" email encryption Archives - LuxSci

Posts Tagged ‘email encryption’

Opportunistic TLS vs Forced TLS for SMTP

Tuesday, January 23rd, 2024

Email sometimes seems like magic because of how quickly messages are transmitted across the internet. While the rapid delivery speeds justify this presumption, a lot must happen for an email to reach you. Email sending relies on a protocol called the Simple Mail Transfer Protocol (SMTP) to make its way across the internet to your recipient’s server. From there, the recipient uses another protocol, such as ActiveSync, POP3, MAPI, IMAP, or a Web-based interface, to pick it up and read it.


Unfortunately, these protocols aren’t always secure by default. Under its original design, emails are sent as plain text. Anyone along the email’s journey can see (and even change) their contents. This can include those in charge of the servers, the government, and even hackers that intercept the data.


Thankfully, engineers are aware of this glaring security hole, and they have introduced several mechanisms that can be leveraged to protect email. This article reviews how SMTP TLS works and the differences between opportunistic TLS and forced TLS.


secure email sending on laptop

Read the rest of this post »

Is the Email Encrypted? How to Tell if an Email is Transmitted Using TLS

Tuesday, January 9th, 2024

SMTP TLS encryption is popular because it provides adequate data protection without creating a complicated user experience for email recipients. Sometimes, though, the experience is too seamless, and recipients may wonder if the message was protected at all.

Luckily, there is a way to tell if an email was encrypted using TLS. To see if a message was sent securely, we can look at the raw headers of the email. However, it requires some knowledge and experience to understand the text. It is actually easier to tell if a recipient’s server supports TLS than to tell if a particular message was securely transmitted.

To analyze a message for transmission security, we will look at an example email message sent from Hotmail to LuxSci. We will explain what to look for when decoding the message headers and how to tell if the email was transmitted using TLS encryption.

encrypted email transmission

Read the rest of this post »

Are Replies to Encrypted Emails also Secure?

Tuesday, December 26th, 2023

Sending HIPAA-compliant emails is easy when you use an encryption solution like LuxSci. But what happens when someone replies to an encrypted message? Are the replies also secure? This is primarily a concern when using SMTP TLS as a secure means of email delivery. 

This article will explain how messages are sent securely, how replies behave, and whether they are secure and compliant. At the end, we provide some recommendations for how to balance security and usability. 

Read the rest of this post »

Send Secure Emails: Alternatives to Web Portals

Tuesday, December 5th, 2023

Digital technologies have entirely shifted how individuals want to interact with their healthcare providers. As consumers have become used to emailing or texting with their hairstylists, mechanics, and other providers to schedule appointments, they want to have the same level of interaction with their healthcare providers.

However, many healthcare organizations find it challenging to deliver the same experience because of their compliance requirements under HIPAA. They must balance usability and access with security and patient privacy. To send secure emails, they often resort to secure web portals. 

Problems with Secure Web Portals

One of the most common ways that healthcare organizations communicate securely with patients is by using the secure web portal method of email encryption. In this scenario, messages are sent to a secure web server, and a notification is sent to the recipient, who then logs into the portal to retrieve the message.

While highly secure, this method is not popular with recipients because of the friction it creates.

To maintain a high level of security, users must log in to a separate account to retrieve the message. This extra step creates a barrier, especially for individuals who are not tech-savvy. In addition to creating a new account, they must remember a different username and password to access their secure messages. If the recipient doesn’t have this information readily available, they will likely delete the message and move on with their day. Many users will never bother logging in because of the inconvenience. This creates issues for organizations that want to use email for standard business communications and patient engagement efforts. 

While this method may be appropriate for sending highly sensitive information like medical records, financial documents, and other valuable information, many emails that must meet compliance requirements only infer sensitive information and do not require such a high level of security. Flu shot reminder emails are not as sensitive or potentially devastating as sending the wrong medical file to someone. Healthcare organizations need to use secure email solutions that are flexible enough to send only the most sensitive emails to the portal and less sensitive emails using other methods.

How to Meet Compliance Requirements for Sending Secure Email

So, what other options do you have for sending secure emails? The answer will depend on what specific requirements you need to meet. Healthcare organizations that must abide by HIPAA regulations will find a lot of flexibility regarding the technologies they can use to protect ePHI in transit.

In addition to a secure web portal, three other types of encryption are suitable for email sending: TLS, PGP, and S/MIME. PGP and S/MIME are more secure than a web portal. They also require advanced technological skills and coordination with the end-user to implement, which makes them impractical for most business email sending.

That leaves us with TLS, which is suitable to meet most compliance standards (including HIPAA) and delivers an email experience much like that of a “regular” email.

Send Secure Emails with TLS Encryption

TLS encryption is an excellent option for secure email sending that provides a seamless experience for the recipient. Emails sent securely with TLS appear like regular, unencrypted emails in the recipient’s inbox.

TLS encrypts the message contents as they travel between mail servers to prevent interception and eavesdropping. Once the message reaches the inbox, it is unencrypted and can be read by anyone with access to the email account. For this reason, it is less secure than a portal but secure enough to meet compliance requirements like HIPAA.

If you’re wondering why this is, HIPAA only requires covered entities and business associates to protect PHI when it is stored on their systems or as it is transmitted elsewhere. After the message reaches the recipient, it is up to the recipient to decide what they want to do to secure the information. HIPAA does not apply to individuals. Each person is entitled to share and store their health information however they see fit.


Balancing security and usability is a significant challenge for healthcare organizations. If the message is too secure, it may be difficult for the recipient to open and engage with it. If it’s not secure enough, it is too easy for cybercriminals and other bad actors to intercept private information as it is sent across the internet. 

Choosing an email provider like LuxSci, which offers flexible email encryption options, allows users to choose the right level of encryption for each message to maximize engagement and improve health outcomes. Contact our team today to learn more about how we can support your efforts.

Understanding the HIPAA Requirements for Email Encryption

Tuesday, November 28th, 2023

If you are in the healthcare field, you may have wondered what HIPAA’s exact requirements are regarding email encryption. Understandably, not many people are willing to read the 115 pages of the simplified regulation text, so the question often goes unanswered.

The good news is that we have parsed them for you. We’ve trawled through the long and arduous document to identify the HIPAA regulations concerning email encryption. We also conducted some analysis to help you figure out just how your organization can comply with these requirements.

person composing email

What Does HIPAA Say About Email Encryption?

There are a few different segments of the HIPAA Security Rule that apply to email encryption. The first one we will discuss is section 164.306 Security Standards.

Security Standards for HIPAA Email Encryption

The general requirements state that covered entities and business associates must do the following:

  1. Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.
  2. Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.
  3. Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part.
  4. Ensure compliance with this subpart by its workforce.

Let’s unpack some of these terms to understand how they apply to your obligations under HIPAA.

  • Covered entity – As a simplification, a covered entity is any healthcare-related organization dealing with protected health data.
  • Business associate – A business associate (BA) is a person or organization with which a covered entity shares electronic protected health information (ePHI). This relationship is governed by a business associates agreement (BAA).
  • Electronic protected health information (ePHI) – This is basically any digital information that is both “individually identifying” and contains protected health information.” Individually identifying information includes names, contact details, social security numbers, and more. Protected health information relates to a patient’s health, treatments, or payments. Check out our article on ePHI for the specifics.

To summarize: Under the Security Rule, healthcare organizations and those dealing with their protected health information are obligated to protect that data. Encryption is just one way that data can be protected when stored or transmitted electronically, like through an email account.

HIPAA Technical Safeguards and Email Encryption

The next place to find information about email encryption is in section 164.312 Technical Safeguards. The rule states:

“Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health information.”

Notice how it says “addressable”? HIPAA has two different specifications regarding implementation, “required” and “addressable.” Required means that a particular mechanism must be in place for compliance.

On the other hand, addressable means that there is flexibility in the mechanisms that can be used. HIPAA is intentionally vague and technologically agnostic on purpose. This gives organizations the flexibility to develop the best security measures for their unique situation. It is not an excuse to be lax about security. Some addressable standards may not apply to an organization because of the structure or technologies used. Whether or not you need to meet the standard is a question for your legal and compliance teams. 

Does HIPAA Require Encryption and Decryption?

At this stage, you may assume that since encryption is an addressable standard, it’s optional, and you do not have to utilize it. This assumption is almost correct– nowhere in the HIPAA documentation does it specify that encryption and decryption must be used.

But unfortunately, things aren’t that simple. Let’s return to the Security Standards of section 164.306, where it states that covered entities and business associates must:

“Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.”

This time, we’ve put different terms in bold. So, while HIPAA does not state that covered entities have to use encryption, it does say that they need to ensure the confidentiality of any ePHI that is created, received, maintained, or transmitted.

The big question is, “If you aren’t going to use encryption, what techniques will you use to guarantee confidentiality instead?” Will you put all electronic data on flash drives and lock them in metal boxes for storage and transit?

The text doesn’t say that you have to use encryption. Still, given the other requirements in the HIPAA documentation, encryption is the only reasonable solution if you want to communicate electronically about patients and their health conditions.

Is Email Encryption Required for HIPAA?

As stated above, HIPAA does not require the use of email encryption. However, if you plan to communicate PHI via email, you must take steps to secure that data. Without other suitable technologies, encryption is the easiest way to protect patient data in emails. 

So what can you do? The HIPAA text doesn’t include specific encryption requirements, so the documentation isn’t particularly helpful for organizations looking for ways to be compliant and secure. Thankfully, the National Institute of Standards and Technology (NIST), another government agency, has released its own guidelines for email and how to keep it secure.

The guide is extensive, but some of the key takeaways are:

  • Appropriate authentication and access control measures need to be in place.
  • TLS should be used to connect to the email server.
  • Mechanisms such as PGP or S/MIME should be used to encrypt sensitive data (such as ePHI).

If you don’t feel like reading such an exhausting document, you can turn to a HIPAA compliance specialist like LuxSci instead. Our HIPAA-Compliant Email includes email encryption as well as other features to help your organization stay both secure and compliant.