2026 that make optional encryption increasingly untenable. Regulatory scrutiny around PHI and PII exposure continues to intensify. Breach costs and litigation are rising, with email remaining one of the most common vectors for data exposure and breaches. AI is also changing the game for cybercriminals, and attacks will continue to increase and be more sophisticated. As a result, cyber insurers are tightening underwriting requirements and demanding stronger, more predictable controls.
At the same time, email user behavior is unpredictable and inconsistent, which is a non-starter for data security in today’s world.
Taken together, these trends and behaviors point to a single requirement: email security controls must be automated. They must be enforced by systems, not dependent on employee memory, judgment, or good intentions.
The Reality of “Encryption Optional” in Practice
On paper, optional encryption can sound reasonable. In practice, it creates gaps large enough to open you up to a breach.
Secure portals are a good example. They require recipients to click a link, authenticate, and access content in a controlled environment. While this protects data in transit, and is a better approach than no security at all, it also introduces friction. And people don’t like friction. Senders forget to use the portal. Recipients ask for “just a quick email instead.” Shortcuts are taken to save time. And every shortcut becomes a risk.
Click-to-encrypt systems suffer from a similar problem. They rely on users to correctly identify sensitive data and remember to take action. But people often misclassify information, forget to click the button, or assume someone else has already secured the message. From an auditor’s perspective, this isn’t a training failure. It’s a set-up and control failure.
Email Security Defaults Are the New Normal
The latest message from regulators, auditors, and insurers is clear. If encryption is optional, data vulnerabilities become inevitable.
What can you do?
Below is a quick email security checklist to help you get started. Cyber insurers may require or recommend the following safeguards during the underwriting process, such as:
Multi-factor authentication (MFA)
Endpoint protection
Encrypted backups
Incident response planning
Encryption protocols for sensitive data in transit and at rest, including PHI in emails
In 2026 and beyond, healthcare organizations and regulated industries will be judged not by what they allow, but by what they prevent. Automated, encrypted email is the new. normal.
