LuxSci

Menu
Contact us
Login

Creating Secure Web Forms: What You Need to Know

person filling out a secure web form on a laptop

Creating secure web forms starts with creating a secure website. This process is more complex than creating web pages and adding an SSL Certificate. A certificate is a solid first step, but it only goes so far as to protect whatever sensitive data necessitates security in the first place.

Naive attempts at security can ultimately make the data less secure and more likely to be compromised by creating an appetizing target for the unscrupulous.

So, what do you do beyond hiring a developer with significant security expertise? Start with this article. Its purpose is to shed light on many of the most significant factors in creating secure web forms and how to address them. At a minimum, reading this article will help you intelligently discuss website security with the developers you hire.

person filling out a secure web form on a laptop

What Is Involved In Creating Secure Web Forms?

If you want to add a secure web form to your website, first, you must understand how to securely configure the website. Website security is a serious and complex topic; this article only discusses the high points. Check out some of our other articles and eBooks for more detailed information on website security.

Here are some of the critical issues that need to be considered:

  1. SSL – Is the website and form secured to transmit data from the end user safely? Is your website form page protected with SSL to prevent tampering with its contents?
  2. Web page content – Is the HTML content sent to the end-user protected from Cross-Site Scripting (XSS) issues, and does it avoid loading objects insecurely or from third parties?
  3. Script Security – Are the scripts or programs that process the submitted data written with security in mind? Do they have any vulnerabilities?
  4. Infrastructure – Is the website hosting provider trusted and known for good security? Are you on a shared server when you should be on a dedicated one?
  5. Data Flows – What do you do with the data once submitted? Is that data secured?
  6. Tracking – Do you track events such as data access and submission?
  7. Archival and Backup – Are there processes to make backups and permanent archives of important data?

SSL – Web Security Starts Here

SSL certificates are required for creating a secure website and form. The SSL certificate allows:

  1. The encryption of data sent to and from your web server and users to prevent eavesdropping or tampering.
  2. Your users trust that they are connecting to your website securely.

An SSL certificates on a properly configured web server encrypts your website data as it flows to and from your end users.

To get an SSL certificate, you can order one directly from a third party, or your web hosting provider will handle it for you. In either case, the web host will need to install the certificate on the server where the website is hosted, and then you will need to make changes to your site to take full advantage of the secure channel you have added.

SSL and Encryption

The most significant reason people use SSL is to encrypt the data transmitted from their website and the end-user. When an end-user visits a page protected by SSL, their web browser communicates over a secure channel with the web server so that all data transmitted is sent over this encrypted channel. This helps prevent eavesdropping and man-in-the-middle attacks on the data (more on these below).

Without SSL encryption, there is little or no protection of the data.

SSL and Trust

The most overlooked and misunderstood aspect of SSL is the establishment of trust. That is, enabling your end-users to trust and feel confident that they are connecting to your website. What else could they be connecting to, you may ask?

  1. Someone with access to the network between the end-user and website could be trying to intercept and read all the web traffic or altering your website pages themselves (e.g., changing your forms to submit the data to them instead of you). This is called a man-in-the-middle attack. Even with SSL security, a man-in-the-middle can present the end-user with an SSL Certificate for your domain name that looks legitimate, like a forged ID card.
  2. The user could be visiting another website that is pretending to be yours. This phishing website could collect information from your users for malicious purposes. Unless your users identify this site as illegitimate, they could be duped into revealing personal information. How could they end up at a phishing website like this? This can happen by clicking on a link emailed to them or by visiting a misspelled version of your URL. No site is immune from such attacks, but you can work to mitigate them.

SSL Certificates and Cybersecurity

As mentioned above, SSL certificates are not the sole website and form security solution, but they can help! To understand how it’s worth looking at how certificates are awarded. SSL certificates are signed by a third-party authority, the “Certificate Authority.” This can be:

  1. You, if you sign your certificates.
  2. A respected third-party issuing:
    1. A cheap or free certificate validating only your domain.
    2. A more expensive “Extended Validation” certificate which also validates your organization.

If you sign your own certificates, your website will generate warnings when anyone visits it. Users can choose to dismiss them, but more commonly, they will be more likely to navigate away from the website. For this reason, self-signed certificates are never recommended for a public website. Self-signed certificates provide no inherent trust that they are legitimate (anyone can generate one and pose as your site). They look amateurish and are annoying to the end user. Self-signed certificates should only be used in internal or test environments.

When ordering a certificate from a trusted third-party authority, there are various types that you can order. The cheapest ones are called domain-validated certificates. These work by emailing your domain administrator a validation link. Once verified, the certificate is awarded. These domain-validated certificates are acceptable and provide excellent security; however, as no humans are directly involved in the validation process, it may be easier for an attacker to get an illegitimate certificate by gaining control of the admin’s inbox or via other methods.

You can also order Extended Validation certificates. They cost more because real people validate the organization and your domain ownership. They make phone calls and ensure that everything looks right. If you have one of these certificates, your browser’s address bar turns green (or displays a lock symbol) when visitors come there to indicate that this site is trusted. If you want to maximize trust and make it easy for your end-users to identify your site as legitimate, you should use an Extended Validation certificate. These cost more but are well worth it in terms of security and trust. If EV certificates are outside your budget, you should still use an SSL certificate from some trusted third party.

Securing Web Forms with SSL

Once your website has an SSL certificate installed by a web host, your web pages can be accessed with addresses that start with “https://” instead of just “http://.” The “s” in “https” means “secure.” Note:

  1. When connected to a web page using a secure address like “https://yourdomain.com,” the web browser will show a lock icon to inform you that the connection is secure.
  2. Web pages that end in “.shtml” are not necessarily secure. The “s” means “server” (i.e., server-parsed page) and not “secure.” So, for example, “http://yourdomain.com/index.shtml” is not a secure page, but “https://yourdomain.com/index.html” is a secure page.
  3. With SSL enabled, you can access the same page securely and insecurely in many default web server configurations. Both “http://yourdomain.com/form.html” and “https://yourdomain.com/form.html” work and show the form — the only difference is the use of SSL or not.

So, let’s say that you have a web form located at “http://yourdomain.com/form.html.” You have an SSL certificate, and your web host has installed it. Next, you want to:

  1. Make sure people connect securely to the form page.
  2. Make sure that no one can connect to the form page insecurely.

These two goals might sound the same, but they are not.

Enforce Secure Connections to Form Pages

Since regular website pages may be insecure, you need to ensure that the links to the secure form page are absolute links starting with the prefix “https://.” This will ensure that anyone clicking these links will be taken to the form page on a secure connection.

The best solution is to use an HSTS (HTTP Strict Transport Security), which tells browsers that they should always use the secure version of your website. If you choose to have both the insecure (http) and secure (https) versions of your site running at the same time (not recommended), then you need to be careful with linking so that sensitive pages are secured:

Wrong Links: Relative links are not recommended because, if the user is on an insecure page, relative links will always take them to insecure versions of the destination page. So relative links like the following should be avoided:

Fill out my form!

Correct Links: Absolute links will ensure a secure connection by specifying that SSL must be used via the link prefix “https://.”

For example: <a href=”https://yourdomain.com/form.html”>Fill out my form!

Be sure that all links to all secure pages of the site use this secure format with the “https://” prefix.

Side Note: These days, it is recommended that you use SSL for all website pages, not just ones that process sensitive information. This is good for user trust, security, and privacy. It is also good for Search Engine Optimization (as Google will reward you for securing your site). If you set up your site so all pages are always secure, relative links are safe.

Ensure No One Can Connect to Form Pages Insecurely

Using the above suggestions, all the links on your website will take users to the secure version of the form. However, most web hosts leave the insecure version of the form there, and users can still access it if they enter the insecure address directly (or if links are directed to the insecure page). As a next step, you should ensure that accessing the form page via an insecure connection is impossible.

There are several different ways that this can be done. Some of these include:

Separate space for SSL pages: If your web host has this feature, you can configure the website to store web pages for secure (SSL) connections in a different directory from those for insecure pages. If this feature is enabled, the form page is placed in the secure directory and no copies are in the insecure directory. Thus, any insecure requests for these pages would result in a “page not found” error. You could then implement server-side redirection rules where if someone requests the insecure page, they are automatically redirected to the secure version (this can be done using .htaccess files and the “Redirect” directive). If you did this, secure and insecure requests for the page would take the user to the secure version with no errors, warnings, or issues for the end user.

Scripted pages: If the form page is generated by a server-side script (i.e., PHP, Perl, Python, or JAVA), then the script itself can determine if the request is secure or not (e.g., by looking at the server environment variables). For secure requests, it can render the form as usual. The user receives an error for insecure requests or is redirected to the proper secure location. 

Securing all pages: (Recommended) The site can be configured to automatically redirect all requests for insecure pages to the respective secure page. All pages will be secure, and any accidental/incorrect requests for the insecure pages will still get people to the right place. Security is greatly improved if you have set this up.

If my form is posted to a secure form processing script, why does it need to be secured?

This question is usually asked when a third-party manages the form processing. Is securing the form itself with SSL needed?

The answer is based on the following facts:

  1. The data sent from end-users to the server will be secure and encrypted during transmission. This is critical for creating secure websites and forms that require HIPAA compliance.
  2. Non-technical end-users will only know if their data is securely submitted once it is done. Many end-users will refrain from submitting sensitive data to an insecure form on your site.
  3. End-users cannot know if they are viewing your website or a phishing site or if eavesdropping and modification are happening. Many users will not trust the connection and will not want to submit their data through your site if it appears insecure.
  4. If your form page is insecure, it is straightforward for any malicious party to perform a man-in-the-middle attack to eavesdrop on connections, modify your form in transit to change what is collected and where the data is sent, and set up phishing sites. Your end-users can’t tell if this is going on.

If you do not secure your web form with SSL, it is vulnerable to attack. If nothing is going on, you can rely on transmission security. However, that minimal level of security is not recommended for production websites or anywhere that compliance is required.

Other Aspects of Creating Secure Web Forms

Proper use of SSL for encryption and trust is only part of creating secure website forms. You must be concerned with many other aspects to protect your users, your application, and your company’s reputation. These include (but are not limited to):

1. Cross-Site Scripting (XSS). Suppose you include dynamic content on your web pages (i.e., information submitted by other users or content submitted via form fields), and that content is not cleaned of JavaScript and HTML. In that case, bad actors could make arbitrary content appear on your website, capture user data, or worse. All data displayed should be clear of undesirable content (script tags, special characters, HTML, and other things). This is one of the most significant security issues with dynamic web pages across the internet.

2. Secure Server-Side Programming: The scripts and programs that accept and process the data from online forms must be created with security in mind. They must validate all submitted data as needed without making assumptions about its format and content. The scripts must not provide avenues for attacks like SQL Injection. Scripts must not use submitted content as actual filenames or URLs for remote loading content. They should log any strange errors or problems for later analysis. They should provide a mechanism for blocking undesirable actions or users from using the scripts.

3. Validation: Validation of all input data is part of the above two points. However, it is so essential that we will repeat it and go over some of the fundamental points:

  • If you validate submitted content, always perform your validation on the server side. Even if you use JavaScript to validate the data on the client side, you should always re-validate it on the server side. Why? Because people can get around JavaScript and submit arbitrary content directly to your scripts. The scripts should be prepared to handle that.
  • Always de-taint submitted data. What does that mean? It means never trust submitted data and take pains to ensure that the submitted data matches what you expect. For example, if you have a select list that sends your script a number as the value, do not assume you are getting a number. Instead, check that it is a numeric value or convert whatever is submitted into a number.
  • Remove disallowed content from the text submitted by users. Remove or block special characters, embedded codes, and other things that should not be there.
  • Ensure the submitted data is manageable enough to be used.
  • Do not assume anything — program defensively.

4. Preserving State with Hidden Form Fields or Cookies: If your program remembers information from one page to another by saving the data in hidden form fields, then your program must also ensure that the content of those fields was not tampered with. One good way to do this is to make a hash of all the data, together with a secret value, and include that hash in the form data. Then, when the form is submitted, you can recompute the hash and compare it with what passed from the form. If they match, you are okay; if they do not, the data has been tampered with. No one can break this scheme without knowing your secret value or breaking your hashing algorithm. This method can also be used to validate data saved in cookies. You can go further and use time stamps to prevent replay attacks.

5. Third-Party Applications: If you install programs from third parties on your website, you must ensure there are no known security issues with these programs, and you must be sure to update these programs as soon as new versions are released. If you let your website languish with an older, vulnerable version of a program, it will become a target for hackers as they constantly search the internet for such websites. Your site will likely be hacked in these cases, possibly causing loss of business, deactivation of your website, and tarnishing your website’s reputation. Using a third-party application is easy, but you need to select a good one that places the burden of keeping it updated on you. An exception is using a third-party application hosted by the third party itself. In these cases, the third party ensures that the program is continuously updated with anything needed to address any security issues. The burden is on them and not you. If you choose a good, respectable vendor, you should have no problems.

All these things, and more, are critical to developing a secure web application.

Securing the Form Data After Submission

Ensuring that users’ data is transmitted securely to your web server is critical, as is ensuring that your application is secure and will not be hacked. To secure sensitive data, you must understand what happens to that data after your program receives it. Many people forget that transmitting the data from the web server may require just as much preparation as receiving it from their users in the first place.

In the following subsections, we will look at three different ways of saving and retrieving your users’ data. In each case, we will explain what is needed to secure the data in your systems.

Send Form Data via Email 

The most common action data processing scripts do is email the submitted data to the website owner’s email address. The website owner knows when there are new submissions by checking their email and can access the data immediately. Most people running websites check their email reasonably often, which integrates well with their business operations.

However, the standard ways of sending emails are entirely insecure. So, how can you use email while ensuring the data is secure and viewable only by the intended recipient?

  1. Have your website script encrypt the data.
  2. Send this encrypted data (or a link to download the encrypted data) to the intended viewers via regular email.

As the form data is encrypted within the email message, most insecurities inherent in email are obviated. You can also use secure third-party services to have your form data emailed to you securely without programming anything yourself.

Save the Submission in a Database

Many website owners like to save the submitted form data in a database (even if it is also emailed to someone). Why?

  1. The data is saved online and potentially accessible from anywhere.
  2. If the emailed copies of the data are lost, the copies in the database are still there.
  3. The database can be accessed through a web browser with a suitable user interface.
  4. The data is typically backed up and can be restored.

If storage in an online database is for you, then you need to:

  1. Use encryption, like SSL or PGP, to ensure the data is securely stored in the database. Why? The contents of database tables are not encrypted or secure in general. Storing unencrypted data makes it available to anyone with access to the database or its backups.
  2. Provide a user interface that allows you to access the database data. It must be secure, have robust access controls, and provide a means for decrypting the data.

The database option requires much work to make a secure and usable solution. For this reason, most small organizations do not end up using secure database storage for important form data.

Save the Data in Files

The file storage option is the “quick and dirty” alternative to secure database storage. Essentially, your program will:

  1. Make a file containing the form data.
  2. Encrypt that file using PGP or SSL.
  3. Save that encrypted file in a directory on the web server that is not accessible from the website. Another option is to save it in an online file-sharing service.

Then, the website owners can log in to the web server using Secure FTP and download these files as needed. They can be decrypted locally when the data must be accessed. Other simpler data access mechanisms are available if the files are saved in an online file share.

This solution is secure and provides an excellent backup to securely emailed data.

Other Technical Tips for Creating Secure Website Forms

There are many other considerations in developing and maintaining a secure website and forms. It would be impossible to cover or even list them all. However, here are some more interesting and valuable tips.

Use Secure Cookies

If your secure site uses cookies for anything, set the “secure” cookie and the “httpOnly” flags. This will ensure that these cookies are never sent insecurely over the internet when the visitor arrives at any insecure pages of your website (they are not sent at all to insecure pages) and thus helps preserve the security of the contents of these secure cookies.

Prevent Form Spam

Form spam occurs when automated programs find your web forms and try to send spam through them. Form spam can result in hundreds or thousands of useless form posts daily. Once you start getting form spam, stopping it is a priority. There are two primary ways to help prevent spam:

  1. CAPTCHA – This method requires end-users to read text embedded in an image and type that text successfully into a form field. The back-end program then validates this. Since most spam programs cannot read text embedded in images, it will successfully block almost all automated forms spam. However, CAPTCHA requires the users to perform one more step, which can be annoying.
  2. JavaScript and Cookies – Most automated form spam programs do not process JavaScript or use cookies. If your web form requires JavaScript to submit the form successfully, bots cannot do this, and most form spam will be blocked. This method is less reliable than CAPTCHA but does not require any extra work from the end-user. Note that if you wish to use the JavaScript method, you must be sure that arbitrary submissions to the default action URL of your forms will never succeed—only submissions made after the execution of your custom JavaScript should succeed.

Minimize the Need for Trust

A good rule of thumb is to minimize the need to trust third parties and trust only the trustworthy.

  1. If you do not trust your internal IT staff, do not host your web application on your servers or give them access to the server used.
  2. If you do not trust the third-party hosting your website, encrypt the form data as soon as possible. This helps ensure that the data is not saved anywhere in plain text and is not backed up in plain text, thus minimizing your exposure to unauthorized people. Further, ensure that the private keys and passwords needed to decrypt the data are not stored on the web host’s servers.
  3. Ensure that only authorized staff can access the submitted form data. Ideally, it should always be encrypted, and only authorized people should be able to decrypt it.

These are just a few obvious points. As you evaluate your web application and data flow, ask yourself, “Who can access the raw data and how?” at each stage. Are there stages where you are trusting people who should not be trusted?

Forced use of strong encryption in SSL

The strength of encryption used by SSL is a function of both the user’s web browser and the server. Even if your web server supports excellent encryption, like AES256, the user’s browser may choose a weaker level of encryption. Older versions of Internet Explorer are notable for choosing weaker encryption in the interest of speed.

You can modify your web server configuration so that only levels of encryption you approve can be used to access your site.

Use Two-Factor Authentication

Two-factor authentication is standard on very secure sites now. You require a password and something else (a code or token) to validate their identity. With both, the user can log in. Avoid using only SMS texting as the second factor, which is no longer considered secure.

Get Started Creating Secure Web Forms

Outsourcing your form hosting and processing can be the fastest and most cost-effective way to get started. LuxSci’s Secure Form was designed for security and compliance. Contact us today to learn more about protecting sensitive information online.

Picture of Erik Kangas

Erik Kangas

With 30 years engaged in to both academic research and software architecture, Erik Kangas is the founder and Chief Technology Officer of LuxSci, playing a core role in building the company into the market leader for HIPAA compliant, secure healthcare communications solutions that it is today. An international lecturer on messaging security, Erik also advises and consults on email technology strategies and best practices, secure architectures, and HIPAA compliance. Erik holds undergraduate degrees in physics and mathematics from Case Western Reserve University, and a doctoral degree in computational biophysics from MIT. Erik Kangas — LinkedIn

Get in touch

Find The Best Solution For Your Organization

Talk To An Expert & Get A Quote




A member of our staff will reach out to you

Follow us on LinkedIn

Search

Search

Category

Recent Posts

Get Your Free E-Book!

LuxSci High Email Deliverability Best Practices Paper

What you’ll learn:

  • How to opitmize email performance
  • Key strategies to increase email deliverability rates
  • How email deliverability impacts marketing ROI
Get Free Ebook

Related Posts

HIPAA Security Rule Update

The HIPAA Security Rule Missed Its May Deadline — Here’s What We Know

The proposed HIPAA Security Rule update has become one of the most closely watched healthcare compliance developments in recent years. Designed to strengthen cybersecurity protections for electronic protected health information (ePHI), the proposal could significantly reshape how healthcare organizations approach risk management, ePHI encryption, and mandatory email encryption requirements.

A final rule was expected as early as May 2026. However, that deadline has now passed without publication from the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR).

So, what happens next—and what should healthcare IT directors, CISOs, and compliance officers do now?

Where Things Stand Today

The HIPAA Security Rule Notice of Proposed Rulemaking (NPRM) was published on January 6, 2025, with the goal of strengthening cybersecurity protections for ePHI in response to escalating ransomware attacks, healthcare breaches, and growing concerns about cyber resilience across the healthcare sector.

The proposal generated thousands of public comments from healthcare providers, payers, business associates, technology vendors, and industry groups. OCR has spent much of the past year reviewing this feedback and evaluating the operational and financial impact of the proposed changes.

Although the Spring Unified Regulatory Agenda identified May 2026 as a target date for a final rule, that milestone came and went without publication. As of June 2026, the proposed HIPAA Security Rule update remains under review.

While some organizations may be tempted to take a wait-and-see approach, the missed deadline should not be interpreted as a signal that the initiative has stalled. If anything, the proposal offers valuable insight into the future direction of healthcare cybersecurity regulation.

The Growing Focus on Mandatory Email Encryption

One of the most discussed aspects of the proposed HIPAA Security Rule update is encryption.

Under the current HIPAA Security Rule, encryption is generally classified as an “addressable” implementation specification. Organizations can choose alternative safeguards if they document and justify their decisions through a risk analysis process.

The proposed changes would significantly reduce that flexibility. Instead, many security safeguards, including encryption controls, would become more prescriptive and difficult to avoid.

While the final language has not yet been released, healthcare organizations should pay close attention to the proposal’s clear message: protecting ePHI through encryption is increasingly viewed as a baseline cybersecurity requirement.

This is particularly important for email communications.

Email remains one of the most widely used communication channels in healthcare, supporting everything from patient engagement and care coordination to billing, scheduling, and marketing communications. As regulators continue to focus on reducing data breach risks, mandatory email encryption is emerging as a likely area of increased scrutiny.

What Healthcare Organizations Should Do Now

The current delay creates an opportunity, not a reason to postpone action.

Healthcare organizations can begin preparing for likely requirements today by evaluating the security controls highlighted throughout the proposed rule.

Key areas to review include:

  • Encryption of ePHI across systems and communications channels
  • Comprehensive asset inventories and ePHI data mapping
  • Enhanced risk analysis and risk management processes
  • Multifactor authentication (MFA)
  • Vulnerability scanning and penetration testing
  • Incident response planning and testing
  • Backup and recovery procedures
  • Email security and secure email encryption practices

Organizations that proactively strengthen these areas now will be better prepared regardless of the final rule’s implementation timeline.

Why Secure Email Encryption Should Be a Priority

For many healthcare organizations, email remains one of the largest compliance and security risks.

Human error, misdirected messages, phishing attacks, and inconsistent encryption practices continue to contribute to breaches involving protected health information. As a result, secure email encryption is increasingly becoming a foundational component of healthcare cybersecurity strategies.

Organizations that rely on manual encryption processes or employee judgment alone may find it difficult to meet evolving regulatory expectations.

Instead, healthcare organizations should look for solutions that automate encryption decisions, reduce user error, and provide flexibility based on the sensitivity of the communication.

At LuxSci, we have long believed that security and usability must work together. We are 100% focused on secure healthcare communications, helping healthcare providers, payers, and suppliers protect sensitive data while improving patient and customer engagement. Our proven secure email solutions, used by leading companies including Athenahealth, 1-800 Contacts, and Hinge Health, help organizations protect ePHI with automated encryption capabilities that support both compliance and operational efficiency. Our unique SecureLine encryption technology enables organizations to apply the appropriate level of protection while maintaining a seamless experience for patients, customers, and staff.

For organizations already using Microsoft 365 or Google Workspace, LuxSci Secure Email Gateway can add HIPAA-compliant email security and encryption without requiring users to change their existing workflows. This approach helps reduce risk, while preserving productivity and user adoption.

The Bottom Line

The HIPAA Security Rule final rule may have missed its anticipated May deadline, but the cybersecurity challenges driving the proposal remain very real.

The OCR is still expected to make the rule change, which could require mandatory encryption of ePHI by early 2027.

The time to prepare is now!

Healthcare organizations should view the proposed HIPAA Security Rule update as an advance warning of where regulatory expectations are heading. Stronger cybersecurity controls, enhanced risk management, ePHI encryption, and mandatory email encryption requirements are all likely to remain central themes in future compliance efforts.

The organizations that begin preparing now will not only be better positioned for future regulatory changes, but will also strengthen their ability to protect patient data, reduce risk, and build trust in an increasingly challenging threat landscape.

At LuxSci, we’re proud to support the healthcare industry’s ongoing digital transformation through secure healthcare communications. Our HIPAA-compliant solutions for secure email, email marketing, and forms empower organizations to safely use and protect PHI, while delivering better patient experiences and outcomes.

Ready to strengthen your healthcare cybersecurity strategy?

Learn more about LuxSci and our complete suite of HIPAA compliant email and marketing solutions, or schedule a consultation with one of our healthcare communication experts today.

Contact us today!

Read More
LuxSci G2

LuxSci Awarded 20 Badges in the G2 Summer 2026 Reports

We’re excited to announce that LuxSci has again been recognized by G2 with 20 badges in its just-released Summer 2026 Reports, highlighting our continued leadership in secure healthcare communications and HIPAA compliant email solutions.

The new LuxSci G2 recognitions span several categories, including:

  • Best Estimated ROI
  • Best Support
  • High Performer
  • Leader

These latest LuxSci G2 awards reflect what matters most to our customers: delivering secure, HIPAA compliant healthcare communications backed by responsive support and measurable business results.

As one of the most trusted providers of HIPAA compliant email, marketing, and forms solutions, we’re proud to see our commitment recognized across multiple product categories and customer satisfaction metrics.

Recognition Built on Customer Experience

LuxSci’s G2 rankings are based on verified customer feedback and real-world user experiences, making these badges especially meaningful to our team.

This year’s Summer Reports recognized LuxSci for consistently delivering value to healthcare organizations looking to securely engage patients and customers while maintaining compliance with HIPAA requirements.

Among the highlights, the LuxSci G2 recognition includes:

  • Best Estimated ROI, reflecting the measurable value customers achieve through secure healthcare communications and personalization
  • Best Support, reinforcing LuxSci’s long-standing reputation for responsive, knowledgeable customer service
  • High Performer badges across multiple categories for customer satisfaction and product performance
  • Leader recognition for delivering secure, scalable communications solutions trusted by healthcare organizations

At LuxSci, we believe secure communications should also drive better engagement, stronger outcomes and operational efficiency. These recognitions reinforce our focus on helping healthcare providers, payers and suppliers personalize communications while protecting sensitive patient data.

Supporting the Future of Personalized Healthcare Engagement

LuxSci’s secure healthcare communication and patient engagement solutions empower organizations to safely communicate with patients and customers through:

  • HIPAA-compliant high volume email
  • Secure email marketing
  • Secure forms and data collection
  • Flexible encryption with SecureLine technology

Our solutions are designed to help healthcare organizations improve engagement, streamline workflows and personalize the healthcare journey while maintaining the highest standards of security and compliance.

These latest LuxSci G2 recognitions also build on LuxSci’s broader reputation for security, performance and customer success. Security and trust remain foundational to everything we do, alongside our commitment to delivering smart, responsive support for our customers.

Thank You to Our Customers

We’re grateful to our customers for their continued trust, collaboration and feedback. Their reviews and insights help shape our products and drive ongoing innovation across the LuxSci product set.

To learn more about LuxSci’s secure healthcare communications solutions, contact our team to schedule a secure email assessment or demo.

Connect with us today!

Follow us on LinkedIn

Read More
Email Encryption

Is OCR Already Enforcing Email Encryption Under the New HIPAA Security Rule?

Healthcare organizations waiting for the final HIPAA Security Rule updates before improving email encryption and security may already be behind.

While the proposed changes to the HIPAA Security Rule are expected to be finalized in May, the direction from the U.S. Department of Health and Human Services Office for Civil Rights (OCR) is becoming increasingly clear. Across investigations, settlements, and enforcement actions, OCR continues emphasizing stronger technical safeguards, encryption, documented security programs, multi-factor authentication (MFA), risk analysis, and proactive cybersecurity operations.

For healthcare organizations, one area stands directly in the middle of all of these priorities: email.

Email remains a primary communication channel in healthcare — and one of the industry’s largest security vulnerabilities. From unauthorized PHI exposure to phishing attacks and ransomware delivery to account compromise, email continues to be at the center of healthcare cybersecurity incidents.

So, are the proposed HIPAA Security Rule changes hypothetical future guidance or a preview of OCR’s future enforcement expectations?

For healthcare email security, the implications are significant.

Email = Healthcare Cybersecurity Risk

Healthcare organizations rely on email for critical communications and healthcare workflows, including:

  • Patient communications
  • Care coordination
  • Claims and billing notifications
  • Marketing and engagement
  • Internal collaboration
  • Third-party vendor communications
  • Delivery of sensitive PHI

At the same time, attackers continue targeting email systems because they remain one of the easiest entry points into healthcare environments.

Insecure email workflows create unnecessary exposure of protected health information. Phishing campaigns are becoming more sophisticated. Credential theft attacks are bypassing traditional MFA methods. And business email compromise (BEC) attacks continue rising.

Recent OCR enforcement actions increasingly reflect these realities.

Organizations are being evaluated not simply on whether a breach occurred, but whether they implemented reasonable safeguards beforehand, including encryption, authentication controls, monitoring, access management, and documented risk mitigation processes.

For email systems specifically, that means healthcare organizations should expect increased scrutiny around:

  • Email encryption enforcement
  • MFA deployment
  • Audit logging and retention
  • Conditional access policies
  • Vendor security controls
  • Secure email delivery best practices
  • Segmentation and infrastructure isolation
  • Ongoing patch and vulnerability management

In many ways, email infrastructure is becoming a visible test of an organization’s overall cybersecurity posture.

Email Encryption Is Moving From Addressable to Required

Historically, healthcare organizations often interpreted HIPAA email encryption requirements with flexibility because encryption was technically categorized as an “addressable” safeguard under the Security Rule. But, OCR enforcement and broader cybersecurity realities are changing that interpretation rapidly.

Today, failing to encrypt sensitive healthcare communications increasingly creates both security and regulatory risk. The proposed Security Rule updates place even greater emphasis on encryption and technical safeguards. At the same time, OCR investigations continue examining whether organizations properly protected PHI in transit and at rest.

For healthcare email specifically, this creates several growing expectations:

  • Email encryption should be automated wherever possible
  • Human error should not determine whether PHI is protected
  • Organizations should maintain documented encryption policies
  • Secure delivery methods should adapt dynamically to recipient capabilities
  • Audit trails should demonstrate how messages were secured

At LuxSci, we have long believed that encryption should operate as a strategic layer of healthcare communications infrastructure, not as a manual user decision.

Our SecureLine email encryption technology automatically applies appropriate encryption methods based on organizational policies and delivery requirements, helping reduce the risks associated with human error while maintaining usability, deliverability and compliance. As enforcement expectations rise, this type of automated security enforcement is becoming increasingly important.

Traditional MFA May No Longer Be Enough

Another major shift emerging from both OCR enforcement trends and the proposed rule updates is the growing importance of stronger authentication models.

Healthcare organizations have historically viewed MFA deployment as sufficient protection. But attackers have adapted quickly.

MFA bypass attacks, token theft, session hijacking, and consent phishing campaigns are increasingly targeting healthcare users. As a result, regulators and cybersecurity experts are placing greater emphasis on phishing-resistant authentication approaches and contextual access controls.

For email environments, organizations should increasingly evaluate:

  • Whether MFA methods are resistant to phishing attacks
  • Conditional access policies based on device, location, and behavior
  • Account monitoring and anomaly detection
  • Administrative access protections
  • Session management controls
  • Logging and authentication auditing

The broader message is clear: healthcare organizations need authentication strategies designed for today’s threat landscape, not yesterday’s compliance checklist.

OCR Wants Proof, Not Just Policies

One of the clearest trends emerging from recent OCR activity is the increasing importance of documentation and operational evidence. Healthcare organizations must increasingly demonstrate not only that safeguards exist, but that they are consistently enforced, monitored, tested, and maintained over time.

For email systems, organizations should be prepared to demonstrate:

  • Email encryption policies
  • MFA enforcement records
  • Audit logs and message tracking
  • Vendor security documentation
  • Risk assessments involving email infrastructure
  • Patch management procedures
  • Employee security awareness training
  • Incident response procedures for email-based threats

This represents a broader shift in healthcare cybersecurity expectations.

The question is no longer: “Do you have email security controls?”

The question is increasingly: “Can you prove they are operationally effective?”

Healthcare Organizations Need a New Email Security Strategy

The healthcare industry is entering a new phase of cybersecurity enforcement.

OCR’s direction is becoming increasingly clear: organizations are expected to proactively secure systems handling PHI using modern, documented, and continuously maintained safeguards. For email security specifically, that means organizations should stop treating encryption, MFA, and secure communications as optional compliance requirements. Instead, they should view secure email infrastructure as a strategic component of enterprise cybersecurity and patient trust.

At LuxSci, we help healthcare organizations modernize secure communications with HIPAA compliant email infrastructure designed specifically for healthcare environments, including flexible encryption, secure delivery, auditability, high deliverability, access controls, and dedicated infrastructure options.

The proposed HIPAA Security Rule updates may not yet be final. But, OCR is already signaling where healthcare cybersecurity enforcement is headed next. For organizations relying on email to communicate with patients, members, customers, and partners, the time to examine your secure email infrastructure is now.

Connect with our experts to learn more using the form at the top of this page!

Read More
LuxSci HIPAA Compliant Email for Mid-Sized Healthcare Organizations

LuxSci Launches Enterprise-Grade HIPAA Compliant Email Security for Mid-Sized Healthcare Organizations

New right-sized offering brings advanced encryption, easy API integration, and HITRUST-certified compliance to the most underserved segment in healthcare email — with pricing starting at $99/month

CAMBRIDGE, MA — May 5, 2026 — LuxSci, a leading provider of HIPAA compliant secure healthcare communications, today announced the launch of LuxSci Secure High Volume Email for mid-sized healthcare organizations, the industry’s trusted HIPPA-compliant email solution now packaged and priced for mid-size healthcare organizations. Regional health systems, health plans, specialty group practices, urgent care networks, and multi-site regional providers can now access LuxSci’s enterprise-grade email security and encryption infrastructure at published, volume-based pricing — with no custom quote required.

LuxSci Secure High Volume Email for mid-sized healthcare organizations delivers the same HITRUST CSF r2-certified email security and flexible encryption capabilities that power communications for some of the largest healthcare organizations in the industry, including Athenahealth, 1-800 Contacts, Hinge Health and Eurofins. The new LuxSci mid-sized offer is tiered and priced for organizations with email sending volumes of between 300 and 99,000 emails per month.

LuxSci Secure High Volume Email is built on the company’s proprietary SecureLine™ encryption technology, which automatically selects the optimal email encryption method — TLS, secure portal fallback, PGP, or S/MIME — on a per-recipient basis at the time of delivery, with no action required from senders or recipients. This intelligent, adaptive encryption method goes significantly beyond TLS-only or portal fallback models offered by basic platforms, giving mid-market healthcare organizations the flexibility and cybersecurity depth they need as HIPAA regulations tighten and email threats continue to get more sophisticated.

Key capabilities include:

  • Automatic email encryption via SecureLine™ — encrypt every email and its content, including Protected Health Information (PHI), with per-recipient adaptive encryption across TLS, portal fallback, PGP, and S/MIME.
  • Advanced REST API with webhooks for dataflows into your systems — supports unlimited messages/hour with failover, queuing, plus webhooks can push email engagement data back to EHRs, CRMs, RCM and customer data platforms.
  • Comprehensive audit logging and reporting — message-level tracking, delivery status, engagement reporting, and downloadable reports for compliance officers.
  • HITRUST CSF r2 certification, BAA, GDPR-compliant, and US-EU Privacy Framework agreement all included.
  • Microsoft 365 and Google Workspace overlay — use LuxSci’s Secure Email Gateway add-on to integrate directly with existing M365 or Google Workspace environments, adding HIPAA-compliant encryption without migration or user retraining.
  • HIPAA-compliant patient engagement — secure outbound email campaigns with PHI-powered hyper-segmentation, automated workflows, and personalized emails for marketing campaigns, proactive patient communications, appointment reminders, care gap outreach, new plan enrollments, healthcare education, and more — with LuxSci Secure Marketing add-on.

New Published LuxSci Pricing

LuxSci Secure High Volume Emai for mid-sized healthcare organizations features published pricing based on monthly sending volume:

Monthly Send VolumeMonthly Price
300 to 9,999 emails/month $99/month
10,000 – 29,999 emails/month $199/month
30,000 – 49,999 emails/month $299/month
50,000 – 99,999 emails/month $399/month
100,000+ emails/month Custom

“Mid-size healthcare organizations have been underserved for too long, forced to choose between inadequate email security tools that weren’t built for healthcare and HIPAA compliance and enterprise level solutions that felt too big or too complex,” said Mark Leanord, CEO of LuxSci. “Our new secure email packaging for mid-sized organizations changes that. We’re making the same encryption depth, ease of integration into EHRs, CRMs and other systems, and compliance rigor that powers our largest customers accessible for mid-sized organizations to easily evaluate and buy.”

Timing and Market Context

The launch comes at a critical moment for mid-size healthcare organizations. The HHS HIPAA Security Rule overhaul, expected to finalize in mid-2026, is anticipated to mandate email encryption as a required safeguard, elevating email security from addressable best practice to a regulatory requirement for thousands of organizations that have not yet upgraded their email security and compliance posture. LuxSci secure email is designed to meet these requirements, backed by HITRUST CSF r2 certification and the company’s 20-year track record in secure healthcare communications.

Availability

LuxSci Secure Email for mid-sized healthcare organizations is available immediately. Pricing and product details are published here.

Users can contact LuxSci to set up a call or DEMO.

About LuxSci

LuxSci is a leading provider of secure healthcare communications solutions for the healthcare industry. The company offers secure email, marketing, forms and hosting, delivering HIPAA‑compliant communication solutions that enable organizations to safely manage and transmit sensitive data, including protected health information (PHI). Founded in 1999 and recently merged with digital care and telehealth provider Ovia Health, LuxSci serves more than 2,000 customers across healthcare verticals, including providers, payers, suppliers, and healthcare retail, home care providers, and healthcare systems, as well as organizations operating in other highly regulated industries. LuxSci is HITRUST‑certified with current customers including Athenahealth, 1800 Contacts, Lucerna Health, Eurofins, and Rotech Healthcare, among others.

###

Media Contact:
Pete Wermter, CMO

pwermter@luxsci.com

Read More

You Might Also Like

In-Home Care Email Use Cases

HIPAA-Compliant Email: 7 Use Cases for In-Home Care

The demand for in-home care is growing as patients increasingly seek personalized, convenient healthcare in the comfort of their homes. A key reason for this increase is the rise in the number of baby boomers, i.e., people aged 65 and older, opting for in-home care.

In fact, as of 2020, there were approximately 76.4 million Baby Boomers in the United States, with projections indicating that by 2040, there will be roughly 80.8 million Americans over the age of 65. Consequently, the need for in-home care services will only grow to accommodate the health needs of this expanding demographic. 

For in-home care providers, remaining competitive in this space requires increased levels of patient engagment over digital channels and the inclusion of protected health information (PHI) to personalize communications. As a result, incorporating secure, HIPAA-compliant email communications and campaigns into your in-home patient outreach efforts both enhances engagement and yields significant operational and financial benefits. 

In this post, we explore 7 impactful use cases for HIPAA-compliant secure communications for in-home care, including how providers can harness them to achieve their efficiency goals and growth objectives, while improving health outcomes for patients.

What Are the Benefits of HIPAA-Compliant Email for In-Home Care Providers?

Before we dive into the most common email use cases for in-home care providers, let’s look at why adopting secure, personalized communication strategies offer several advantages:

  • Avoiding the Consequences of HIPAA Non-compliance: including sensitive patient data in communications without implementing the security measures required by HIPAA can incur financial (fines, compensation), operational (time spent mitigating security threats), and reputational (being seen as untrustworthy with PHI) consequences. 
  • Enhanced Efficiency and Outcomes: streamlined communications, such as automated appointment reminders, reduce administrative tasks and missed appointments, allowing staff to spend more of their time engaging patients to drive better health outcomes.
  • Improved Patient Satisfaction: timely, relevant, and personalized communications demonstrate a commitment to patient well-being and positive engagements, fostering trust and loyalty.
  • Cost Savings: Secure, personalized communications lead to significant cost reductions by preventing miscommunications and the resulting complications. 
  • Increased brand connection: with HIPAA-compliant communications, you can foster a better understanding of the full extent of your capabilities, the value you provide, and, ultimately, the vital role you play in your patients’ healthcare journey. 

High-Impact HIPAA-Compliant Use Cases for In-Home Care

1. Appointment Reminders

Missed appointments are a substantial financial burden on healthcare organizations. In the U.S., they result in an estimated $150 billion in losses annually, with each no-show costing businesses approximately $200 per hour. 

Sending personalized, secure appointment reminders via HIPAA-compliant email and text messaging can significantly reduce no-show rates, cutting costs, boosting revenue, and, most importantly, increasing patient adherence to care. Better still, appointment reminders can be automated, e.g., with confirmations sent at the time of booking and reminders scheduled to go out a few days before the appointment. This not only ensures consistent communication, with minimal additional administrative overhead, but also increases the utility and value of the in-home care service.  

2. Follow-Up Communications

Frequent follow-up email communications are an effective way to monitor a patient’s progress, ensuring adherence to treatment plans and enabling them to adapt a health regime according to potential changes in their condition. 

A few examples of situations that warrant a follow-up email include:  

  • After an initial consultation
  • After an appointment with an in-home care professional
  • After a treatment or surgery
  • After in-home medical equipment training 
  • After a patient has started a new course of medication

Follow-up email communications could include advice on booking a subsequent appointment, aftercare advice, or guidelines for taking medication. Again, as with appointment reminders, follow-up emails can be automated to streamline the process. 

3. Personalized Treatment Plans

Tailoring treatment plans to fit a patient’s specific needs enhances treatment efficacy and reduces the likelihood of adverse effects. Secure email plays a crucial role in the development and distribution of treatment plans, which always include PHI, providing a channel by which healthcare providers can share sensitive patient data quickly and coordinate on any courses of action.

Email security measures, such as encryption, access control, and user authentication protect patient data from the malicious efforts of cybercriminals, while ensuring compliance with HIPAA’s Security Rule.  

4. Care Coordination

Effective care coordination is essential for in-home care success where multiple healthcare professionals, such as nurses, therapists, and caregivers, must consistently collaborate to deliver high levels of patient care. 

Offering critical functions such as treatment updates and emergency alerts, HIPAA-compliant email communications can ensure that all necessary parties remain in the loop about any situations regarding their shared patients. Additionally, integrating HIPAA-compliant email with a customer data platform (CDP) solution, electronic health record (EHR) systems, or any other system where PHI resides, allows in-home care providers to access and update patient records in real time, ensuring access to up-to-date information across the care team.

5. Proactive Patient Education

Educating patients through secure, personalized communications helps to enhance their competence in matters regarding their health, thereby increasing confidence in their ability to manage their healthcare journey more effectively, and resulting in greater engagement. Using PHI to segment patients by their condition or certain demographics (e.g., age, gender, lifestyle factors) and send them relevant educational materials is a powerful way for in-home care providers to offer additional value. This could include: 

  • Advice on managing a particular condition of injury, e.g., chronic disease management
  • Informing patients and customers of events related to their present state of health, e.g., classes for expectant mothers, support groups for cancer patients, etc. 
  • Tips related to improving their health according to recent diagnoses and known lifestyle factors, e.g., smoking cessation strategies, dietary advice, etc.  

Patient education is such an effective use of HIPAA-compliant email because it can be done frequently. Plus, it offers the additional benefits of helping to position the in-home care provider as an expert, increasing patient trust and boosting adherence to prescribed health advice. 

6. Collecting Patient and Customer Feedback

Another simple, yet powerful use of secure email communication is to collect feedback and intelligence from patients, via integrated, secure email and forms, for review requests, surveys, and polls. By gaining insight into how your patients and customers feel about the quality of your in-home care products and services, you can pinpoint areas for improvement. As well as increasing customer satisfaction levels, this will also present opportunities to root out inefficiencies and cut costs in the process. 

Additionally, asking for feedback helps increase patient trust, because you’ve displayed a commitment to improving your service and that you’re interested in the opinion of your patients and customers. 

7. Health Alerts

HIPAA-compliant email is a helpful tool for making patients aware of situations or circumstances that could adversely affect their health. This could include alerts about virus outbreaks in their area or adverse weather events that could affect their in-home healthcare provision. To maximize value, these email alerts can be paired with advice to help patients through potential health emergencies, such as information on vaccine drives, activities to avoid during a period of rough weather, and support resources should they require more assistance.  

Elevate Your In-Home Care Communications with LuxSci HIPAA-Compliant Email

LuxSci stands at the forefront of secure healthcare communications, offering HIPAA-compliant email, text, forms and marketing solutions for the security and compliance needs of in-home care providers. With over 25 years of experience, LuxSci provides secure high-volume email solutions, solutions for making Google Workspace and Microsoft 365 HIPAA-compliant, secure text messaging, and secure forms solutions that enable personalized, efficient, and effective patient engagement across a variety of channels. 

Using LuxSci’s suite of secure communication tools, in-home care providers can streamline their operations, drive better, more personalized engagement, and improve health outcomes for the growing numbers of patients looking for healthcare services at home. Contact LuxSci today to learn more.

Read More
HIPAA Security Rule Update

The HIPAA Security Rule Missed Its May Deadline — Here’s What We Know

The proposed HIPAA Security Rule update has become one of the most closely watched healthcare compliance developments in recent years. Designed to strengthen cybersecurity protections for electronic protected health information (ePHI), the proposal could significantly reshape how healthcare organizations approach risk management, ePHI encryption, and mandatory email encryption requirements.

A final rule was expected as early as May 2026. However, that deadline has now passed without publication from the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR).

So, what happens next—and what should healthcare IT directors, CISOs, and compliance officers do now?

Where Things Stand Today

The HIPAA Security Rule Notice of Proposed Rulemaking (NPRM) was published on January 6, 2025, with the goal of strengthening cybersecurity protections for ePHI in response to escalating ransomware attacks, healthcare breaches, and growing concerns about cyber resilience across the healthcare sector.

The proposal generated thousands of public comments from healthcare providers, payers, business associates, technology vendors, and industry groups. OCR has spent much of the past year reviewing this feedback and evaluating the operational and financial impact of the proposed changes.

Although the Spring Unified Regulatory Agenda identified May 2026 as a target date for a final rule, that milestone came and went without publication. As of June 2026, the proposed HIPAA Security Rule update remains under review.

While some organizations may be tempted to take a wait-and-see approach, the missed deadline should not be interpreted as a signal that the initiative has stalled. If anything, the proposal offers valuable insight into the future direction of healthcare cybersecurity regulation.

The Growing Focus on Mandatory Email Encryption

One of the most discussed aspects of the proposed HIPAA Security Rule update is encryption.

Under the current HIPAA Security Rule, encryption is generally classified as an “addressable” implementation specification. Organizations can choose alternative safeguards if they document and justify their decisions through a risk analysis process.

The proposed changes would significantly reduce that flexibility. Instead, many security safeguards, including encryption controls, would become more prescriptive and difficult to avoid.

While the final language has not yet been released, healthcare organizations should pay close attention to the proposal’s clear message: protecting ePHI through encryption is increasingly viewed as a baseline cybersecurity requirement.

This is particularly important for email communications.

Email remains one of the most widely used communication channels in healthcare, supporting everything from patient engagement and care coordination to billing, scheduling, and marketing communications. As regulators continue to focus on reducing data breach risks, mandatory email encryption is emerging as a likely area of increased scrutiny.

What Healthcare Organizations Should Do Now

The current delay creates an opportunity, not a reason to postpone action.

Healthcare organizations can begin preparing for likely requirements today by evaluating the security controls highlighted throughout the proposed rule.

Key areas to review include:

  • Encryption of ePHI across systems and communications channels
  • Comprehensive asset inventories and ePHI data mapping
  • Enhanced risk analysis and risk management processes
  • Multifactor authentication (MFA)
  • Vulnerability scanning and penetration testing
  • Incident response planning and testing
  • Backup and recovery procedures
  • Email security and secure email encryption practices

Organizations that proactively strengthen these areas now will be better prepared regardless of the final rule’s implementation timeline.

Why Secure Email Encryption Should Be a Priority

For many healthcare organizations, email remains one of the largest compliance and security risks.

Human error, misdirected messages, phishing attacks, and inconsistent encryption practices continue to contribute to breaches involving protected health information. As a result, secure email encryption is increasingly becoming a foundational component of healthcare cybersecurity strategies.

Organizations that rely on manual encryption processes or employee judgment alone may find it difficult to meet evolving regulatory expectations.

Instead, healthcare organizations should look for solutions that automate encryption decisions, reduce user error, and provide flexibility based on the sensitivity of the communication.

At LuxSci, we have long believed that security and usability must work together. We are 100% focused on secure healthcare communications, helping healthcare providers, payers, and suppliers protect sensitive data while improving patient and customer engagement. Our proven secure email solutions, used by leading companies including Athenahealth, 1-800 Contacts, and Hinge Health, help organizations protect ePHI with automated encryption capabilities that support both compliance and operational efficiency. Our unique SecureLine encryption technology enables organizations to apply the appropriate level of protection while maintaining a seamless experience for patients, customers, and staff.

For organizations already using Microsoft 365 or Google Workspace, LuxSci Secure Email Gateway can add HIPAA-compliant email security and encryption without requiring users to change their existing workflows. This approach helps reduce risk, while preserving productivity and user adoption.

The Bottom Line

The HIPAA Security Rule final rule may have missed its anticipated May deadline, but the cybersecurity challenges driving the proposal remain very real.

The OCR is still expected to make the rule change, which could require mandatory encryption of ePHI by early 2027.

The time to prepare is now!

Healthcare organizations should view the proposed HIPAA Security Rule update as an advance warning of where regulatory expectations are heading. Stronger cybersecurity controls, enhanced risk management, ePHI encryption, and mandatory email encryption requirements are all likely to remain central themes in future compliance efforts.

The organizations that begin preparing now will not only be better positioned for future regulatory changes, but will also strengthen their ability to protect patient data, reduce risk, and build trust in an increasingly challenging threat landscape.

At LuxSci, we’re proud to support the healthcare industry’s ongoing digital transformation through secure healthcare communications. Our HIPAA-compliant solutions for secure email, email marketing, and forms empower organizations to safely use and protect PHI, while delivering better patient experiences and outcomes.

Ready to strengthen your healthcare cybersecurity strategy?

Learn more about LuxSci and our complete suite of HIPAA compliant email and marketing solutions, or schedule a consultation with one of our healthcare communication experts today.

Contact us today!

Read More
LuxSci MFA

Traditional MFA No Longer Qualifies as “Reasonable” Security

For years, multi-factor authentication (MFA) was considered one of the most effective ways to protect sensitive systems. By requiring a second verification step, such as a text message code or push notification, organizations could significantly reduce the risk of compromised passwords.

But the threat landscape has changed.

Today, attackers routinely bypass traditional MFA using techniques such as MFA evasion, token replay attacks, and consent phishing. These methods are no longer rare or highly sophisticated. They are widely used, automated, and increasingly effective.

As a result, regulators, auditors, and security frameworks are raising expectations for authentication security. For healthcare organizations in particular, traditional MFA alone may no longer satisfy the HIPAA requirement to implement “reasonable and appropriate safeguards.”

In the near future, email systems that rely only on basic MFA, without conditional access or phishing-resistant authentication, may increasingly be viewed as security gaps during risk assessments.

Why Traditional MFA Is No Longer Enough

Traditional MFA still improves security compared to passwords alone. However, many common MFA methods were designed before today’s phishing techniques and cloud authentication attacks became widespread.

Common MFA methods include:

  • SMS verification codes
  • Email-based authentication codes
  • Push notifications to mobile apps

While these mechanisms add friction for attackers, they can still be intercepted or manipulated during sophisticated phishing attacks. Because modern attackers now target authentication workflows directly, organizations relying solely on traditional MFA may be more vulnerable than they realize.

How Attackers Bypass MFA Today

Cybercriminals increasingly rely on tools that capture credentials and authentication tokens during login sessions. Three attack techniques are now especially common.

  • MFA Evasion and Phishing Proxies – Attackers frequently deploy adversary-in-the-middle phishing kits that sit between the user and the real login service. When users enter their credentials and MFA code on a phishing page, the attacker forwards the information to the legitimate site and captures the authentication session. The user successfully logs in—but the attacker gains access as well. If attackers capture those tokens, they can reuse them to access the account directly.
  • Token Replay Attacks – After successful authentication, systems typically issue session tokens that allow users to remain logged in without repeated MFA prompts. This technique has been widely observed in attacks targeting cloud email platforms such as Microsoft 365, allowing attackers to access email data even when MFA is enabled.
  • Consent Phishing – Consent phishing bypasses MFA entirely. Instead of stealing passwords, attackers trick users into granting permissions to malicious applications that request access to their mailbox or files. If users approve the request, the attacker’s application receives persistent access to the account through APIs—often without triggering security alerts.

Why Email Authentication Matters Most in Healthcare

Email remains one of the most critical systems in healthcare organizations. It supports patient communication, internal collaboration, and the exchange of sensitive information. Unfortunately, it is also the most frequently targeted entry point for cyberattacks.

Once attackers gain access to an email account, they can:

  • Impersonate healthcare staff
  • Launch internal phishing attacks
  • Access sensitive patient communications
  • Extract protected health information (PHI)

Because of this, email authentication controls are becoming a major focus for security teams and compliance auditors alike.

Evolving Regulatory Expectations

HIPAA does not prescribe specific technologies, but it requires organizations to implement safeguards that are “reasonable and appropriate” based on risk. As new attack methods emerge, the definition of reasonable security evolves.

Today, many security frameworks and regulatory bodies are emphasizing stronger identity protections, including:

  • Phishing-resistant authentication
  • Conditional access policies
  • Monitoring for suspicious login behavior
  • Controls for third-party application permissions

Organizations that rely solely on basic MFA may increasingly struggle to demonstrate that their authentication protections are sufficient.

The Shift Toward Phishing-Resistant Authentication

To address the weaknesses of traditional MFA, many organizations are adopting phishing-resistant authentication technologies, which can be enabled with tools like Duo and Okta. These solutions rely on cryptographic authentication tied to trusted devices, which prevents attackers from capturing or replaying login credentials.

Examples include:

  • Hardware security keys
  • Passkeys
  • Certificate-based authentication

Because authentication is tied to both the device and the legitimate website domain, these technologies significantly reduce the success rate of phishing attacks.

Why Conditional Access Is Becoming Essential

Conditional access adds another layer of protection by evaluating context and risk before granting access. Instead of treating every login the same, conditional access policies analyze signals such as:

  • Device security status
  • Geographic location
  • Network reputation
  • User behavior patterns

If something appears unusual, such as a login from a new country, the system can require stronger authentication or block the attempt altogether. This risk-based approach to authentication helps prevent many account compromise scenarios.

The Future of HIPAA Risk Assessments

As authentication threats evolve, healthcare security assessments are increasingly focusing on identity protection maturity. Organizations may begin seeing findings related to:

  • Weak or outdated MFA methods
  • Lack of conditional access policies
  • Insufficient monitoring of login activity
  • Unrestricted third-party application permissions

In particular, email systems without advanced authentication protections may be flagged as high-risk vulnerabilities, especially when PHI is accessible.

LuxSci’s Modern Approach to MFA

Modern threats require more than a simple second login factor. LuxSci approaches authentication security with layered identity protection designed specifically for healthcare environments.

Instead of relying solely on basic MFA methods like SMS codes or email verification, LuxSci supports stronger authentication controls and policies that align with evolving security expectations. These protections can include:

  • Strong multi-factor authentication options
  • Monitoring for unusual login behavior
  • Enhanced identity verification mechanisms

By combining multiple security layers within its HIPAA-compliant secure communications email and marketing solutions, LuxSci helps healthcare organizations protect sensitive email communications while maintaining usability for providers, health plan administrators, payment providers, and patient engagement teams.

Conclusion

Multi-factor authentication remains an important security control—but not all MFA is created equal. Attack techniques such as phishing proxies, token replay, and consent phishing have demonstrated that traditional MFA methods can be bypassed. As a result, regulators and auditors are increasingly expecting stronger identity protections.

For healthcare organizations that rely heavily on email communications, the implications are significant. Weak authentication controls can expose sensitive patient data and may soon appear as high-risk findings during HIPAA risk assessments. The organizations best positioned for the future will be those that modernize authentication strategies now, moving toward phishing-resistant methods, conditional access policies, and layered identity protection.

Reach out to LuxSci today to learn how HIPAA compliant email can support both your organization’s engagement and cybersecurity needs.

FAQs

1. What is traditional MFA?

Traditional MFA refers to authentication methods that require a second verification step, typically SMS codes, email codes, or push notifications.

2. Why can attackers bypass MFA today?

Modern phishing tools can intercept authentication sessions or steal login tokens, allowing attackers to access accounts even when MFA is enabled.

3. What is phishing-resistant authentication?

Phishing-resistant authentication uses cryptographic methods tied to trusted devices, preventing attackers from capturing login credentials.

4. Why is email security especially important for healthcare organizations?

Email systems often contain patient communications and sensitive information, making them a common target for cyberattacks.

5. How can organizations improve authentication security?

Organizations can strengthen identity security by adopting phishing-resistant authentication methods, implementing conditional access policies, and monitoring login activity.

Read More
LuxSci Oiva Health

LuxSci and Oiva Health Combine to Form Transatlantic Healthcare Communications Group

Boston & Helsinki, February 12, 2026 – LuxSci, a provider of secure healthcare communications solutions in the United States, and Oiva Health, a Nordic provider of Digital Care solutions in social and healthcare services, today announced that the companies are joining forces. Backed by Main Capital Partners (“Main”), the combination brings together two complementary platforms and teams, forming a strong transatlantic software group focused on secure healthcare communications.

Founded in 1999, LuxSci is a U.S. provider of HIPAA‑compliant, secure email, marketing, and forms solutions. Its application and infrastructure software enable organizations to securely deliver personalized, sensitive data at scale to support a broad range of healthcare communications and workflows including care coordination, benefits and payments, marketing, wellness communications, after care and ongoing care. Certified by HITRUST for the highest levels of data security, LuxSci serves dozens of healthcare enterprises and hundreds of mid‑market organizations.

Founded in 2010, Oiva Health is a provider of digital care and communications solutions in the Nordics. Headquartered in Finland, with additional offices in Denmark, Norway, and Sweden, Oiva Health offers digital care and digital clinic solutions – including digital visits, secure messaging, online scheduling and appointments, and caregiver communications – serving the long-term care, especially elderly care, and occupational healthcare verticals. The company employs approximately 60 people and has recently expanded across the Nordic region, with a growing presence in Norway and Sweden.

The combination of LuxSci and Oiva Health creates a larger, cross Atlantic group with complementary solutions, serving the U.S. and European markets. Together, the companies offer healthcare providers, payers, and suppliers a comprehensive suite of tools to communicate securely and compliantly, spanning communications, workflows, and virtual care delivery.

Daan Visscher, Partner and Co-Head North America at Main, commented: “We are pleased to announce this cross Atlantic transaction, creating an internationally active secure communications player within the healthcare and home care space. The combined product suite enables healthcare organizations to drive much needed efficiency gains in healthcare provision addressing a global trend of rising costs, aging population, and increasing pressure on resources needed to provide high-quality care.”

Mark Leonard, CEO of LuxSci, said, “We are thrilled to join forces with Oiva Health and believe that together we can truly make a difference in healthcare coordination, access, and delivery. We see an exciting path forward with our customers benefiting from an end-to-end, secure and compliant approach to optimizing both healthcare communications and today’s frontline workers, which we need now more than ever.”

Juhana Ojala, CEO at Oiva Health, concluded, “We look forward to this new chapter together with LuxSci. We are very excited about the strong alignment between our solutions, which especially strongly positions us to expand our flagship Digital Care offering to the high-potential U.S. care market – from care coordination to care delivery to in-home and institutional care.”

Nothing contained in this Press Release is intended to project, predict, guarantee, or forecast the future performance of any investment. This Press Release is for information purposes only and is not investment advice or an offer to buy or sell any securities or to invest in any funds or other investment vehicles managed by Main Capital Partners or any other person.

[END OF MESSAGE]

About LuxSci

LuxSci is a U.S.-based provider of secure healthcare communications solutions for the healthcare industry. The company offers secure email, marketing, forms and hosting, delivering HIPAA‑compliant communication solutions that enable organizations to safely manage and transmit sensitive data. Founded in 1999, LuxSci serves more than 1,900 customers across healthcare verticals, including providers, payers, suppliers, and healthcare retail, home care providers, and healthcare systems, as well as organizations operating in other highly regulated industries. LuxSci is HITRUST‑certified with example clients being Athenahealth, 1800 Contacts, Lucerna Health, Eurofins, and Rotech Healthcare, among others.

About Oiva Health

Oiva Health is a Digital Care provider in the Nordics, offering a comprehensive Digital Platform for integrated health and care services to digitalize primary healthcare, social care, hospital healthcare and long-term care services. The company was founded in 2010 and currently employs approximately 60 people in Finland, Denmark, Norway, and Sweden serving domestic municipalities, customers and partners, such as City of Helsinki, Keski-Suomi Welfare Region, Länsi-Uusimaa Welfare Region in Finland, and Viborg municipality in Denmark with its Digital Care platform. Annually over 5 million customer contacts are handled digitally through Oiva Health’s Digital Care and Digital Clinic platforms.  

About Main Capital Partners

Main Capital Partners is a software investor managing private equity funds active in the Benelux, DACH, the Nordics, France, and the United States with approximately EUR 7 billion in assets under management. Main has over 20 years of experience in strengthening software companies and works closely with the management teams across its portfolio as a strategic partner to achieve profitable growth and create larger outstanding software groups. Main has approximately 95 employees operating out of its offices in The Hague, Düsseldorf, Stockholm, Antwerp, Paris, and an affiliate office in Boston. Main maintains an active portfolio of over 50 software companies. The underlying portfolio employs approximately 15,000 employees. Through its Main Social Institute, Main supports students with grants and scholarships to study IT and Computer Science at Technical Universities and Universities of Applied Sciences.

The sender of this press release is Main Capital Partners.

For more information, please contact:

Main Capital Partners
Sophia Hengelbrok (PR & Communications Specialist)

sophia.hengelbrok@main.nl

+ 31 6 53 70 76 86

Read More