LuxSci vs. Zix Webroot: Choosing the Right HIPAA Compliant Email Provider

HIPAA Compliant Email
Pete Wermter
March 6, 2025

There are many crucial factors to consider when developing and executing successful healthcare communication campaigns. First and foremost, you must ensure the protected health information (PHI) under your organization’s care is handled securely, as mandated by Health Insurance Portability and Accountability Act (HIPAA) regulations, which begins with selecting the right HIPAA compliant email provider for your company’s needs.

With the right email services provider (ESP) in place, healthcare providers, payers, and suppliers can confidently use PHI in their patient and customer engagement campaigns – safe in the knowledge they’re aligned with HIPAA’s tight regulatory guidelines.

To help you choose the best HIPAA compliant email provider for your healthcare organization’s email outreach objectives, this post compares two of the most well-known HIPAA compliant services on the market: LuxSci and Zix Webroot (from here, simply referred to as Zix).

Comparing each email provider’s performance on several criteria, we’ll help you decide which solution best fits the needs of your healthcare organization and will help you better engage with your patients and customers.

LuxSci vs. Zix: Evaluation Criteria

In our evaluation of LuxSci vs. Zix, we’ll be using the following criteria:

Data Security and Compliance: undoubtedly the most important factor when it comes to ensuring HIPAA-compliant email communication within healthcare organizations, this reflects the extent to which each platform secures sensitive patient data as per HIPAA’s regulations.
Performance and Scalability: the email platform’s ability to facilitate high-volume email communication campaigns, which also, subsequently, encompasses the platform’s throughput and how well they’re able to scale in line with an organization’s needs.
Infrastructure: if the email service provider has the necessary security infrastructure in place to both adequately safeguard PHI and support bulk email marketing campaigns.
Marketing Capabilities: if the platform provides features that allow you to personalize and refine your patient engagement strategies.
Ease of Use: how easy each email service is to use; a deceptively important factor in light of the urgent need for employee cyber threat awareness training.
Other HIPAA-Compliant Products: if the platform offers complementary features that aid healthcare organizations with their broader patient engagement, and growth, objectives.

Now that we’ve covered the criteria by which we’ll be assessing each email platform, let’s compare LuxSci vs Zix to determine which is the best fit for your company’s needs.

LuxSci vs. Zix: How Do They Compare?

Data Security and Compliance

LuxSci prides itself on being a fully HIPAA-compliant email service provider, offering end-to-end, flexible, and automated encryption, giving it an advantage in the protection of patient data in the event of its exfiltration by cyber criminals. Additionally, LuxSci is HITRUST-certified, illustrating its additional commitment to data privacy legislation and the securing of PHI.

Zix is also fully HIPAA-compliant and, consequently, enables the use of PHI to personalize your email communications. That said, Zix doesn’t offer as many encryption options as LuxSci. Most notably, Zix doesn’t enforce Transport Layer Security (TLS) encryption or enable automated encryption. The absence of these features means that a healthcare organization’s security teams must perform more manual oversight when it comes to encryption of PHI, increasing the chance of human error.

Performance and Scalability

While Zix supports large email campaigns and provides detailed reporting functionality, LuxSci is the more prudent choice for high-volume email marketing campaigns.

LuxSci maintains the necessary infrastructure to ensure the reliable delivery of hundreds of thousands to millions of emails per month (i.e., throughput – 1000s of emails per hour), all while adhering to HIPAA’s strict guidelines on preserving patient privacy.

Infrastructure

In the same way that LuxSci have advantages over Zix on data security capabilities, it performs well in this category too, which makes sense, as the two factors are interwoven.

While offering a range of customary multi-tenancy infrastructure setups, Zix doesn’t accommodate dedicated, or single-tenancy, infrastructure options – for companies who can’t afford to depend on the security postures of the companies with whom they share servers. Zix, in line with its ability to facilitate large patient or customer engagement campaigns, provides enterprise-scale scalability.

Zix also provides high availability and robust disaster recovery capabilities, so healthcare organizations can retain their operational capabilities in the event of a cyber attack. Or, alternatively, an unforeseen physical disaster that compromises a company’s infrastructure (power outages, fires, storms, intentional damage, etc.).

That said, LuxSci possesses all these features in addition to more comprehensive single-tenancy options, scalability, and secure email hosting.

Marketing Capabilities

As with our comparisons of LuxSci against email platforms like Paubox and Virtru, it’s somewhat futile to compare each platform’s marketing capabilities – as neither LuxSci or Zix are marketing platforms, in the vein of Adobe Campaign or Oracle Eloqua, for example.

That said. LuxSci provides a HIPAA compliant marketing solution, offering automation, for streamlining email marketing campaigns, and, personalization options, for more engaging email communication campaigns.

Ease of Use

Both LuxSci and Zix perform admirably in this category, but the edge goes to Zix, as LuxSci implementations often involve the complexities that come with large-scale, high volume use cases.

LuxSci, however, is known for offering best-in-class customer support backed by HIPAA security experts, honed as a result of over 25 years of facilitating and supporting email communication strategies for healthcare organizations of all sizes.

Other HIPAA-compliant Products

With secure texting functionality, secure forms for HIPAA compliant data collection, and secure file sharing, LuxSci ranks well in this category. Zix, in contrast, provides only secure file sharing – though, because of Zix Webroot’s capabilities, offers superior secure file sharing to LuxSci.

Get Your Copy of LuxSci’s Vendor Comparison Guide

To discover how LuxSci and Zix stack up against the other leading email providers on the market when it comes to HIPAA compliance, take a look at our Vendor Comparison Guide. Evaluating 12 email delivery platforms, the guide offers comprehensive insights on what to consider when selecting a HIPAA compliant provider, and how to choose the best solution for you.

Pete Wermter

As a marketing leader with more than 20 years of experience in enterprise software marketing, Pete's career includes a mix of corporate and field marketing roles, stretching from Silicon Valley to the EMEA and APAC regions, with a focus on data protection and optimizing engagement for regulated industries, such as healthcare and financial services. Pete Wermter — LinkedIn

Get in touch

Find The Best Solution For Your Organization

Talk To An Expert & Get A Quote

First Name

Last Name

Work Email

Phone

Company

Type of Inquiry

Company Size

Message (optional)

Acceptance

I consent to be contacted by LuxSci for this inquiry and other relevant content, products, and services. You may unsubscribe from these communications at any time. We're committed to your privacy. For more information, check out our Privacy Policy.

A member of our staff will reach out to you

Search

Get Your Free E-Book!

LuxSci High Email Deliverability Best Practices Paper

What you’ll learn:

LuxSci Welcomes Angel Mazariegos as Head of Finance

December 9, 2025
Pete Wermter

LuxSci, a leader in secure healthcare communications and HIPAA compliant email, is pleased to announce the appointment of Angel Marie Mazariegos as the company’s new Head of Finance. With over 25 years of experience in financial management, accounting, and human resources, Angel will play a central role in advancing LuxSci’s operational excellence and supporting the company’s rapid growth in 2026 and beyond.

Angel brings a wealth of expertise to LuxSci, having held senior leadership positions at organizations focused on financial services, language and access services for healthcare, and human resources. In these roles, Angel has led multi-department Finance and HR teams, spearheading critical initiatives, including ERP implementations, streamlined employee onboarding, and financial process optimization.

In her role at LuxSci, Angel will oversee all aspects of the company’s finance operations, including budgeting, forecasting and reporting. Additionally, Angel will manage the company’s HR function, ensuring that LuxSci continues to foster a strong, people-driven culture based on its Secure, Trust, Responsible and Smart company values.

“Angel’s blend of financial and HR leadership makes her an invaluable addition to the LuxSci executive team and a real asset for our people,” said Mark Leonard, CEO of LuxSci. “We look forward to working with Angel to build the high-performing teams that will be critical to our future growth and serving the evolving needs of our customers.”

Angel holds dual MBA degrees in Accounting and Human Resource Management from Cappella University, as well as dual BS degrees in Business Administration (Accounting and CIS Business Systems) from California State University, Los Angeles.

“I am honored to join the LuxSci team at such an exciting time for the company,” said Mazariegos. “I look forward to working with the team and helping build on LuxSci’s reputation for excellence and reliability in secure healthcare communications.”

LuxSci Shines in G2 Winter 2026 Reports, Underscoring Commitment to Product Leadership and Trusted Relationships

December 4, 2025
Pete Wermter

We’re pleased to announce that LuxSci has been recognized for excellence and leadership for HIPAA compliant email and messaging in the just-released G2 Winter 2026 Reports!

Based on verified customer reviews, LuxSci earned 20 G2 badges as part of the most recent G2 reports, including top honors such as Grid Leader, Highest User Adoption, Best Support, and Best Estimated ROI.

This recognition further validates what we’ve always believed: our customers don’t just choose a great product — they choose a great partner. At LuxSci, we build long-term, trusted relationships with our customers, anchored in product reliability, industry-leading email deliverability and performance, and the best customer support in the business.

Why G2 Matters

G2 is a globally trusted peer‑review platform that aggregates verified user feedback and real‑world usage data to rank software and service providers. G2’s seasonal reports like the Winter 2026 editions shine a spotlight on latest tools and vendors that deliver consistent value and satisfaction to real customers.

Earning 20 badges this quarter signals a strong vote of confidence from our customers and community, helping affirm that LuxSci is a leading, highly adopted secure email solutions provider.

What We Earned in Winter 2026

Among the 20 badges awarded to LuxSci across Email Security, Email Encryption, Email Gateway and HIPAA Compliant Messaging are:

Grid Leader
Highest User
Best Support
Best Estimated ROI

This broad range of accolades spanning leadership, adoption, support and return on investment underscores the reliability of our solutions and the trust our customers place in us.

Awards Reflect Our Commitment to Customer Success

Reliable. Winning Grid Leader and Highest User Adoption demonstrates that thousands of users are depending on LuxSci, securely delivering emails to today’s most popular platforms, including Gmail, Apple Mail, Yahoo Mail and AOL, to name a few.

Proven. With Best Estimated ROI, customers are saying that LuxSci delivers tangible results, whether in secure email delivery, regulatory compliance, or operational efficiency.

Long‑Term Trust. Best Support is perhaps the most telling because for us, success isn’t just about features, it’s about being there for our customers every step of the way.

Thank you to all of our customers. We remain committed to your success — today and in the future.

Want to learn more about LuxSci? Reach out and connect with us today!

Here’s What HIPAA Compliant Email Salespeople Don’t Tell You

November 18, 2025
Pete Wermter

With email security threats continuously increasing in number and sophistication, as well as healthcare companies requiring secure solutions to communicate with patients and customers, the need for HIPAA compliant email solutions has never been greater.

However, when looking for the right secure email services provider (ESP), healthcare organizations run the risk of making inaccurate assumptions about HIPAA compliance via what they learn from prospective vendors. This is due to the tendency for sales materials for HIPAA compliant email services, such as web pages or promotional videos, to highlight the strengths of the platform, while downplaying a healthcare company’s own role and responsibilities in securing protected health information (PHI).

With this firmly in mind, here are six key things that HIPAA compliant email salespeople don’t tell you about securing communications and achieving compliance.

1. The Shared Responsibility Model

Firstly, HIPAA compliant email salespeople are unlikely to emphasize the idea of shared responsibility when it comes to data security. This is the idea that two entities that share access to data, e.g., a healthcare company and their ESP, have a shared responsibility to preserve the privacy of that data.

In reality, most sales pitches explain the benefits and features of the solution, as opposed to stressing that compliance truly depends on how it’s configured and used. Now, that’s not to say that a salesperson is trying to hide this fact, as they’ll probably allude to training and configuration requirements. But, they’ll be less likely to make light of this and, more broadly, how shared responsibility factors into compliance.

2. A BAA Doesn’t Automatically Make You HIPAA Compliant

A business associate agreement (BAA) is essential for HIPAA compliance, but signing one doesn’t automatically make you compliant. Your organization still has to use the email delivery solution in a way that aligns with HIPAA regulations, which involves proper configuration, training, oversight, and reporting.

The misconception among some healthcare companies that a BAA equals compliance may be perpetuated by the term “HIPAA compliant email services provider”. This could give some the impression that the vendor is fully HIPAA compliant and, subsequently, in signing a BAA with them, the use of their services is fully compliant.

But, it’s not that simple.

Simply signing a BAA obscures the real effort involved in achieving compliance. There’s no official HIPAA seal of approval, and HIPAA compliant means that the solution is capable of being configured for compliant use, which is a shared responsibility. HIPAA compliant email salespeople are unlikely to volunteer this nuance, especially if their email solution requires considerable configuration or has a steep learning curve to use it securely.

3. Not All Solutions or Features Are HIPAA Compliant

Another key detail often underplayed by vendor sales materials of HIPAA compliant email solutions is that some of their features, or even entire services, aren’t covered by their BAAs, so they can’t be used to handle PHI.

These tools are referred to as “out of scope” and may include tools capable of integration with the email service, such as analytics or AI capabilities, but they don’t possess the cyber risk mitigation measures that align with HIPAA regulations. Perhaps the main reason for this is that many mass-market email delivery solutions, such as Microsoft 365 or Google Workspace, are designed for companies across all sectors. Consequently, while they can be HIPAA compliant, they weren’t developed from the ground up with the stringent regulatory demands of the healthcare industry in mind.

4. Solutions Are Not HIPAA Compliant “Out of The Box”

HIPAA compliant email salespeople may suggest that compliance is built into their platform, and healthcare organizations can use it to transmit PHI straight away, but this isn’t the case. Healthcare companies must still configure the email platform accordingly, as per the security requirements determined by their risk assessment, e.g., applying the right level of encryption.

Also, if the email service is difficult to configure for HIPAA compliance or if the vendor’s configuration documentation lacks detail, that presents another obstacle to its compliant use.

In addition to configuration, healthcare companies also have to implement access management controls and policies, establishing the extent to which each employee can access PHI in respect to their roles and responsibilities. From there, they will have to train their workforce on how to use the HIPAA compliant email solution securely, which may include those tools that fall outside the scope of your BAA with the vendor, and must not be used for the disclosure of patient data.

5. Essential Security Features Cost Extra

Another more egregious version of an ESP not being HIPAA compliant out of the box is having features required for compliance, such as encryption or audit logging, as premium add-ons and not included in the solution’s base pricing.

A vendor’s sales materials for its email service might list the necessary safeguards, but underemphasize the fact that only some versions of their platform are truly HIPAA compliant. Consequently, healthcare companies must confirm that the features required for HIPAA compliant email communications are included in the plan they’re purchasing.

6. The Importance of Staff Training on HIPAA

HIPAA compliant email salespeople are often remiss in stressing the need for additional workforce training alongside the deployment of their platform. A healthcare company’s employees must be trained on how to securely use the email client, how to ID potential threats, and best practices for including PHI in email communications, as well as the regulations tied to HIPAA and data security.

This includes educating users on the differences between regular and secure email, and what they must do to safeguard patient and customer data. Fortunately, secure email solutions from providers like LuxSci enable automated email encryption, and users do not need to take any additional actions to ensure encryption when sending emails.

Additionally, in some cases, employees will need to be trained on which tools or features do not align with HIPAA guidelines and must not be used to process PHI.

LuxSci: Fully HIPAA Compliant – No Hidden Surprises

LuxSci specializes in solutions that enable companies to carry out secure, personalized, and HIPAA compliant email communications and campaigns. With more than 20 years of experience and billions of emails sent for companies including Athenahealth, 1 800 Contacts, Lucerna Health and Rotech Healthcare, we’ve acquired invaluable experience in helping healthcare organizations enhance their engagement efforts, all while adhering to HIPAA regulations. In addition, LuxSci’s secure high-volume and marketing email solutions feature HIPAA-required security controls, including encryption, audit logging, and multi-factor authentication (MFA) by default, not as optional, hidden extras.

Contact us today to learn more about how LuxSci’s secure email solutions can help increase the ROI on your patient and customer outreach efforts, while safeguarding PHI in line with HIPAA requirements.

What Does B2B Marketing Help Healthcare Vendors Accomplish?

November 4, 2025
Erik Kangas

B2b medical marketing helps healthcare vendors to explain the practical value of a product to clinical and administrative buyers by presenting clear information that supports decision making across operational and regulatory domains. Buyers respond to communication that describes how a tool fits into routine workflows and how it handles information, and the process depends on steady explanations rather than promotional language.

Early Movement in the Buyer Relationship

The first stage of communication gives prospective buyers a clear sense of what the service does and why it belongs in their setting. Healthcare groups rely on predictable routines and they look for products that support those routines without creating unnecessary strain on staff. When an introduction explains how a tool fits into patient movement, documentation demands, or coordination between departments, readers can place the service into a familiar context. This lowers the cognitive effort required to evaluate whether further consideration is worthwhile and creates a smoother path for later discussions, which is why many vendors treat early stage explanations as the base of effective b2b medical marketing in this environment.

The Influence of Operational Structure

Clinical and administrative environments are shaped by long standing systems, varied software tools, and staff roles that have developed around known constraints. Vendors using b2b medical marketing describe how a product enters this environment so that the buyer can picture the transition from interest to adoption. Extended explanations of onboarding steps, data migration choices, and staff training routines help readers understand how daily operations shift when a new tool is introduced. These explanations allow decision makers to forecast workload changes rather than relying on assumptions, and they reflect the broader goal of b2b medical marketing which is to reduce uncertainty.

Regulatory Considerations in Vendor Communication

Healthcare buyers place great weight on regulatory matters, which is why clear descriptions of data handling are central to this type of communication. Readers look for information about access management, retention practices, audit preparation, and the path information takes through each component of a system. When vendors describe these areas in detail, compliance teams can perform early assessments and avoid long chains of clarification requests. This approach supports efficient internal review because the buyer gains confidence that the vendor maintains structured processes rather than improvised arrangements, and this clarity strengthens the overall impact of b2b medical marketing.

Reliability Expectations Within Clinical Settings

Healthcare settings cannot tolerate uncertainty in the systems that support patient care. B2b medical marketing provides insight into how a vendor manages service interruptions, planned updates, backup routines, and recovery efforts. A description of past events or internal procedures gives readers a sense of how the vendor behaves when conditions are difficult. Buyers place great value on this type of detail because it helps them differentiate between systems that hold up under stress and systems that falter when routine performance is disrupted, and these reliability discussions form a core thread in b2b medical marketing for clinical tools.

Perspectives That Influence Internal Decision Making

Each participant in the purchasing process evaluates a product through a different lens. Financial leaders consider long term spending patterns, clinical managers look for ease of use and effects on staff time, and compliance teams examine information practices. Communication that attends to these perspectives without shifting tone allows the reader to share information across departments with minimal friction. This prevents internal delays because each group can assess the service using information that relates to its role in the organisation, and thoughtful navigation of these viewpoints reinforces the strength of b2b medical marketing across healthcare markets.

The Role of Educational Content in Vendor Outreach

Healthcare groups respond well to educational material that speaks to challenges in clinical settings. Articles and guides that explain regulatory shifts, workflow bottlenecks, or mistakes observed in comparable organisations allow readers to examine their own processes. This form of communication helps buyers understand the vendor’s approach to problem solving and creates familiarity before any formal evaluation begins. Educational content performs well in this field because it demonstrates practical awareness rather than relying on abstract claims, making it a central component of many b2b medical marketing programs.

Use After Adoption

Decision makers frequently look beyond the moment of purchase and seek a clear view of the daily relationship that follows implementation. Communication describing staff support, update patterns, training formats, and communication channels helps buyers picture how the tool will fit into routine operations. Long paragraphs that describe the lived experience of using the service allow internal champions to advocate for the product with fewer unknowns, which supports faster movement through approval stages. This expectation of clarity after adoption aligns with the wider goals of b2b medical marketing which encourage predictable cooperation between vendor and buyer.

Documentation Supporting Review Processes

Healthcare organisations rely heavily on documentation during evaluation. Guides, records, administrative instructions, and explanations of data controls enable teams to examine the product without repeated requests for further detail. B2b medical marketing that introduces these documents early in the conversation reduces internal delays because reviewers can move through their procedures with all necessary information available at the outset. This transparent approach helps build trust between the vendor and the buyer and underscores the value of documentation as a recurring theme within b2b medical marketing.

B2b medical marketing works most effectively when vendors show an accurate grasp of clinical pressures and administrative realities. When communication reflects these conditions and acknowledges the challenges that healthcare groups experience during busy periods, readers gain confidence that the vendor understands the world they operate in. This supports deeper conversations about integration, performance, and long term cooperation across the organisation.

HIPAA-Compliant Email Marketing FAQs

October 24, 2024
LuxSci

Email is an essential channel for most healthcare marketers, but HIPAA compliance requirements can make it challenging to execute effective engagement campaigns without violating patient privacy.

HIPAA is a complicated set of regulations that while offering a lot of guidance, does not mandate the use of any specific technologies to protect patient privacy. This ambiguity causes a lot of confusion for marketers looking to integrate email into their healthcare engagement campaigns.

With this in mind, this article addresses some frequently asked questions (FAQs) about HIPAA-compliant email marketing and offers advice for securing patient data and future-proofing your marketing.

Frequently asked HIPAA compliant email marketing questions

Do Generic Newsletters Need To Be Protected?

What Is An Email API?

Does HIPAA Allow Healthcare Providers To Send Unencrypted Emails With PHI To Patients?

Can Patients Exercise Their Right Of Access By Receiving PHI via Unencrypted Email?

Is Microsoft 365 Sufficient For Marketing Emails?

What Are Common Email Marketing Use Cases For Healthcare?

How Do I Find a HIPPA-Compliant Email Marketing Vendor?

Do generic newsletters need to be protected?

Some marketers assume newsletters from a healthcare provider or supplier do not contain health information and, therefore, do not fall under HIPAA requirements. This assumption, however, is often incorrect, with many surprised to learn that protected health information (PHI) can be implied from seemingly innocuous information.

As a result, many generic email newsletters often indirectly contain PHI due to the very fact that they are sent to lists of current patients or customers. This is because email addresses count as individually identifiable data and when combined with the message therein, it’s pretty simple to infer that they are patients or customers.

Let’s say, for example, that you send a newsletter to the patients of a dialysis clinic. An eavesdropper could infer that the recipients receive dialysis. Consequently, as the email reveals information about an individual’s health treatment, it contains PHI and should be secured in compliance with HIPAA regulations.

For the fundamental reason that it can be difficult to determine what classifies as PHI, it’s safer to skip the ambiguity entirely and use a HIPAA-compliant email marketing solution to ensure security.

What is an email API?

An Application Programming Interface (API) is a collection of protocols, or rules, that enable different applications to communicate with each other. APIs are a crucial aspect of modern applications – as they spare developers the considerable effort of creating application features from scratch – they can just connect to the API of an existing application.

For example, how many websites have you used that utilize Google Maps? This is because they have connected their site to the Google Maps API – integrating it into their application and providing another feature for their users.

In the case of an email API, it is a way for applications, such as customer relationship management (CRM) platforms, customer data platforms (CDP) and electronic health record (EHR) systems, to connect to email service providers. This then allows marketers to send emails through the application, using the ePHI (electronic protected health information) collected and stored within the application.

Additionally, marketers can view and further utilize campaign data through the powerful dashboards and analysis tools found in CRM systems and similar applications. Trigger-based transactional or marketing emails are ideal for sending with an email API, whereby emails are sent when pre-determined conditions in the application are met. Healthcare organizations may use email APIs to send appointment reminders using electronic health records system data about a patient’s upcoming appointments, check ups or treatments.

As invaluable as email APIs are, however, especially for streamlining and automation communication workflows, they are no substitute for a comprehensive email marketing platform. Email APIs do not include the contact management systems standard in most email marketing platforms, as all the data resides within the application they connect to. Additionally, email API tools do not typically include drag-and-drop editor tools and other design features that enable you to make your emails stand out and boost patient engagement.

Does HIPAA allow healthcare providers and companies to send unencrypted emails with PHI to patients?

Encryption is an addressable standard, i.e., it must be implemented by the organization unless a risk analysis concludes that implementation is not reasonable and appropriate, under the HIPAA Security Rule. This does not mean it is optional. The HIPAA Security Rule does not explicitly forbid unencrypted email. Still, it does state that “other safeguards should be applied to protect privacy reasonably, such as limiting the amount or type of information disclosed through the unencrypted email.”

In addition, the Department of Health and Human Services also states that “covered entities are permitted to send individuals unencrypted emails if they have advised the individual of the risk, and the individual still prefers the unencrypted email.” in response to this, some organizations use waivers to inform patients of the risks and acquire permission to send unencrypted emails.

However, we do not recommend this approach for several reasons:

Keeping track of waivers over time and recording status changes and updates is challenging – and increases your administrative overhead.
Signed waivers do not insulate you from the consequences of a HIPAA breach.
Using waivers to send unencrypted emails doesn’t absolve you of your other HIPAA obligations, such as data retention and disposal. Subsequently, using a HIPAA-compliant email solution is more manageable and eliminates ambiguity.

Can patients exercise their right of access of receiving PHI voa unencrypted email?

Yes, but they must be fully informed of the risks and sign waivers acknowledging them; the caveats detailed in the above answer apply. Consequently, it’s always best to use an encryption tool to protect patient data.

Is Microsoft 365 with encryption sufficient for sending marketing emails?

Microsoft 365 can be configured with Office Message Encryption (OME) to comply with HIPAA. However, it is not well-suited for sending marketing emails. OME primarily relies on portal pickup encryption, in which the message is stored securely on a server and requires the recipient to log in to the portal to read the email. As a result, the portal adds friction to the marketing process that prevents optimal engagement and constrains ROI.

Marketing messages containing light-PHI, i.e. low-risk data, are best sent using Transport Layer Security (TLS) encryption. TLS-encrypted messages arrive in the recipient’s inbox just like a regular email and do not require them to complete an additional step.

Additionally, Microsoft 365 is not configured to send high volumes of email. If you plan on executing large scale marketing campaigns, you could unintentionally disrupt regular business communications by sending all the messages through the same infrastructure. Instead, you should separate your business and marketing email delivery activities to protect your IP reputation, i.e., the trustworthiness of your IP addresses and how likely it is your emails end up in a spam folder, and achieve your desired sending throughput.

What are the common email marketing use cases for healthcare?

Email marketing in healthcare is not restricted to boring general practice newsletters and other communications that fail to engage patients. When you successfully harness tools that enable you to use ePHI to better target and personalize your healthcare engagement campaigns – the sky is the limit. With consumer preferences shifting toward digital communications, marketers who know how to best utilize HIPAA-compliant email marketing – and tactics like segmentation and personalization – will prove more effective at reaching patients.

Examples of ways that healthcare marketers can use email include:

Lead generation campaigns
Promotions
Verifications
Order confirmations
Notifications
Upsell & cross-sell
Collecting data on the patient experience

How do I find a HIPAA-compliant email vendor?

Using popular email marketing platforms, such as Mailchimp, is not recommended. Many of these platforms were designed for businesses, but are simply not secure enough to meet HIPAA requirements. We do not recommend using a solution not specifically equipped to meet the healthcare industry’s unique security and compliance needs. To determine if your email marketing provider is compliant, they must meet three broad criteria at a minimum.

The vendor must sign a Business Associate Agreement (BAA) outlining how they plan to secure your data and what they will do in the event of a breach.
Encrypt data at rest when it is stored in their systems.
Encrypt data, i.e., email messages, in transit as sent to the recipients.

Not all vendors will be up to the task. Carefully vet your email marketing vendors to ensure they are taking steps to secure data and protect patient privacy.

Conclusion

Admittedly, HIPAA can be difficult to understand – but choosing the right tools and adequately vetting your vendors makes it far easier to successfully execute HIPAA-compliant email marketing campaigns.

As the most experienced HIPAA-compliant email provider, LuxSci specializes in providing secure and scalable communications for companies aiming to send hundreds of thousands – or millions – of emails. In light of this, we place security, compliance and personalization considerations front and center when building our solutions.

Interested in discovering how LuxSci’s secure healthcare communications solutions can transform your healthcare marketing and engagement efforts?

Is SendGrid HIPAA-Compliant?

January 23, 2025
LuxSci

Twilio’s SendGrid is a cloud-based email marketing platform that contains the tools and resources that organizations need to carry out bulk email marketing campaigns. By providing companies with a robust, scalable email infrastructure, SendGrid reduces the technical and management overhead from delivering emails at scale.

SendGrid’s capabilities and benefits are undeniable – and are the reason why the popular platform is the email delivery service of choice for prominent companies like Spotify and Airbnb. For healthcare organizations, however, while reliability and scalability are essential for large-scale patient engagement campaigns and communications, security is another crucial concern. More specifically, for a healthcare company to send electronic protected health information (ePHI) through an email services platform, the service must be HIPAA-compliant.

This then begs the question, is SendGrid a HIPAA compliant email service? Subsequently, can companies use SendGrid to transmit ePHI?

The short answer is no, they are not. Let’s take a closer look…

Is SendGrid HIPAA-Compliant?

SendGrid is not a HIPAA-compliant email service. There are two key reasons for this:

It lacks sufficient encryption measures
SendGrid does not sign business associate agreements (BAAs)

Let’s discuss each reason in greater detail.

Basic Encryption

SendGrid only offers the basic encryption provided by the Simple Mail Transmission Protocol (SMTP), i.e., the standard mechanism used to transmit emails.

Unfortunately, this level of encryption leaves ePHI vulnerable to cyber threats such as business email compromise (BEC) attacks, ransomware, and device loss or theft. In contrast, for an email services platform to be HIPPA-compliant, it must protect ePHI in transit and at rest, using security measures like Transport Layer Security (TLS) encryption and end-to-end encryption.

Refreshingly, SendGrid is clear and upfront about this (in contrast to, Mailchimp, for example, who make you dig a little deeper to determine their non-compliance) – as Twilio’s documentation explicitly says that they do not offer HIPAA-compliant data transmission. Stating, “SendGrid does not natively support HIPAA-compliant data transmission. We do not offer any encryption or security measures surrounding message transmission beyond those included in the SMTP RFC, which was not designed with HIPAA compliancy in mind.”

In short, SendGrid wasn’t designed to withstand the increased cyber risk that accompanies handling ePHI and isn’t HIPPA-compliant as a result.

No Business Associate Agreement

Additionally, in addition to lower levels of encryption, SendGrid does not sign the business associate agreements (BAA) required to be HIPPA-compliant.

A business associate agreement (BAA) is a written contract between a covered entity (your company) and a business associate (a service provider, such as an email services or email marketing platform) that’s an essential requirement of HIPAA compliance. A BAA details how two organizations can share data and the legal responsibilities of each party.

This is again stated on Twilio’s website that says, “Twilio SendGrid does not intend uses of the Service to create obligations under The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Gramm-Leach-Bliley Act (“GLBA”) or similar laws and makes no representations that the Service satisfies the requirements of such laws. If You are (or become) a Covered Entity or Business Associate (as defined in HIPAA) or a Financial Institution (as defined in GLBA), You agree not to use the Service for any purpose or in any manner involving Protected Health Information (as defined in HIPAA) or Nonpublic Personal Information (as defined in GLBA).”

Here, Twilio is explicitly telling you that SendGrid does not fit the requirements of HIPPA-compliant and that you should not use their service to transmit ePHI.

HIPAA-Compliant Alternatives to SendGrid

While healthcare companies cannot rely on popular options like SendGrid if they want to utilize ePHI in their patient outreach campaigns, fortunately, there are HIPAA-compliant email platforms that are specifically designed for organizations that have to comply with the regulations.

As the most experienced HIPAA-compliant email provider, LuxSci specializes in providing secure and scalable HIPAA-compliant services for companies aiming to send hundreds of thousands – or millions – of emails. In light of this, we place security, regulatory and practical considerations front and center when building our solutions – from their early planning stages until final deployment.

Our approach results in tailor-made tools and services like HIPAA-compliant bulk email, secure text and secure marketing. This includes flexible encryption functionality, such as TLS, end-to-end, or role-based access encryption, that enable healthcare organizations to align their security with the sensitivity of the transmitted and their specific business requirements – all while remaining HIPAA compliant.

To discover how LuxSci and SendGrid stack up against each other, as well as with other HIPAA-compliant, general purpose and marketing email providers on the market, including Virtru and Mailchimp, take a look at our Vendor Comparison Guide. The guide takes a deep dive on 12 email delivery platforms, offering insights on what to consider when selecting a provider – and how to choose the vender best suited to meet your secure healthcare communications needs.

Get your copy here, and reach out to us with any questions.

Send Secure Emails: Alternatives to Web Portals

December 5, 2023
LuxSci

Digital technologies have entirely shifted how individuals want to interact with their healthcare providers. As consumers have become used to emailing or texting with their hairstylists, mechanics, and other providers to schedule appointments, they want to have the same level of interaction with their healthcare providers.

However, many healthcare organizations find it challenging to deliver the same experience because of their compliance requirements under HIPAA. They must balance usability and access with security and patient privacy. To send secure emails, they often resort to secure web portals.

Problems with Secure Web Portals

One of the most common ways that healthcare organizations communicate securely with patients is by using the secure web portal method of email encryption. In this scenario, messages are sent to a secure web server, and a notification is sent to the recipient, who then logs into the portal to retrieve the message.

While highly secure, this method is not popular with recipients because of the friction it creates.

To maintain a high level of security, users must log in to a separate account to retrieve the message. This extra step creates a barrier, especially for individuals who are not tech-savvy. In addition to creating a new account, they must remember a different username and password to access their secure messages. If the recipient doesn’t have this information readily available, they will likely delete the message and move on with their day. Many users will never bother logging in because of the inconvenience. This creates issues for organizations that want to use email for standard business communications and patient engagement efforts.

While this method may be appropriate for sending highly sensitive information like medical records, financial documents, and other valuable information, many emails that must meet compliance requirements only infer sensitive information and do not require such a high level of security. Flu shot reminder emails are not as sensitive or potentially devastating as sending the wrong medical file to someone. Healthcare organizations need to use secure email solutions that are flexible enough to send only the most sensitive emails to the portal and less sensitive emails using other methods.

How to Meet Compliance Requirements for Sending Secure Email

So, what other options do you have for sending secure emails? The answer will depend on what specific requirements you need to meet. Healthcare organizations that must abide by HIPAA regulations will find a lot of flexibility regarding the technologies they can use to protect ePHI in transit.

In addition to a secure web portal, three other types of encryption are suitable for email sending: TLS, PGP, and S/MIME. PGP and S/MIME are more secure than a web portal. They also require advanced technological skills and coordination with the end-user to implement, which makes them impractical for most business email sending.

That leaves us with TLS, which is suitable to meet most compliance standards (including HIPAA) and delivers an email experience much like that of a “regular” email.

Send Secure Emails with TLS Encryption

TLS encryption is an excellent option for secure email sending that provides a seamless experience for the recipient. Emails sent securely with TLS appear like regular, unencrypted emails in the recipient’s inbox.

TLS encrypts the message contents as they travel between mail servers to prevent interception and eavesdropping. Once the message reaches the inbox, it is unencrypted and can be read by anyone with access to the email account. For this reason, it is less secure than a portal but secure enough to meet compliance requirements like HIPAA.

If you’re wondering why this is, HIPAA only requires covered entities and business associates to protect PHI when it is stored on their systems or as it is transmitted elsewhere. After the message reaches the recipient, it is up to the recipient to decide what they want to do to secure the information. HIPAA does not apply to individuals. Each person is entitled to share and store their health information however they see fit.

Conclusion

Balancing security and usability is a significant challenge for healthcare organizations. If the message is too secure, it may be difficult for the recipient to open and engage with it. If it’s not secure enough, it is too easy for cybercriminals and other bad actors to intercept private information as it is sent across the internet.

Choosing an email provider like LuxSci, which offers flexible email encryption options, allows users to choose the right level of encryption for each message to maximize engagement and improve health outcomes. Contact our team today to learn more about how we can support your efforts.

Why is High Email Deliverability Essential for Healthcare Companies?

June 30, 2025
Pete Wermter

With email communication playing a critical role in the customer engagement strategies of virtually every organization, high email deliverability rates are vital to success across all industries. In the healthcare sector, however, the stakes can be far higher. An undelivered email isn’t merely an inconvenience or a lost sales opportunity; it could mean a missed appointment, a delay in a prescription refill, or a failure to get a patient critical healthcare information. Or worse, the email could end up in the hands of an unintended recipient, including bad actors and cybercriminals.

With this in mind, this post details why high email deliverability is essential for healthcare companies, as well as how your organization benefits from reliable and rapid email delivery.

Speed and Efficiency

The primary reason that high email deliverability is crucially important to healthcare organizations is to best guarantee essential communications that directly impact an individual’s healthcare journey reach them promptly. These transactional emails can include appointment reminders, prescription renewals, product order confirmations, test results, explanation of benefits notices, payment reminders, and invoices. Administrative notifications related to software or systems that a patient might use, such as a password reset for an online portal, also fall under the category of transactional emails.

When transactional emails are delayed or fail to reach people altogether, they can compromise a patient’s ability to access care, adhere to treatment plans, stay informed on key facets of their healthcare journey, and, ultimately, achieve optimal health outcomes.

When a patient fails to receive an expected email, such as a prescription confirmation, for example, it can leave them feeling confused and unsure of what to do next. For individuals who are sick, elderly, or managing chronic conditions, this can cause unnecessary stress, anxiety, and even compromise adherence to care plans.

In contrast, high email delivery rates create the opposite effect, helping patients get the communications and information they need. This increases their trust in your company and gives them a firmer sense of control over their healthcare journey.

Compliance with HIPAA Regulations

While the above point stresses the importance of reliable email delivery for the patient’s and customer’s benefit, healthcare companies also have a vested interest in ensuring communications reach the intended recipient for regulatory and patient privacy reasons.

To comply with the Health Insurance Portability and Accountability Act (HIPAA), emails that contain sensitive patient data, i.e., electronic protected health information (ePHI), must be securely delivered to the intended recipient. If, on the other hand, a communication containing ePHI fails to reach the intended recipient patient, that represents a failure in secure communications and a potential HIPAA violation for your organization.

After all, where did the patient’s data go? Was it delivered to the wrong person? Was it blocked by a spam filter and is left sitting unencrypted on a server somewhere?

If you can’t answer these questions, you could be exposed to a data breach, and it could result in a HIPAA violation, meaning your organization incurrs the associated consequences, including financial penalties and reputational damage. Conversely, deploying a fully HIPAA compliant email solution, such as LuxSci, supported by a dedicated infrastructure and designed for high email delivery enables your organization to include patient data in communications with confidence and ensure you messages land in the recipient’s inbox.

Greater Levels of Personalization and Engagement

Finally, high email deliverability rates are essential for healthcare organizations because they help drive greater levels of engagement with patients and customers. Higher email deliverability means better inbox placement, leading to more emails being opened, more links being clicked, and more conversions for your communications and campaigns.

In the case of healthcare retailers, for example, this equates to converting more prospects into customers and, consequently, maximizing the ROI of email marketing campaigns, in some cases with up to 80% better results.

While healthcare marketers, understandably, focus most of their efforts on crafting attention-grabbing headlines, personalizing the message content, and the email’s design elements, these factors are rendered irrelevant if the message fails to reach the recipient in the first place! When you take this into account, high email deliverability is a crucial component in optimizing the ROI of email communications and campaigns, and an all too often overlooked component at that.

Get Your Copy LuxSci’s Achieving High Email Deliverability Best Practices Paper

To learn more about the importance and value of high email deliverability for healthcare companies, download your copy of LuxSci’s latest Best Practices Paper: How to Achieve High Email Deliverability in Healthcare. You’ll discover:

How to opitmize performance for the different types of healthcare emails.
Powerful strategies for increasing your company’s email deliverability rates.
How small increases in email deliverability can have considerable effects on your marketing ROI

Grab your copy of the report here, and learn how to enhance your email deliverability rates today.