LuxSci Receives Majority Investment from Main Capital Partners

Business Solutions, Company Announcements, Industry News
LuxSci
November 3, 2023

Main Capital Partners announces a majority investment in Lux Scientiae, Incorporated (‘LuxSci’), a leading provider of healthcare-focused secure communications and secure hosting solutions. The investment reflects Main’s commitment to the healthcare market and desire to build robust, international software groups.

Founded in 1999, LuxSci is a leading American provider of HIPAA-compliant secure communications and secure hosting solutions. LuxSci’s application and infrastructure software enables organizations to securely deliver personalized sensitive data at scale. Certified by HITRUST to support customers with HIPAA compliance requirements, LuxSci serves dozens of healthcare enterprises and hundreds of middle-market organizations. Customers include providers, healthcare IT firms, medical device manufacturers, and companies active in other highly regulated industries.

With the strategic support of Main, LuxSci will strengthen its market position and its capabilities to meet the complex needs of modern healthcare organizations. In addition to fostering organic growth in the North American market, LuxSci and Main will explore opportunities for strategic acquisitions to expand the product portfolio and accelerate internationalization.

Erik Kangas (PhD), Founder & CEO of LuxSci, expressed his enthusiasm for the partnership, stating: “Having led LuxSci through 23 profitable bootstrapped years, I am extremely excited to partner with Main. Their resources and expertise will enable us to expand our technology and deepen our market penetration at a time when the demand for high-security communications solutions has never been greater.”

Jeanne Fama (PhD, MBA), COO & CSO of LuxSci, adds: “We are excited about the partnership’s potential to increase the awareness and adoption of LuxSci’s communication solutions and potentiate their impact in healthcare organizations seeking to improve clinical and business outcomes and increase patient satisfaction and loyalty.”

Main has demonstrated strong performance in both the healthcare and security markets, evidenced by investments such as Enovation (connected care solutions with over 350 employees across Europe) and Pointsharp (security and identity access management software with over 200 employees in Northwestern Europe). Main will leverage its experience and network in these markets to support LuxSci in its continued growth.

Daan Visscher, Co-Head of Main Capital North America, concludes: “We are thrilled to partner with the LuxSci team in spearheading the company’s next phase of growth. We are impressed by LuxSci’s double-digit recurring revenue growth, the underlying product, the management team’s capabilities, and the unwavering commitment to customers. We see ample opportunities to drive value through honing operational excellence, accelerating organic growth, and executing select strategic acquisitions. The result will be a robust, international software group positioned to meet the evolving needs of healthcare organizations.”

Pagemill Partners, the tech investment banking division of Kroll, served as financial advisor to LuxSci and Cooley LLP acted as legal advisor to LuxSci. Morse, Barnes-Brown & Pendleton, PC acted as legal advisor to Main.

About LuxSci

LuxSci is a leading provider of highly scalable secure communications and secure hosting solutions. Certified by HITRUST, LuxSci helps organizations navigate complex HIPAA regulations and safeguard sensitive data. LuxSci serves nearly 2,000 customers across healthcare and other highly regulated industries.

About Main Capital Partners

Main Capital Partners is a leading software investor active in Northwestern Europe and North America. Main has over 20 years of experience in software investing and works closely alongside management teams to achieve sustainable growth. Main has 70 employees operating out of its offices in The Hague, Stockholm, Düsseldorf, Antwerp, and Boston. Main has over EUR 2.2 billion in assets under management and maintains an active portfolio of over 40 software groups. The underlying portfolio employs over 12,000 employees.

LuxSci

Get in touch

Find The Best Solution For Your Organization

Talk To An Expert & Get A Quote

First Name

Last Name

Work Email

Phone

Company

Type of Inquiry

Company Size

Message (optional)

Acceptance

I consent to be contacted by LuxSci for this inquiry and other relevant content, products, and services. You may unsubscribe from these communications at any time. We're committed to your privacy. For more information, check out our Privacy Policy.

A member of our staff will reach out to you

Search

Get Your Free E-Book!

LuxSci High Email Deliverability Best Practices Paper

What you’ll learn:

LuxSci Awarded 20 Badges in the G2 Summer 2026 Reports

May 28, 2026
Pete Wermter

We’re excited to announce that LuxSci has again been recognized by G2 with 20 badges in its just-released Summer 2026 Reports, highlighting our continued leadership in secure healthcare communications and HIPAA compliant email solutions.

The new LuxSci G2 recognitions span several categories, including:

Best Estimated ROI
Best Support
High Performer
Leader

These latest LuxSci G2 awards reflect what matters most to our customers: delivering secure, HIPAA compliant healthcare communications backed by responsive support and measurable business results.

As one of the most trusted providers of HIPAA compliant email, marketing, and forms solutions, we’re proud to see our commitment recognized across multiple product categories and customer satisfaction metrics.

Recognition Built on Customer Experience

LuxSci’s G2 rankings are based on verified customer feedback and real-world user experiences, making these badges especially meaningful to our team.

This year’s Summer Reports recognized LuxSci for consistently delivering value to healthcare organizations looking to securely engage patients and customers while maintaining compliance with HIPAA requirements.

Among the highlights, the LuxSci G2 recognition includes:

Best Estimated ROI, reflecting the measurable value customers achieve through secure healthcare communications and personalization
Best Support, reinforcing LuxSci’s long-standing reputation for responsive, knowledgeable customer service
High Performer badges across multiple categories for customer satisfaction and product performance
Leader recognition for delivering secure, scalable communications solutions trusted by healthcare organizations

At LuxSci, we believe secure communications should also drive better engagement, stronger outcomes and operational efficiency. These recognitions reinforce our focus on helping healthcare providers, payers and suppliers personalize communications while protecting sensitive patient data.

Supporting the Future of Personalized Healthcare Engagement

LuxSci’s secure healthcare communication and patient engagement solutions empower organizations to safely communicate with patients and customers through:

HIPAA-compliant high volume email
Secure email marketing
Secure forms and data collection
Flexible encryption with SecureLine technology

Our solutions are designed to help healthcare organizations improve engagement, streamline workflows and personalize the healthcare journey while maintaining the highest standards of security and compliance.

These latest LuxSci G2 recognitions also build on LuxSci’s broader reputation for security, performance and customer success. Security and trust remain foundational to everything we do, alongside our commitment to delivering smart, responsive support for our customers.

Thank You to Our Customers

We’re grateful to our customers for their continued trust, collaboration and feedback. Their reviews and insights help shape our products and drive ongoing innovation across the LuxSci product set.

To learn more about LuxSci’s secure healthcare communications solutions, contact our team to schedule a secure email assessment or demo.

Connect with us today!

Is OCR Already Enforcing Email Encryption Under the New HIPAA Security Rule?

May 12, 2026
Pete Wermter

Healthcare organizations waiting for the final HIPAA Security Rule updates before improving email encryption and security may already be behind.

While the proposed changes to the HIPAA Security Rule are expected to be finalized in May, the direction from the U.S. Department of Health and Human Services Office for Civil Rights (OCR) is becoming increasingly clear. Across investigations, settlements, and enforcement actions, OCR continues emphasizing stronger technical safeguards, encryption, documented security programs, multi-factor authentication (MFA), risk analysis, and proactive cybersecurity operations.

For healthcare organizations, one area stands directly in the middle of all of these priorities: email.

Email remains a primary communication channel in healthcare — and one of the industry’s largest security vulnerabilities. From unauthorized PHI exposure to phishing attacks and ransomware delivery to account compromise, email continues to be at the center of healthcare cybersecurity incidents.

So, are the proposed HIPAA Security Rule changes hypothetical future guidance or a preview of OCR’s future enforcement expectations?

For healthcare email security, the implications are significant.

Email = Healthcare Cybersecurity Risk

Healthcare organizations rely on email for critical communications and healthcare workflows, including:

Patient communications
Care coordination
Claims and billing notifications
Marketing and engagement
Internal collaboration
Third-party vendor communications
Delivery of sensitive PHI

At the same time, attackers continue targeting email systems because they remain one of the easiest entry points into healthcare environments.

Insecure email workflows create unnecessary exposure of protected health information. Phishing campaigns are becoming more sophisticated. Credential theft attacks are bypassing traditional MFA methods. And business email compromise (BEC) attacks continue rising.

Recent OCR enforcement actions increasingly reflect these realities.

Organizations are being evaluated not simply on whether a breach occurred, but whether they implemented reasonable safeguards beforehand, including encryption, authentication controls, monitoring, access management, and documented risk mitigation processes.

For email systems specifically, that means healthcare organizations should expect increased scrutiny around:

Email encryption enforcement
MFA deployment
Audit logging and retention
Conditional access policies
Vendor security controls
Secure email delivery best practices
Segmentation and infrastructure isolation
Ongoing patch and vulnerability management

In many ways, email infrastructure is becoming a visible test of an organization’s overall cybersecurity posture.

Email Encryption Is Moving From Addressable to Required

Historically, healthcare organizations often interpreted HIPAA email encryption requirements with flexibility because encryption was technically categorized as an “addressable” safeguard under the Security Rule. But, OCR enforcement and broader cybersecurity realities are changing that interpretation rapidly.

Today, failing to encrypt sensitive healthcare communications increasingly creates both security and regulatory risk. The proposed Security Rule updates place even greater emphasis on encryption and technical safeguards. At the same time, OCR investigations continue examining whether organizations properly protected PHI in transit and at rest.

For healthcare email specifically, this creates several growing expectations:

Email encryption should be automated wherever possible
Human error should not determine whether PHI is protected
Organizations should maintain documented encryption policies
Secure delivery methods should adapt dynamically to recipient capabilities
Audit trails should demonstrate how messages were secured

At LuxSci, we have long believed that encryption should operate as a strategic layer of healthcare communications infrastructure, not as a manual user decision.

Our SecureLine email encryption technology automatically applies appropriate encryption methods based on organizational policies and delivery requirements, helping reduce the risks associated with human error while maintaining usability, deliverability and compliance. As enforcement expectations rise, this type of automated security enforcement is becoming increasingly important.

Traditional MFA May No Longer Be Enough

Another major shift emerging from both OCR enforcement trends and the proposed rule updates is the growing importance of stronger authentication models.

Healthcare organizations have historically viewed MFA deployment as sufficient protection. But attackers have adapted quickly.

MFA bypass attacks, token theft, session hijacking, and consent phishing campaigns are increasingly targeting healthcare users. As a result, regulators and cybersecurity experts are placing greater emphasis on phishing-resistant authentication approaches and contextual access controls.

For email environments, organizations should increasingly evaluate:

Whether MFA methods are resistant to phishing attacks
Conditional access policies based on device, location, and behavior
Account monitoring and anomaly detection
Administrative access protections
Session management controls
Logging and authentication auditing

The broader message is clear: healthcare organizations need authentication strategies designed for today’s threat landscape, not yesterday’s compliance checklist.

OCR Wants Proof, Not Just Policies

One of the clearest trends emerging from recent OCR activity is the increasing importance of documentation and operational evidence. Healthcare organizations must increasingly demonstrate not only that safeguards exist, but that they are consistently enforced, monitored, tested, and maintained over time.

For email systems, organizations should be prepared to demonstrate:

Email encryption policies
MFA enforcement records
Audit logs and message tracking
Vendor security documentation
Risk assessments involving email infrastructure
Patch management procedures
Employee security awareness training
Incident response procedures for email-based threats

This represents a broader shift in healthcare cybersecurity expectations.

The question is no longer: “Do you have email security controls?”

The question is increasingly: “Can you prove they are operationally effective?”

Healthcare Organizations Need a New Email Security Strategy

The healthcare industry is entering a new phase of cybersecurity enforcement.

OCR’s direction is becoming increasingly clear: organizations are expected to proactively secure systems handling PHI using modern, documented, and continuously maintained safeguards. For email security specifically, that means organizations should stop treating encryption, MFA, and secure communications as optional compliance requirements. Instead, they should view secure email infrastructure as a strategic component of enterprise cybersecurity and patient trust.

At LuxSci, we help healthcare organizations modernize secure communications with HIPAA compliant email infrastructure designed specifically for healthcare environments, including flexible encryption, secure delivery, auditability, high deliverability, access controls, and dedicated infrastructure options.

The proposed HIPAA Security Rule updates may not yet be final. But, OCR is already signaling where healthcare cybersecurity enforcement is headed next. For organizations relying on email to communicate with patients, members, customers, and partners, the time to examine your secure email infrastructure is now.

Connect with our experts to learn more using the form at the top of this page!

LuxSci Launches Enterprise-Grade HIPAA Compliant Email Security for Mid-Sized Healthcare Organizations

May 5, 2026
Pete Wermter

New right-sized offering brings advanced encryption, easy API integration, and HITRUST-certified compliance to the most underserved segment in healthcare email — with pricing starting at $99/month

CAMBRIDGE, MA — May 5, 2026 — LuxSci, a leading provider of HIPAA compliant secure healthcare communications, today announced the launch of LuxSci Secure High Volume Email for mid-sized healthcare organizations, the industry’s trusted HIPPA-compliant email solution now packaged and priced for mid-size healthcare organizations. Regional health systems, health plans, specialty group practices, urgent care networks, and multi-site regional providers can now access LuxSci’s enterprise-grade email security and encryption infrastructure at published, volume-based pricing — with no custom quote required.

LuxSci Secure High Volume Email for mid-sized healthcare organizations delivers the same HITRUST CSF r2-certified email security and flexible encryption capabilities that power communications for some of the largest healthcare organizations in the industry, including Athenahealth, 1-800 Contacts, Hinge Health and Eurofins. The new LuxSci mid-sized offer is tiered and priced for organizations with email sending volumes of between 300 and 99,000 emails per month.

LuxSci Secure High Volume Email is built on the company’s proprietary SecureLine™ encryption technology, which automatically selects the optimal email encryption method — TLS, secure portal fallback, PGP, or S/MIME — on a per-recipient basis at the time of delivery, with no action required from senders or recipients. This intelligent, adaptive encryption method goes significantly beyond TLS-only or portal fallback models offered by basic platforms, giving mid-market healthcare organizations the flexibility and cybersecurity depth they need as HIPAA regulations tighten and email threats continue to get more sophisticated.

Key capabilities include:

Automatic email encryption via SecureLine™ — encrypt every email and its content, including Protected Health Information (PHI), with per-recipient adaptive encryption across TLS, portal fallback, PGP, and S/MIME.
Advanced REST API with webhooks for dataflows into your systems — supports unlimited messages/hour with failover, queuing, plus webhooks can push email engagement data back to EHRs, CRMs, RCM and customer data platforms.
Comprehensive audit logging and reporting — message-level tracking, delivery status, engagement reporting, and downloadable reports for compliance officers.
HITRUST CSF r2 certification, BAA, GDPR-compliant, and US-EU Privacy Framework agreement all included.
Microsoft 365 and Google Workspace overlay — use LuxSci’s Secure Email Gateway add-on to integrate directly with existing M365 or Google Workspace environments, adding HIPAA-compliant encryption without migration or user retraining.
HIPAA-compliant patient engagement — secure outbound email campaigns with PHI-powered hyper-segmentation, automated workflows, and personalized emails for marketing campaigns, proactive patient communications, appointment reminders, care gap outreach, new plan enrollments, healthcare education, and more — with LuxSci Secure Marketing add-on.

New Published LuxSci Pricing

LuxSci Secure High Volume Emai for mid-sized healthcare organizations features published pricing based on monthly sending volume:

Monthly Send Volume	Monthly Price
300 to 9,999 emails/month	$99/month
10,000 – 29,999 emails/month	$199/month
30,000 – 49,999 emails/month	$299/month
50,000 – 99,999 emails/month	$399/month
100,000+ emails/month	Custom

“Mid-size healthcare organizations have been underserved for too long, forced to choose between inadequate email security tools that weren’t built for healthcare and HIPAA compliance and enterprise level solutions that felt too big or too complex,” said Mark Leanord, CEO of LuxSci. “Our new secure email packaging for mid-sized organizations changes that. We’re making the same encryption depth, ease of integration into EHRs, CRMs and other systems, and compliance rigor that powers our largest customers accessible for mid-sized organizations to easily evaluate and buy.”

Timing and Market Context

The launch comes at a critical moment for mid-size healthcare organizations. The HHS HIPAA Security Rule overhaul, expected to finalize in mid-2026, is anticipated to mandate email encryption as a required safeguard, elevating email security from addressable best practice to a regulatory requirement for thousands of organizations that have not yet upgraded their email security and compliance posture. LuxSci secure email is designed to meet these requirements, backed by HITRUST CSF r2 certification and the company’s 20-year track record in secure healthcare communications.

Availability

LuxSci Secure Email for mid-sized healthcare organizations is available immediately. Pricing and product details are published here.

Users can contact LuxSci to set up a call or DEMO.

About LuxSci

LuxSci is a leading provider of secure healthcare communications solutions for the healthcare industry. The company offers secure email, marketing, forms and hosting, delivering HIPAA‑compliant communication solutions that enable organizations to safely manage and transmit sensitive data, including protected health information (PHI). Founded in 1999 and recently merged with digital care and telehealth provider Ovia Health, LuxSci serves more than 2,000 customers across healthcare verticals, including providers, payers, suppliers, and healthcare retail, home care providers, and healthcare systems, as well as organizations operating in other highly regulated industries. LuxSci is HITRUST‑certified with current customers including Athenahealth, 1800 Contacts, Lucerna Health, Eurofins, and Rotech Healthcare, among others.

###

Media Contact:
Pete Wermter, CMO

pwermter@luxsci.com

Patient Engagement ROI: The Business Case for Secure Email in Healthcare

April 28, 2026
Pete Wermter

Every IT investment in healthcare today is being evaluated through a sharper lens.

Budgets are tighter. Expectations are higher. AI is the shiny object. Across healthcare organizations, leadership is asking the same question: how does this investment drive measurable results?

That’s where Patient Engagement ROI comes in, and where many traditional approaches fall short.

The Hidden Cost of Ineffective Communication

Patient engagement isn’t just a healthcare priority. It’s a financial one.

Missed appointments, gaps in care, and low response rates all translate directly into increased costs, operational inefficiencies, and a poor patient experience. Yet many organizations still rely on fragmented, manual, or non-personalized communication strategies.

Why?

For many, it’s because of uncertainty around HIPAA compliance, and what’s allowed and not allowed. Too often, healthcare IT and marketing teams avoid using valuable patient data to avoid security and compliance risks, especially over the email channel. The result is often generic outreach that fails to connect, and fails to deliver meaningful results, such as better health outcomes, fewer missed appointments, and increased sales.

How Secure Email Delivers ROI in Healthcare

Among all healthcare IT investments, secure email stands out for one reason: it directly impacts both patient engagement and staff and process efficiency.

With the right HIPAA-compliant marketing automation platform, secure email enables organizations to:

Deliver personalized, relevant messages using PHI data in their emails
Automate outreach at scale with triggered, engagement-driven campaigns
Improve patient response rates and adherence for better outcomes
Reduce manual workload across teams for greater productivity

This is where patient engagement ROI becomes tangible.

Instead of one-size-fits-all messaging, organizations can connect with patients based on unique needs and health conditions, such as appointments, care plans, preventative care reminders, new product needs, and more. And because it’s automated, these improvements scale without adding to workloads.

Turning Compliance into Better Outcomes and Growth

HIPAA is often viewed as a constraint. In reality, it’s an opportunity. If you have the right tools.

At LuxSci, we focus exclusively on secure healthcare communications, helping organizations safely unlock the value of their data and communications. Our solutions are designed to remove the friction between compliance and communication, so you don’t have to choose between security and growth.

With capabilities like flexible encryption, advanced segmentation, and high-volume delivery, secure email marketing becomes more than a safeguard, it becomes a growth driver.

And with industry-leading security performance and recognition, organizations can trust that their communications are protected at every level with LuxSci.

Scaling Patient Engagement ROI with Automation

The real power of secure email comes when it’s combined with automated healthcare workflows.

HIPAA compliant marketing automation allows you to build multi-step, data-driven patient journeys that run continuously in the background, taking adaptive steps based on each individual’s email engagement activity. This can include:

Appointment reminders that reduce no-shows
Follow-up communications that improve outcomes
Preventative care outreach for check-ups, annual test and care reminders
New product offers, upgrades and promotions
Educational email campaigns that drive long-term engagement and better health

Each interaction is an opportunity to improve both patient experience and your financial performance. Over time, these incremental gains compound, resulting in significantly higher patient engagement that delivers real value to your business.

Why Act Now?

Healthcare organizations can no longer afford IT investments that don’t deliver clear, measurable value. Secure email, powered by HIPAA compliant marketing automation, offers one of the most direct paths to improving engagement, efficiency, and outcomes, all while maintaining the highest standards of security.

Ready to see how LuxSci secure email can transform your patient engagement into real ROI?

Connect with us today or book a demo to explore how HITRUST-certified, HIPAA-compliant marketing automation can work for your organization.

Is Wix HIPAA Compliant?

December 18, 2024
Erik Kangas

Wix is not HIPAA compliant for healthcare websites that collect, store, or process protected health information. Wix does not offer Business Associate Agreements and lacks the necessary security features required for handling patient data under HIPAA regulations. While Wix provides user-friendly website building tools and basic security measures like SSL certificates, these features do not satisfy the requirements for healthcare data protection. Healthcare organizations need specialized platforms if they plan to handle protected health information on their websites.

Wix Platform Limitations for Healthcare

Wix website building tools focus on ease of use rather than healthcare compliance requirements. The platform uses shared hosting infrastructure that may lack the data isolation needed for sensitive health information. User authentication systems in Wix do not provide the access controls required by HIPAA regulations. Form data collected through Wix stores information in ways that don’t align with healthcare privacy requirements. The platform may lack adequate audit logging capabilities to track who accesses patient information and when. Data backup systems do not include the encryption guarantees needed for protected health information. These structural limitations prevent Wix from serving as a platform for healthcare websites with patient data.

Business Associate Agreement Status

Healthcare organizations require Business Associate Agreements (BAAs) from any service provider handling protected health information. Wix does not offer BAAs for its website building platform or hosting services, making it legally impossible to use Wix for websites collecting or displaying patient information, regardless of added security measures. Wix does not offer HIPAA assurances or a BAA for its website platform; Wix advises customers not to use Wix in a way that causes Wix to handle PHI. Healthcare providers may assume website builders automatically support healthcare regulatory requirements without checking BAA availability.

Form Collection and Data Storage

Many healthcare websites collect patient information through online forms. Wix form builders store submitted information in ways that don’t meet HIPAA requirements. Form data typically resides in the Wix database without the encryption needed for protected health information. The platform lacks documentation about data storage locations and security measures applied to form submissions. Integration options for connecting form data to HIPAA compliant systems remain limited. Access to stored form data doesn’t include the detailed permission controls needed for healthcare information. These form handling limitations are challenging for healthcare websites that may need to collect patient information securely.

Acceptable Uses for Healthcare Organizations

Despite HIPAA limitations, Wix remains suitable for certain healthcare-related websites that don’t involve protected health information. Healthcare providers can use Wix for informational websites displaying services, provider details, location information, and general health resources. Marketing materials and educational content without patient-specific information work well on the platform. Healthcare organizations sometimes maintain separate websites, keeping public information on Wix while placing patient portals on HIPAA compliant platforms. This separation allows organizations to benefit from Wix’s user-friendly design tools for public-facing content while maintaining compliance for protected information.

Secure Alternatives for Healthcare Websites

Healthcare organizations have several alternatives for creating HIPAA compliant websites. Specialized healthcare website platforms include appropriate security measures and offer BAAs as standard practice. Content management systems like WordPress can be configured for HIPAA compliance with proper hosting and security implementations. Custom web development on compliant hosting environments provides maximum flexibility while meeting security requirements. Patient portal systems designed specifically for healthcare use include built-in compliance features. These alternatives typically require more technical knowledge or higher investment than Wix but provide the necessary security infrastructure for protected health information.

Website Compliance Assessment

Healthcare organizations should assess their website needs before selecting a platform. This process starts with determining exactly what information the website will collect and process. Organizations need policies defining what constitutes protected health information in their context. Security requirements should align with the sensitivity of information handled on the website. Budget considerations need to balance platform costs against compliance requirements and potential penalty risks. Technical resources available for website maintenance affect platform choices. This assessment helps organizations select appropriate website platforms and implement necessary security measures based on their needs

The Benefits of Using PHI in Patient Communications

March 15, 2023
LuxSci

Some healthcare organizations do not allow PHI to be sent outside the patient’s health record. However, by allowing your marketing and administrative teams to use PHI in patient communication, you can streamline operations, improve the patient experience, and increase revenue with HIPAA marketing.

Although the healthcare industry is traditionally slow to adopt new technologies, the past few years have rapidly accelerated the shift to digital communications. The reasons for these shifts are varied and will be explored in detail below. No matter the reason, one thing is certain- organizations adapting to the modern digital age are thriving, while those resisting change are falling behind in meeting patient expectations.

Changing Technology Preferences

Rapid technological innovation has made it possible to communicate securely at scale. As broadband access has increased, people are incorporating it into their daily lives. In 2022, 92% of Americans reported using email, and 49% checked it every few hours. Many people now prefer to receive business communications via email because it is asynchronous and can be engaged with when it fits into their schedules.

Healthcare organizations that utilize email for external communication are experiencing better response rates and fewer patient no-shows. Email already fits into the daily lives of many patients and doesn’t require them to take extra steps to receive information about their healthcare journey.

The Rise of Healthcare Consumerism

Healthcare consumerism refers to patients’ personal choices and responsibility in paying for and managing their health. Patients are no longer stuck with one provider or practice. They have more choices than ever and will shop around for new providers if unsatisfied with their experience.

If healthcare providers are not delivering a digital experience that meets patient expectations, they could risk losing patients and revenue.

In addition, as younger generations are taking control of their healthcare, they are used to digital-first experiences that are personalized to their needs. If organizations are unwilling to invest into personalized digital patient experiences, they will not adequately serve the next generation of healthcare consumers.

Staffing Challenges

The healthcare industry is not immune to recent staffing challenges. Staffing shortages have left fewer employees available to do more tasks, including patient care. Introducing digital technology into your patient communication strategy can help automate and streamline common communication workflows like:

Appointment reminders
Pre- and post-procedure instructions
Health education messages
Vaccine reminders
Medication adherence reminders
Billing

Automating common workflows frees up time for staff to focus on urgent patient needs and improves the patient experience.

How to Safely Use PHI in Patient Communications

Patients are already communicating with their healthcare providers one-on-one via email. The question is, how can you protect this data while communicating at scale for marketing and educational purposes? There are tools (like LuxSci’s Secure Marketing and Secure High Volume Email solutions) that are designed to support the unique security needs of the healthcare industry while providing the personalized digital experience that patients desire.

Protecting PHI in Patient Communications

PHI needs to be protected in emails with advanced encryption technology. TLS encryption should be used as often as possible because it provides a user experience like regular email without requiring a portal login. For marketing and patient education emails, TLS is sufficient to protect data and allows patients to readily engage with the email content. By properly vetting and choosing the right vendors, marketing and administrative teams can communicate with patients via email without violating HIPAA.

Personalization at Scale

The power of PHI is undeniable. When healthcare marketers can harness healthcare data to create ultra-personalized campaigns, it increases their relevance and the likelihood that the content will be engaged with, delivering a better ROI. Our solutions integrate via API to securely personalize messages and trigger emails when specific conditions are met. This allows marketers to send relevant messages at the right time when it is relevant to the patient’s healthcare journey.

Modern technology is needed to serve today’s patients. Meeting patients where they are with the information they need on the channels they prefer is vital to improving healthcare outcomes for the most vulnerable populations. Using PHI in patient communications gives your organization a comparative advantage by providing a better patient experience.

What Is Healthcare Marketing Compliance for Medical Practices?

July 21, 2025
Erik Kangas

Healthcare marketing compliance involves strict adherence to HIPAA authorization requirements, state privacy regulations, and industry advertising standards when using patient information for promotional purposes. Medical practices must obtain written patient consent before incorporating protected health information into testimonials, case studies, or targeted advertising campaigns, while ensuring all business associate agreements with promotional vendors include appropriate data protection clauses and breach notification procedures.

Medical practices pursue new patient acquisition through promotional activities while protecting existing patient privacy rights. Marketing departments frequently discover that their most compelling promotional ideas involve patient stories, treatment outcomes, or demographic data that require extensive legal review before implementation.

Written Authorization for Healthcare Marketing Compliance

Patient authorization must precede any use of PHI in promotional materials, specifying exactly which information will be disclosed, identifying all recipients of promotional communications, and explaining patient rights to revoke consent. These forms require expiration dates, signature requirements, and plain language descriptions that patients can easily comprehend without legal expertise.

Organizations cannot combine promotional authorization with treatment consent forms or condition medical services on patients agreeing to promotional uses of their information. Patients who decline promotional authorization must receive identical treatment quality and cannot experience discrimination or reduced service levels because of their privacy choices.

State Privacy Laws

California’s Consumer Privacy Act, Texas Medical Records Privacy Act, and other state regulations impose requirements that exceed federal HIPAA standards for promotional activities. Some states require opt-in consent for all promotional communications, while others mandate specific disclosure language or waiting periods before promotional authorization becomes effective.

Multi-state healthcare systems must comply with the most restrictive state requirements across all their operations to avoid violating patient privacy laws. Organizations operating in states with enhanced privacy protections cannot rely solely on healthcare marketing compliance but must incorporate additional state-specific requirements into their promotional practices.

Digital Advertising Platforms

Social media advertising, email promotional platforms, and website analytics tools frequently request access to patient contact information, demographic data, or behavioral tracking that falls under privacy protection laws. Healthcare marketing compliance requires careful evaluation of third-party technology vendors to ensure they provide appropriate business associate agreements and data protection measures.

Retargeting campaigns that track patient website visits or online behavior present particular risks when healthcare organizations use advertising pixels, conversion tracking, or audience segmentation tools. These technologies may inadvertently transmit protected information to advertising networks without proper authorization or contractual protections.

Vendor Management Protects Marketing Activities

Advertising agencies, promotional consultants, and marketing service providers need business associate agreements before accessing any patient information for campaign development or audience analysis. These contracts must specify permitted uses of protected data, establish security requirements, and outline breach notification procedures when privacy violations occur.

Organizations retain full liability for vendor compliance failures, making thorough due diligence essential before selecting promotional partners. Healthcare marketing compliance programs should include vendor auditing procedures, contract review protocols, and performance monitoring systems to ensure privacy protection throughout promotional activities.

Content Creation Within Privacy Protection Guidelines

Patient testimonials, success stories, and case studies require detailed authorization forms that specify exactly how patient information will be used across different promotional channels and time periods. De-identification offers an alternative approach but requires removing all identifying elements according to HIPAA standards, including dates, locations, and demographic details that could reveal patient identity.

Photography and video content featuring patients or their treatment areas need separate consent documentation covering future use, distribution methods, and duration of permission. Healthcare marketing compliance includes behind-the-scenes content, facility tours, and staff interviews that might inadvertently capture patient information in background elements.

Staff Education Prevents Privacy Violations

Marketing personnel, communications staff, and external vendors need education about distinguishing between permissible healthcare communications and restricted promotional activities requiring authorization. Training programs should cover identification of protected information, authorization requirements, and escalation procedures for situations requiring legal review.

Updates cover new promotional channels, technology platforms, and changing regulatory interpretations that affect healthcare marketing compliance standards. Organizations benefit from establishing clear approval workflows for promotional materials and designating privacy personnel to review campaigns before launch.

Enforcement Actions Shape Compliance Priorities

Recent OCR investigations have targeted healthcare organizations using patient information in social media posts, email campaigns, and website content without proper authorization. These enforcement actions show increasing federal attention to promotional activities and willingness to impose financial penalties for privacy violations.

Settlement agreements frequently require organizations to implement comprehensive compliance programs, conduct staff training, and submit to monitoring for extended periods. Healthcare marketing compliance programs that consider these enforcement priorities can minimize violation risks and avoid costly regulatory investigations.

Here’s What HIPAA Compliant Email Salespeople Don’t Tell You

November 18, 2025
Pete Wermter

With email security threats continuously increasing in number and sophistication, as well as healthcare companies requiring secure solutions to communicate with patients and customers, the need for HIPAA compliant email solutions has never been greater.

However, when looking for the right secure email services provider (ESP), healthcare organizations run the risk of making inaccurate assumptions about HIPAA compliance via what they learn from prospective vendors. This is due to the tendency for sales materials for HIPAA compliant email services, such as web pages or promotional videos, to highlight the strengths of the platform, while downplaying a healthcare company’s own role and responsibilities in securing protected health information (PHI).

With this firmly in mind, here are six key things that HIPAA compliant email salespeople don’t tell you about securing communications and achieving compliance.

1. The Shared Responsibility Model

Firstly, HIPAA compliant email salespeople are unlikely to emphasize the idea of shared responsibility when it comes to data security. This is the idea that two entities that share access to data, e.g., a healthcare company and their ESP, have a shared responsibility to preserve the privacy of that data.

In reality, most sales pitches explain the benefits and features of the solution, as opposed to stressing that compliance truly depends on how it’s configured and used. Now, that’s not to say that a salesperson is trying to hide this fact, as they’ll probably allude to training and configuration requirements. But, they’ll be less likely to make light of this and, more broadly, how shared responsibility factors into compliance.

2. A BAA Doesn’t Automatically Make You HIPAA Compliant

A business associate agreement (BAA) is essential for HIPAA compliance, but signing one doesn’t automatically make you compliant. Your organization still has to use the email delivery solution in a way that aligns with HIPAA regulations, which involves proper configuration, training, oversight, and reporting.

The misconception among some healthcare companies that a BAA equals compliance may be perpetuated by the term “HIPAA compliant email services provider”. This could give some the impression that the vendor is fully HIPAA compliant and, subsequently, in signing a BAA with them, the use of their services is fully compliant.

But, it’s not that simple.

Simply signing a BAA obscures the real effort involved in achieving compliance. There’s no official HIPAA seal of approval, and HIPAA compliant means that the solution is capable of being configured for compliant use, which is a shared responsibility. HIPAA compliant email salespeople are unlikely to volunteer this nuance, especially if their email solution requires considerable configuration or has a steep learning curve to use it securely.

3. Not All Solutions or Features Are HIPAA Compliant

Another key detail often underplayed by vendor sales materials of HIPAA compliant email solutions is that some of their features, or even entire services, aren’t covered by their BAAs, so they can’t be used to handle PHI.

These tools are referred to as “out of scope” and may include tools capable of integration with the email service, such as analytics or AI capabilities, but they don’t possess the cyber risk mitigation measures that align with HIPAA regulations. Perhaps the main reason for this is that many mass-market email delivery solutions, such as Microsoft 365 or Google Workspace, are designed for companies across all sectors. Consequently, while they can be HIPAA compliant, they weren’t developed from the ground up with the stringent regulatory demands of the healthcare industry in mind.

4. Solutions Are Not HIPAA Compliant “Out of The Box”

HIPAA compliant email salespeople may suggest that compliance is built into their platform, and healthcare organizations can use it to transmit PHI straight away, but this isn’t the case. Healthcare companies must still configure the email platform accordingly, as per the security requirements determined by their risk assessment, e.g., applying the right level of encryption.

Also, if the email service is difficult to configure for HIPAA compliance or if the vendor’s configuration documentation lacks detail, that presents another obstacle to its compliant use.

In addition to configuration, healthcare companies also have to implement access management controls and policies, establishing the extent to which each employee can access PHI in respect to their roles and responsibilities. From there, they will have to train their workforce on how to use the HIPAA compliant email solution securely, which may include those tools that fall outside the scope of your BAA with the vendor, and must not be used for the disclosure of patient data.

5. Essential Security Features Cost Extra

Another more egregious version of an ESP not being HIPAA compliant out of the box is having features required for compliance, such as encryption or audit logging, as premium add-ons and not included in the solution’s base pricing.

A vendor’s sales materials for its email service might list the necessary safeguards, but underemphasize the fact that only some versions of their platform are truly HIPAA compliant. Consequently, healthcare companies must confirm that the features required for HIPAA compliant email communications are included in the plan they’re purchasing.

6. The Importance of Staff Training on HIPAA

HIPAA compliant email salespeople are often remiss in stressing the need for additional workforce training alongside the deployment of their platform. A healthcare company’s employees must be trained on how to securely use the email client, how to ID potential threats, and best practices for including PHI in email communications, as well as the regulations tied to HIPAA and data security.

This includes educating users on the differences between regular and secure email, and what they must do to safeguard patient and customer data. Fortunately, secure email solutions from providers like LuxSci enable automated email encryption, and users do not need to take any additional actions to ensure encryption when sending emails.

Additionally, in some cases, employees will need to be trained on which tools or features do not align with HIPAA guidelines and must not be used to process PHI.

LuxSci: Fully HIPAA Compliant – No Hidden Surprises

LuxSci specializes in solutions that enable companies to carry out secure, personalized, and HIPAA compliant email communications and campaigns. With more than 20 years of experience and billions of emails sent for companies including Athenahealth, 1 800 Contacts, Lucerna Health and Rotech Healthcare, we’ve acquired invaluable experience in helping healthcare organizations enhance their engagement efforts, all while adhering to HIPAA regulations. In addition, LuxSci’s secure high-volume and marketing email solutions feature HIPAA-required security controls, including encryption, audit logging, and multi-factor authentication (MFA) by default, not as optional, hidden extras.

Contact us today to learn more about how LuxSci’s secure email solutions can help increase the ROI on your patient and customer outreach efforts, while safeguarding PHI in line with HIPAA requirements.