LuxSci

LuxSci Receives Majority Investment from Main Capital Partners

luxsci and main capital logos

Main Capital Partners announces a majority investment in Lux Scientiae, Incorporated (‘LuxSci’), a leading provider of healthcare-focused secure communications and secure hosting solutions. The investment reflects Main’s commitment to the healthcare market and desire to build robust, international software groups.

Founded in 1999, LuxSci is a leading American provider of HIPAA-compliant secure communications and secure hosting solutions. LuxSci’s application and infrastructure software enables organizations to securely deliver personalized sensitive data at scale. Certified by HITRUST to support customers with HIPAA compliance requirements, LuxSci serves dozens of healthcare enterprises and hundreds of middle-market organizations. Customers include providers, healthcare IT firms, medical device manufacturers, and companies active in other highly regulated industries.

With the strategic support of Main, LuxSci will strengthen its market position and its capabilities to meet the complex needs of modern healthcare organizations. In addition to fostering organic growth in the North American market, LuxSci and Main will explore opportunities for strategic acquisitions to expand the product portfolio and accelerate internationalization.

Erik Kangas (PhD), Founder & CEO of LuxSci, expressed his enthusiasm for the partnership, stating: “Having led LuxSci through 23 profitable bootstrapped years, I am extremely excited to partner with Main. Their resources and expertise will enable us to expand our technology and deepen our market penetration at a time when the demand for high-security communications solutions has never been greater.”

Jeanne Fama (PhD, MBA), COO & CSO of LuxSci, adds: “We are excited about the partnership’s potential to increase the awareness and adoption of LuxSci’s communication solutions and potentiate their impact in healthcare organizations seeking to improve clinical and business outcomes and increase patient satisfaction and loyalty.”

Main has demonstrated strong performance in both the healthcare and security markets, evidenced by investments such as Enovation (connected care solutions with over 350 employees across Europe) and Pointsharp (security and identity access management software with over 200 employees in Northwestern Europe). Main will leverage its experience and network in these markets to support LuxSci in its continued growth.

Daan Visscher, Co-Head of Main Capital North America, concludes: “We are thrilled to partner with the LuxSci team in spearheading the company’s next phase of growth. We are impressed by LuxSci’s double-digit recurring revenue growth, the underlying product, the management team’s capabilities, and the unwavering commitment to customers. We see ample opportunities to drive value through honing operational excellence, accelerating organic growth, and executing select strategic acquisitions. The result will be a robust, international software group positioned to meet the evolving needs of healthcare organizations.”

Pagemill Partners, the tech investment banking division of Kroll, served as financial advisor to LuxSci and Cooley LLP acted as legal advisor to LuxSci. Morse, Barnes-Brown & Pendleton, PC acted as legal advisor to Main.

About LuxSci

LuxSci is a leading provider of highly scalable secure communications and secure hosting solutions. Certified by HITRUST, LuxSci helps organizations navigate complex HIPAA regulations and safeguard sensitive data. LuxSci serves nearly 2,000 customers across healthcare and other highly regulated industries.

About Main Capital Partners

Main Capital Partners is a leading software investor active in Northwestern Europe and North America. Main has over 20 years of experience in software investing and works closely alongside management teams to achieve sustainable growth. Main has 70 employees operating out of its offices in The Hague, Stockholm, Düsseldorf, Antwerp, and Boston. Main has over EUR 2.2 billion in assets under management and maintains an active portfolio of over 40 software groups. The underlying portfolio employs over 12,000 employees.

Picture of LuxSci

LuxSci

Get in touch

Find The Best Solution For Your Organization

Talk To An Expert & Get A Quote




A member of our staff will reach out to you

Get Your Free E-Book!

LuxSci High Email Deliverability Best Practices Paper

What you’ll learn:

Related Posts

Zero Trust Email Security in Healthcare

Zero Trust Email Security in Healthcare: A Requirement for Sending PHI?

As healthcare organizations embrace digital patient engagement and AI-assisted care delivery, one reality is becoming impossible to ignore: traditional perimeter-based security is no longer enough. Email, still the backbone of patient and operational communications, has become one of the most exploited attack surfaces.

As a result, Zero Trust email security in healthcare is moving from buzzword to necessity.

At LuxSci, we see this shift firsthand. Healthcare providers, payers, and suppliers are no longer asking if they should modernize their security posture, but how to do it without disrupting care delivery or patient engagement.

Our advice: Start with a Zero Trust-aligned dedicated infrastructure that puts you in total control of email security.

Let’s go deeper!

What Is Zero Trust Email Security in Healthcare?

At its core, Zero Trust email security in healthcare applies the principle of “never trust, always verify” to every email interaction involving protected health information (PHI).

This means:

  • Continuous authentication of users and systems
  • Device and environment validation before granting access
  • Dynamic, policy-based encryption for every message
  • No implicit trust, even within internal networks

Unlike legacy approaches that assume safety inside the network perimeter, Zero Trust treats every email, user, and endpoint as a potential risk.

Why Email Is a Critical Gap in Zero Trust Strategies

While many healthcare organizations have begun adopting Zero Trust frameworks for network access and identity, email often remains overlooked.

This is a major problem.

Email is where:

  • PHI is most frequently shared
  • Human error is most likely to occur
  • Phishing and impersonation attacks are most effective

Without a Zero Trust email security approach, organizations leave a critical gap in their defense strategy, one that attackers can actively exploit.

Healthcare Challenge: Personalized Communication and PHI Risk

Modern healthcare ecosystems are highly distributed:

  • Care teams span multiple locations
  • Third-party vendors access sensitive systems
  • Patients expect digital, personalized communication

This creates a complex web of PHI exchange—much of it through email.

At the same time, compliance requirements like HIPAA demand that PHI email security is addressed at all times.

The result is a growing tension between:

  • Security and compliance
  • Usability, engagement, and better outcomes

From Static Encryption to Intelligent, Adaptive Protection

Traditional email encryption methods often rely on:

  • Manual triggers
  • Static rules
  • User judgment

This introduces risk. A modern zero trust email security in healthcare model replaces this with:

  • Automated encryption policies based on content and context
  • Flexible encryption methods tailored to recipient capabilities – TLS, Portal Fallback, PGP, S/MIME
  • Seamless user experiences that human error – automated email encryption, including content

At LuxSci, our approach to secure healthcare communications is built around this philosophy. By automating encryption and providing each customer with a zero trust-aligned dedicated infrastructure, organizations can protect PHI without relying on end-user decisions or the actions of other vendors on the same cloud, significantly reducing risk while improving performance, including email deliverability.

Aligning Zero Trust with HIPAA and Emerging Frameworks

Zero Trust is not a replacement for compliance, it’s an enabler. A well-implemented Zero Trust approach helps organizations:

  • Meet HIPAA requirements for PHI protection
  • Reduce the likelihood of breaches
  • Strengthen audit readiness and risk management

More importantly, it positions healthcare organizations to align with emerging cybersecurity frameworks that increasingly emphasize identity, data-centric security, and continuous verification.

PHI Protection Starts with Email

Zero Trust is no longer a conceptual framework, it’s becoming the operational standard for healthcare IT, infrastructure, and data security teams.

But success depends on execution. Email remains the most widely used, and vulnerable, communication channels in healthcare. Without addressing it directly, Zero Trust strategies will fall short.

Here are 3 tips to stay on track:

  • Treat every email as a potential risk
  • Automate encryption at scale – secure every email
  • Enable personalized patient engagement with secure PHI in email

At LuxSci, we believe that HIPAA compliant email is the foundation for the future of secure healthcare communications, protecting PHI while enabling better patient engagement and better outcomes.

Reach out today if you want to learn more from our LuxSci experts.

What Sets B2B Marketing In The Healthcare Industry Apart?

B2B marketing in the healthcare industry runs through a buying environment shaped by review, caution, and internal scrutiny. A vendor may catch interest quickly, yet a deal still has to survive procurement, legal input, operational questions, and, in some cases, clinical oversight. That changes the tone and structure of effective outreach. Buyers want clear information, credible framing, and content that holds up when shared across teams. Strong campaigns account for those conditions from the first touch, giving decision makers useful material at the right point in the conversation.

How B2B marketing in the healthcare industry differs from other sectors

Healthcare buying carries a heavier internal burden than many commercial categories. A decision can affect patient related workflows, staff time, data handling, vendor risk, and budget planning all at once. That wider impact shapes how people read. A finance lead may scan for commercial logic and resource use. An operations leader may think immediately about rollout pressure and process disruption. An IT contact may focus on access, integration, and control. Messaging has to stand up to each of those viewpoints. That is why strong healthcare outreach tends to move with more restraint, more clarity, and more attention to proof than campaigns built for faster sales environments.

Trust within B2B marketing in the healthcare industry

Trust grows through judgment on the page. Buyers notice inflated language very quickly, especially when it appears in sectors where risk and accountability are part of everyday work. A polished headline can attract attention, though the body copy still has to carry weight. Clear examples help. Plain explanations help. So does a tone that sounds measured enough for someone to forward internally without hesitation. A payer team may want to see how a service affects review speed or administrative flow. A provider group may care about intake, coordination, or staff workload. A supplier may look for signs that communication across partners will become smoother and easier to manage. Credibility builds when the writing shows a close read of the reader’s world.

Buying committees do not think alike

Most healthcare deals are shaped by several people with different pressures attached to their roles. Procurement may be looking for vendor reliability and a smoother approval process. Compliance may read for privacy exposure and documentation. Operations may focus on practical fit with current workflows. Finance may want a clearer commercial case before the conversation goes any further. Those concerns do not compete with one another so much as stack on top of one another, which is why broad messaging tends to flatten out. Better campaigns anticipate that mix. One sequence can speak to efficiency and team workload. Another can support legal and compliance review. A third can frame the economic rationale in language senior stakeholders will recognise immediately.

Content that helps a deal move

Healthcare content earns its place when it gives buyers something they can use, discuss, and circulate. A short article on referral bottlenecks can help an operations lead frame the problem more clearly. A concise guide to secure communication can help internal teams ask better questions during review. A comparison page on implementation models can help a buyer weigh practical tradeoffs before a call is even booked. Useful content creates momentum because it fits the way decisions are made. It enters the conversation early, gives people sharper language for internal discussion, and keeps the subject alive between meetings. That is where strong work starts to separate itself from content written simply to fill a calendar.

Measuring progress with better signals

Healthcare teams get a clearer picture when they look past surface numbers and pay attention to the signs attached to real interest. Repeat visits from the same account can matter more than a large burst of low value traffic. A reply from an operations contact may tell you more than a high open rate. Visits to implementation, privacy, or procurement pages can indicate that the discussion is moving into a more serious stage.

Patterns like these help commercial teams judge where attention is gathering and where timing is starting to matter. Good B2B marketing in the healthcare industry supports that process by creating sharper entry points for sales, stronger context for follow up, and a more informed path from early curiosity to active evaluation.

Why Does B2B Healthcare Email Marketing Matter To Healthcare Buyers?

B2B healthcare email marketing is the practice of using email to reach healthcare business audiences with timely, relevant communication that supports trust, evaluation, and purchase decisions. In healthcare, that means more than sending promotional copy. Buyers want proof that a vendor understands procurement realities, privacy expectations, clinical workflows, and the pace of internal review. When the message is well judged, email helps move a conversation forward without forcing it. It can introduce a problem, frame the business case, and give decision makers something useful to circulate inside the company while they weigh next steps.

What makes B2B healthcare email marketing work in real buying cycles?

The difference between ignored email and useful email is context. Healthcare deals rarely move on impulse, and very few readers want a sales pitch in their inbox after one click or one download. Good B2B healthcare email marketing takes its cues from where the buyer is in the process. A first touch might define a problem in plain terms. A later message may explain implementation questions, privacy considerations, or internal adoption issues. That sequencing matters because healthcare buyers read with caution. They are not just asking whether a product looks good. They are asking whether it can survive legal review, procurement review, and scrutiny from the teams who will live with it day after day.

How does compliance shape B2B healthcare email marketing?

Healthcare email lives under closer scrutiny than email in many other industries. If a campaign touches protected health information, HIPAA enters the conversation immediately, especially the Privacy Rule and Security Rule. Even when outreach is aimed at business contacts, teams still need a disciplined view of what data is stored, who can access it, and how consent, opt out, and message content are handled.

The CAN SPAM Act also matters because sender identity, subject line accuracy, and unsubscribe function are not small details. Strong B2B healthcare email marketing treats compliance as part of message design from the start. That leads to cleaner copy, better internal approval, and fewer edits after legal teams step in.

Which audiences respond best to B2B healthcare email marketing?

Healthcare buying groups are rarely made up of one decision maker. A payer executive may care about administrative efficiency and audit readiness. A provider operations leader may be focused on referral flow, patient intake, or staff time. A supplier may look at partner communication, order handling, or data movement between systems. B2B healthcare email marketing works better when each audience receives language that matches its concerns instead of one generic message sent to everyone. That does not require jargon. It requires precision in the everyday sense of the word. Readers need to feel that the sender understands the pressures attached to their role, not just the industry label attached to their company.

What kind of content earns trust instead of quick deletion?

Healthcare buyers respond well to emails that help them think clearly. A short note that explains why referral leakage happens will land better than a vague message about transformation. A concise example showing how a health plan cut review delays can do more than a page of inflated claims. This is where B2B healthcare email marketing becomes persuasive without sounding pushy. The best messages teach, but they also move. They give the reader one useful idea, one practical example, and one reason to keep the conversation alive. That balance matters because healthcare readers are trained to be skeptical, and skepticism is not a barrier when the content respects it.

How can teams judge whether the program is doing its job?

Open rate alone does not say much in a long healthcare sales cycle. A better read comes from the quality of replies, the number of relevant page visits after a send, the movement of target accounts through the pipeline, and the way contacts share content internally.

B2B healthcare email marketing earns its place when it helps sales teams enter conversations with better timing and better context. If email is drawing the right people back to security pages, implementation pages, or procurement material, that is a useful signal. The real win is steady progress with buyers who need time, evidence, and confidence before they move.

HIPAA Compliant Email

New HIPAA Security Rule Makes Email Encryption Mandatory—Act Now!

The 2026 Deadline Is Closer Than You Think

The upcoming HIPAA Security Rule overhaul is expected to finalize by mid-2026, and it’s shaping up to be one of the most significant updates in years. Healthcare organizations that fail to prepare, especially when it comes to email security, will face immediate compliance gaps the moment enforcement begins.

Mid-2026 may sound distant, but for healthcare IT and compliance leaders, it’s right around the corner. Regulatory change at this scale doesn’t happen overnight, it requires planning, vendor evaluation, implementation, and internal alignment.

This isn’t a gradual shift. It’s a hard requirement.

Encryption Is About to Become Mandatory

For years, HIPAA has treated encryption as “addressable,” giving organizations flexibility in how they protect sensitive data. That flexibility is disappearing.

Under the updated rule, encryption, particularly for email containing protected health information (PHI), is expected to become a required safeguard.

That means:

  • Encryption must be automatic and standard for email, not optional
  • Policies must be enforced consistently
  • Email security can’t depend on human behavior

If your current system relies on users to manually trigger encryption, it’s already out of step with where compliance is heading. If you’re not encrypting your emails at all, then now is the time to re-evaluate and rest your technology and policies.

Email Is the Weakest Link in Healthcare Security

Email remains the most widely used communication tool in healthcare—and the most common source of data exposure. Every day, sensitive information flows through inboxes, including patient records, lab results, billing details, plan renewals and appointment reminders. Yet many organizations still depend on:

  • Basic TLS encryption that only works under certain conditions
  • Manual processes that leave room for human error
  • Limited visibility into email activity and risk

It only takes one mistake, such as a missed encryption trigger or a misaddressed email, to create a reportable breach. Regulators are well aware of this. That’s why email is a primary focus of the upcoming HIPAA Security Rule changes.

The Cost of Waiting Is Higher Than You Think

Delaying action may feel easier in the short term, but it significantly increases risk. Once the new rule is finalized, organizations without compliant systems may face:

  • Immediate audit failures
  • Regulatory penalties
  • Expensive, rushed remediation efforts
  • Or worst of all, an email security breach

Beyond financial consequences, there’s also reputational harm. Patients expect their data to be protected. A single incident can immediately erode trust and damage your brand beyond repair.

Waiting until the end of 2026 also means that you’ll be competing with every other organization trying to fix the same problem at the same time, driving up costs and limiting vendor availability.

Most Email Solutions Won’t Meet the New Standard

Here’s the uncomfortable reality: many existing email platforms won’t be enough, especially those that are not HIPAA compliant. Common gaps include:

  • Encryption that isn’t automatic or policy-driven
  • Lack of Data Loss Prevention (DLP)
  • Insufficient audit logging for compliance reporting
  • Lack of Zero Trust security principles

On top of that, vendors without alignment to HITRUST certification and Zero-Trust architectures may struggle to demonstrate the level of assurance regulators will expect moving forward.

If your current solution wasn’t designed specifically for healthcare and HIPAA compliance, it’s likely not ready for what’s coming.

LuxSci Secure Email: Built for What’s Next

This is where a purpose-built solution makes all the difference. LuxSci HIPAA compliant email is designed specifically for healthcare organizations navigating the latest compliance requirements, not just today, but in the future regulatory landscape.

LuxSci delivers:

  • Automatic, policy-based encryption that removes user guesswork
  • Advanced DLP controls to prevent PHI exposure before it happens
  • Comprehensive audit logs to support audits and investigations
  • Zero Trust architecture that verifies every user and action

Additionally, LuxSci is HITRUST-certified, helping organizations demonstrate a mature and defensible security posture as regulations tighten. Email data protection isn’t about patching gaps, it’s about eliminating them.

Act Now or Pay Later

If there’s one takeaway, it’s this: the time to act is now. Start by asking a few direct questions:

  • Is our email encryption automatic and enforced?
  • Do we have full visibility into email activity and risk?
  • Is our vendor equipped for evolving HIPAA requirements?

If the answer to any of these is unclear, now’s the time to take action. Organizations that move early will have time to implement the right solution, train their teams, and validate compliance. Those that wait will be forced into reactive decisions under pressure.

Conclusion: The Time to Act is Now!

The HIPAA Security Rule overhaul is coming fast, and it’s raising expectations across the board. Encryption will no longer be addressable, but rather mandatory. As a result, email security can no longer be overlooked, and compliance will no longer tolerate gaps.

LuxSci HIPAA compliant email provides a clear, future-ready path for your organization, combining automated encryption, DLP, auditability, and Zero Trust security in one solution.

The real question isn’t whether change is coming. It’s whether your organization will be ready when it does.

Reach out today. We can look at your existing set up, help you identify the gaps, and show you how LuxSci can help!

FAQs

1. When will the updated HIPAA Security Rule take effect?
The changes to the HIPAA Security Rule are expected to be finalized and announced around mid-2026, with enforcement likely soon after, by the end of the year.

2. Will email encryption truly be mandatory?
Yes, current direction strongly indicates encryption will become a required safeguard, which could start later this year or in early 2027.

3. Is TLS encryption enough for compliance?
No. TLS alone does not provide sufficient, guaranteed protection for PHI.

4. Why is HITRUST important in this context?
HITRUST certification demonstrates a vendor’s strong alignment with healthcare security standards and will likely carry more weight with regulators.

5. How does LuxSci help organizations prepare?
HITRUST-certified LuxSci offers secure email with automated encryption, DLP, audit logs, and Zero Trust architecture, helping organizations meet evolving compliance demands.

You Might Also Like

LuxSci Secure Texting for Healthcare Apps

How Secure Texting for Healthcare Improves Patient Portals

Patient portals were once hailed as a game-changing tool for healthcare companies to engage patients throughout their healthcare journey. In theory, they offer a convenient platform where patients and customers can access their medical records, communicate with their providers or suppliers, book appointments, and even pay bills—safely and securely. But despite the optimism around patient portals, the reality is much more complex. Adoption rates remain stubbornly low, and many patients simply don’t like using them.

So, why is this the case? More importantly, how does the relatively mediocre adoption of patient portals impact patient engagement, outcomes, and overall cost?

In this post, we’ll take a closer look at the shortcomings of patient portals, share current trends in patient and customer communication preferences, and explore how text communication can improve portal adoption and patient engagement.

Why Patient Portals Aren’t Enough

At their core, patient portals are online platforms that provide access to a range of healthcare-related services. These services typically include:

  • Access to medical records
  • Secure messaging with healthcare providers
  • Appointment scheduling
  • Prescription refill requests
  • Bill payments

These portals were designed with good intentions, but as we’ll discuss, they often fall short of delivering the seamless, user-friendly experience that people expect today.

LuxSci Secure Texting for Healthcare Apps

Preferences for Healthcare Communications

Healthcare communication preferences have shifted. Today’s patients don’t just want portals—they want a range of communication options, from phone calls and emails to secure texts. According to a 2023 survey by Accenture, patients’ preferred communication channels include:

  • Phone Calls: 62% of patients still prefer phone conversations with their healthcare providers.
  • Email: 44% like receiving emails for lab results, appointment reminders, and other updates.
  • Text Messaging: 37% of patients prefer receiving healthcare communications via text, particularly for reminders and follow-ups.
  • Patient Portals: Only 28% of patients prefer using portals for routine interactions.

There are several reasons why people are reluctant to adopt patient portals, including:

  • Complexity: Many portals can be clunky, difficult to navigate, and not user-friendly. Patients and customers often find it difficult to log in, locate their information, or contact their provider or supplier through the portal.
  • Lack of Engagement: Patients are rarely encouraged to use these portals consistently, and some are unaware they even exist.
  • Concerns About Security: While patient portals are designed to be secure, many patients still harbor concerns about their personal health information being compromised.
  • Limited Access: Some portals only provide limited access to medical records, appointment scheduling, or other information, making them less useful.

Relying solely on patient portals leaves a significant portion of patients and customers under-served. By integrating secure texting apps into their engagement strategies, healthcare providers, payers and suppliers can diversify their communication methods and connect with patients and customers more effectively across the channels they prefer.

How Secure Texting Complements Patient Portals

Secure texting apps for healthcare solve many of the issues patient portals alone cannot. By offering an additional, patient-friendly communication channel, these apps improve patient engagement and streamline interactions.

Here’s how secure texting apps work:

  • Secure Access to Patient Portals: Secure texting apps allow patients to access ePHI and other sensitive information directly from mobile devices via regular SMS text messages.
  • Instant Notifications & Alerts: Patients and customers can click on a link in text messages and view information in a secure mobile web browser on their smartphones or tablets, including appointment reminders, updates, product upgrades and promotions.
  • User-friendly: Most secure texting apps are designed with usability in mind, offering an intuitive, seamless experience  – with no new applications required.

By offering secure texting as an additional communication channel, healthcare organizations can reach more patients and customers, and improve engagement by offering patients multiple channel options for communication and easier access to portals.

Security and HIPAA Compiance

It’s essential to note that not all texting apps are appropriate for healthcare use. Traditional text messaging services don’t offer the level of encryption and security required by HIPAA regulations, making them risky for exchanging protected health information (PHI).

LuxSci’s secure texting for healthcare ensures that patient and customer communications comply with HIPAA’s strict privacy and security standards. Our secure texting solution offers encryption, authentication, and data protection, ensuring that patients can directly and safely access portals for viewing health information, treatment plans, payments, promotions and more.

Benefits of Secure Texting for Healthcare

Adopting secure texting apps for healthcare, alongside other communication tools, including email and web forms, brings numerous benefits to both patients and providers, including:

  • Increased Engagement: Patients and customers are more likely to respond and engage with providers through their preferred communication method, not just a portal.
  • Improved Outcomes and Results: Engaged patients are more likely to adhere to their treatment plans, stay informed and use the right products, improving overall health outcomes.
  • Lower Costs and Greater Efficiency: Better communication leads to fewer missed appointments, more efficient processes and greater patient participation in their healthcare journeys.
  • Greater Satisfaction: Patients and customers appreciate having a choice in how they communicate with their providers and healthcare suppliers, leading to higher satisfaction, loyalty and trust.
  • Reduce Missed Appointments: Instant notifications and reminders via text can help patients stay on top of their appointments and follow-ups.

Secure Texting is Key to Modern Healthcare Communication

Patient portals alone are no longer enough to drive the kind of patient engagement needed for optimal healthcare outcomes. By integrating secure texting apps for healthcare with other communication tools like email and web forms, providers can offer a more patient-centric approach to healthcare communication.

At LuxSci, we’re committed to helping healthcare providers offer secure, HIPAA-compliant communication solutions that improve patient engagement, outcomes and results. By giving patients the flexibility to choose their preferred communication channel—whether it’s secure texting, email, phone, or a patient portal—you can increase engagement, improve outcomes, and lower costs.

Want to learn more about secure texting for healthcare? Reach out and connect with us today!

FAQs

  1. What are secure texting apps for healthcare? Secure texting apps for healthcare are HIPAA-compliant platforms that enable encrypted, secure communication between healthcare providers and patients via text message.
  2. Why are patient portals underutilized? Patient portals often have usability issues, complex login procedures, and limited functionality, making them less appealing to patients and customers.
  3. Is secure texting HIPAA-compliant? Yes, when done through solutions like LuxSci Secure Text, communications can be encrypted and meet HIPAA’s stringent security requirements.

Send Secure Emails: Alternatives to Web Portals

Digital technologies have entirely shifted how individuals want to interact with their healthcare providers. As consumers have become used to emailing or texting with their hairstylists, mechanics, and other providers to schedule appointments, they want to have the same level of interaction with their healthcare providers.

However, many healthcare organizations find it challenging to deliver the same experience because of their compliance requirements under HIPAA. They must balance usability and access with security and patient privacy. To send secure emails, they often resort to secure web portals. 

mail sending from phone Send Secure Emails: Alternatives to Web Portals

Problems with Secure Web Portals

One of the most common ways that healthcare organizations communicate securely with patients is by using the secure web portal method of email encryption. In this scenario, messages are sent to a secure web server, and a notification is sent to the recipient, who then logs into the portal to retrieve the message.

While highly secure, this method is not popular with recipients because of the friction it creates.

To maintain a high level of security, users must log in to a separate account to retrieve the message. This extra step creates a barrier, especially for individuals who are not tech-savvy. In addition to creating a new account, they must remember a different username and password to access their secure messages. If the recipient doesn’t have this information readily available, they will likely delete the message and move on with their day. Many users will never bother logging in because of the inconvenience. This creates issues for organizations that want to use email for standard business communications and patient engagement efforts. 

While this method may be appropriate for sending highly sensitive information like medical records, financial documents, and other valuable information, many emails that must meet compliance requirements only infer sensitive information and do not require such a high level of security. Flu shot reminder emails are not as sensitive or potentially devastating as sending the wrong medical file to someone. Healthcare organizations need to use secure email solutions that are flexible enough to send only the most sensitive emails to the portal and less sensitive emails using other methods.

How to Meet Compliance Requirements for Sending Secure Email

So, what other options do you have for sending secure emails? The answer will depend on what specific requirements you need to meet. Healthcare organizations that must abide by HIPAA regulations will find a lot of flexibility regarding the technologies they can use to protect ePHI in transit.

In addition to a secure web portal, three other types of encryption are suitable for email sending: TLS, PGP, and S/MIME. PGP and S/MIME are more secure than a web portal. They also require advanced technological skills and coordination with the end-user to implement, which makes them impractical for most business email sending.

That leaves us with TLS, which is suitable to meet most compliance standards (including HIPAA) and delivers an email experience much like that of a “regular” email.

Send Secure Emails with TLS Encryption

TLS encryption is an excellent option for secure email sending that provides a seamless experience for the recipient. Emails sent securely with TLS appear like regular, unencrypted emails in the recipient’s inbox.

TLS encrypts the message contents as they travel between mail servers to prevent interception and eavesdropping. Once the message reaches the inbox, it is unencrypted and can be read by anyone with access to the email account. For this reason, it is less secure than a portal but secure enough to meet compliance requirements like HIPAA.

If you’re wondering why this is, HIPAA only requires covered entities and business associates to protect PHI when it is stored on their systems or as it is transmitted elsewhere. After the message reaches the recipient, it is up to the recipient to decide what they want to do to secure the information. HIPAA does not apply to individuals. Each person is entitled to share and store their health information however they see fit.

Conclusion

Balancing security and usability is a significant challenge for healthcare organizations. If the message is too secure, it may be difficult for the recipient to open and engage with it. If it’s not secure enough, it is too easy for cybercriminals and other bad actors to intercept private information as it is sent across the internet. 

Choosing an email provider like LuxSci, which offers flexible email encryption options, allows users to choose the right level of encryption for each message to maximize engagement and improve health outcomes. Contact our team today to learn more about how we can support your efforts.

LuxSci Executive Appointments Sullebarger Du Lac

LuxSci Expands Executive Team to Scale Enterprise Growth and Operations

LuxSci, a leading provider of secure, HIPAA-compliant communications software, today announced new executive appointments as part of its strategy to drive future growth and further expansion into the enterprise market. Experienced B2B software executives Robert Sullebarger and Geneviève du Lac have joined the company as Head of Sales and Head of Finance, respectively – reporting to recently appointed CEO Mark Leonard. In addition, David Hillman has joined the company as Director of Engineering, reporting to Erik Kangas, Chief Technology Officer.

“LuxSci has proven its capabilities with some of the largest, most forward-looking companies in healthcare, including patient engagement platform, EHR systems, and payment providers, as well as healthcare retail and in-home care providers,” said Leonard. “Bob, Geneviève and David all bring deep leadership experience combined with a willingness to be hands-on in helping us optimize our operations and execute quickly for our customers and partners.”

Proven Sales Leader and Trusted Advisor

Bob’s career has focused on enterprise software sales and customer acquisition across both established and emerging technologies, including security & compliance, conversational AI and virtual assistant platforms, machine learning, and telecom & networking. Bob brings LuxSci more than two decades of experience in sales, marketing, and product management roles, serving as both a trusted business advisor and a technology expert for customers and partners. Most recently, he led the sales teams for AI solution providers ModuleQ and Interactions LLC, where he helped the company grow from $10 million to more than $100 million in annual revenue. He has also held leadership positions at contact center analytics provider CallMiner, and data security provider Vericept Corporation.

“LuxSci is the gold standard for HIPAA-compliant email and secure healthcare communications with a leadership position in the market,” said Sullebarger. “With healthcare portal adoption maxing out, we have a real opportunity to improve patient engagement and outcomes by opening up the email, SMS and marketing channels to bring more people into today’s healthcare conversation.” 

Experienced CFO and Finance Leader

Geneviève joins LuxSci with more than 15 years of experience in CFO and Finance leadership roles. This includes building world-class Finance teams and organizations in the cybersecurity, consumer, and services industries at companies including Cypress Security, Astro Gaming and Wine Country Connect. Throughout her career Geneviève has established a proven track record of success in Finance leadership for ‘scale-up’ businesses, with focus on SaaS companies. Geneviève also brings LuxSci deep experience in implementing systems & processes aimed at building operational scalability, which will be a key part of her responsibilities at the company.

“I’m excited to be joining LuxSci as we build it into a world-class organization,” said Du Lac. “The company has achieved tremendous success to date, and we’re positioned better than ever to keep growing – and to help transform the healthcare industry with secure communications.”

Full Stack Software Architect and Data Scientist

David joins LuxSci with more than 20 years of experience across the entire spectrum of application development, data analysis and automated systems. This includes architect, engineer, developer, and consultant roles at innovative companies, such as Kapital Trading, Gogo, Monster, Livetext, and AT&T Bell Labs. David specializes in designing and building data-intensive applications that analyze large datasets and extract intelligence, as well as developing tools to empower users to interact with those resources. At LuxSci, David will play a key role in the future development of LuxSci technology, helping guide the company’s product direction and roadmap moving forward.

“I’m looking forward to collaborating with the outstanding team already in place at LuxSci and continuing to enhance our products to make our customers’ healthcare communications and operations both smoother and safer,” said Hillman.

In other recent news, LuxSci continues to innovate in secure healthcare communications, recently rolling out new email reporting capabilities and achieving best-in-class performance for email security.

LuxSci has been at the forefront of HIPAA-compliant communications since its inception, offering a full suite of products for secure email, marketing, text and forms. Today, LuxSci is used by nearly 2,000 customers for HIPAA-compliant communications across the healthcare industry, including athenaHealth, 1800 Contacts, Delta Dental, Lucerna Health, Hinge Health, and Rotech Healthcare.

If you’d like to learn more about how LuxSci can help you with secure healthcare communications, reach out to us today for a meeting or demo!

HIPAA Compliant

Can a Website Be HIPAA Compliant?

A website can be HIPAA compliant when it incorporates security measures, privacy protections, and data handling practices that meet HIPAA regulatory requirements. Healthcare organizations must implement encryption, access controls, audit logging, and secure data storage for websites that collect, store, or transmit protected health information. A well configured HIPAA compliant website helps healthcare providers maintain patient privacy while offering online services.

HIPAA Website Requirements

Websites handling protected health information must meet the standards established in the HIPAA Security Rule. These requirements include encryption for data transmission using protocols like TLS 1.2 or higher. Access controls limit website data viewing to authorized personnel with appropriate login credentials. Audit logging tracks all user activities and data access attempts across the website. Session timeouts automatically log out inactive users to prevent unauthorized access. Regular security testing identifies and addresses potential vulnerabilities. These measures work together to protect patient information from unauthorized access or disclosure.

Website Hosting and Infrastructure

HIPAA compliant hosting provides the foundation for a secure healthcare website. When selecting a hosting provider, healthcare organizations look for companies willing to sign a Business Associate Agreement (BAA). This legal document establishes the hosting provider’s responsibilities for protecting health information. The physical location of servers matters, with many HIPAA compliant services using data centers with restricted access, environmental controls, and monitoring systems. Network protection typically includes firewalls, intrusion detection, and regular security updates. Organizations often choose dedicated hosting environments rather than shared servers to maintain data separation.

Patient Data Collection and Forms

Most healthcare websites collect information through online forms. HIPAA compliant websites include appropriate authorization language on these forms before gathering protected health information. Well-designed websites explain how patient data will be used in clear, accessible language. Form data requires protection both during transmission and after submission. Many websites use secure database connections and encryption for stored information. Healthcare organizations determine what information they actually need to collect, following the minimum necessary standard from HIPAA regulations. User-friendly form design can improve completion rates while maintaining compliance.

Secure Patient Portals and Interaction

Patient portals on HIPAA compliant websites allow secure access to medical records, appointment scheduling, and provider communications. These portals employ authentication measures like password requirements and account recovery processes. Many implement automatic timeout features that log out inactive users after a set period. Secure messaging features enable patient-provider communication without using standard email. The best patient portals maintain detailed logs of all system access and actions. Healthcare organizations integrate these portals with their electronic health record systems for data consistency and accuracy.

Mobile Responsiveness and App Integration

Modern HIPAA compliant websites function across various devices while maintaining security protections. Mobile responsive design allows patients to access information securely from smartphones and tablets. When healthcare organizations develop companion mobile apps, these applications need the same HIPAA compliance measures as their websites. Integration between websites and mobile applications requires secure API connections and consistent authentication methods. Many healthcare providers test their digital platforms across multiple devices to ensure both functionality and security. The mobile experience influences patient satisfaction with digital healthcare services.

Compliance Maintenance

Healthcare websites require regular updates and monitoring to maintain HIPAA compliance over time. Technology changes quickly, and security measures that worked previously may become outdated. Website administrators perform regular security scans and vulnerability testing. Organizations document these maintenance activities as evidence of compliance efforts. Staff training helps ensure everyone handling website data understands privacy requirements. As regulations evolve, websites need corresponding updates to privacy notices and security features. Many healthcare organizations work with compliance consultants who specialize in digital healthcare requirements.