We’re thrilled to announce the opening of LuxSci’s new headquarters offices at Harvard Square in Cambridge, Massachusetts!
The move marks another milestone in our continuing journey to innovate and grow in secure healthcare communications. The new workspace aims to bring our people and teams together for in-person interactions and collaboration, and to better connect with our customers, partners and thought leaders. Located in the heart of one of the world’s most prestigious educational and technology hubs, our new office space reflects our roots and connections to the Massachusetts Institute of Technology (MIT), and our founder Erik Kangas, an MIT alumnus and advisor.
A Strategic Move for Continued Growth and Expansion
Opening our Cambridge office, part of the Industrious complex of offices, is not just about a change in location. The new office puts us at the center of cutting-edge technology in a thriving area for healthcare innovation. As a company deeply rooted in delivering the latest in secure, HIPAA-compliant communication solutions, this move allows us to leverage the rich talent pool and dynamic environment that Cambridge and the Greater Boston area have to offer.
Leading the Way in HIPAA Compliance for Healthcare Communications
At LuxSci, we’re proud to be the leader in HIPAA-compliant communication solutions for the healthcare industry, which includes serving some of the largest organizations in the US. With over two decades of experience, we understand the critical importance of safeguarding sensitive patient information and protected health information (PHI), but also how to increase patient and customer engagement.
The Next Step into Personalized Healthcare Engagement
Effective healthcare communication goes beyond just compliance—it’s about creating personalized and meaningful interactions with patients and customers. This often requires healthcare organizations to move beyond patient portals to open-up new communications channels and use cases, including email, marketing, text and forms—all in a HIPAA-compliant way. By protecting PHI data and using it in your communications for better personalization, you can deliver improved experiences and better outcomes for everyone involved.
Multi-Channel Suite of Secure Healthcare Communications Solutions
Today, LuxSci offers a suite of secure healthcare communication solutions, including support for high volume email, marketing, text messaging, and forms. As the demand for secure, compliant communication tools grows, LuxSci is at the forefront of delivering solutions that keep up with regulations and protect you from the latest threats.
“With our new Cambridge office, we’re launching the company into a new future with valuable connections to our past and where LuxSci was born,” said Mark Leonard, CEO of LuxSci. “Cambridge offers an unparalleled environment for innovation, and we’re excited to to bring our employees, partners and customers together – and to be part of this vibrant community.”
Want to see for yourself?
Contact us today for an in-person visit to talk about the future of secure healthcare communications.
Secure email is not the same as “email with encryption turned on.” True secure email requires enforced automated encryption, a signed BAA, access controls, audit logs, and documented processes — not just a feature toggle.
Standard email platforms like Gmail and Microsoft 365 rely on opportunistic TLS by default, which can silently fall back to unencrypted delivery if the recipient’s server doesn’t support encryption.
HIPAA’s encryption safe harbor means a misdirected but properly encrypted email is a non-event. The same email sent unencrypted is a presumed breach unless a risk assessment shows otherwise.
A signed Business Associate Agreement (BAA) with your email provider is non-negotiable — without one, you cannot legally send or store PHI through that provider.
The proposed 2025 HIPAA Security Rule update, planned for finalization in 2027, would make encryption of ePHI in transit and at rest a mandatory requirement rather than “addressable,” raising the stakes for organizations still relying on opportunistic TLS.
Best for: Healthcare IT Directors, Compliance Officers, Privacy Officers, and Marketing Managers at provider, payer, and supplier organizations that handle protected health information (PHI).
In healthcare IT, the term “secure email” gets thrown around loosely. Vendors slap the label on anything with a padlock icon, and internal teams often assume that because their provider offers TLS, they’re covered. They’re not, and the gap between what’s assumed and what’s actually required is where data breaches occur and HIPAA violations happen.
This guide breaks down exactly what secure email means from a technical and regulatory standpoint, why the email platform your staff uses every day probably isn’t compliant out of the box, and what to look for when evaluating a provider that needs to protect PHI at scale. If you want the full picture of what compliance requires beyond email specifically, our HIPAA Compliance Checklist is a useful companion read.
What Is Secure Email?
Secure email refers to an email system that protects the confidentiality, integrity, and availability of message content — specifically PHI — through a combination of technical safeguards and contractual protections. It’s not a single feature. It’s a stack of controls working together.
At minimum, secure email in a healthcare context includes:
Enforced encryption in transit, so messages can’t fall back to plaintext delivery
Encryption at rest, so stored messages remain protected on the server
Authentication protocols (SPF, DKIM, DMARC) that prevent spoofing and impersonation
Access controls and audit logs that track who accessed what, and when
A signed Business Associate Agreement (BAA) with the email provider
The distinction that trips up most organizations is this: encryption is a component of secure email, not the whole picture. A provider can offer encryption and still fail to meet HIPAA requirements if that encryption isn’t enforced, if there’s no BAA in place, or if audit logging doesn’t exist. Secure email is the combination of all these pieces functioning as a system, which is why it needs to be evaluated holistically rather than checked off feature by feature.
For healthcare provider, payer, and supplier organizations, this matters because email remains one of the highest-volume channels for PHI exposure, from clinical referrals to patient billing statements to routine staff communication. Getting the definition right is the first step toward closing the compliance gap.
Why Standard Email Is Not HIPAA-Compliant
Many healthcare organizations run on Gmail (Google Workspace) or Microsoft 365, and most assume they’re protected because encryption exists somewhere in the stack. That assumption is the single most common — and most dangerous — misconception in healthcare email security.
Here’s the problem: standard email services use opportunistic TLS by default. TLS is attempted between mail servers, but if the receiving server doesn’t support it, the message is delivered anyway — unencrypted, in plaintext. Neither the sender nor the recipient typically sees a warning. The email just goes through.
This isn’t a hypothetical edge case. IT professionals managing healthcare email infrastructure have flagged this exact issue directly: opportunistic TLS is often enabled by default and creates a false sense of security, since it offers no guarantee that a given message, including one containing PHI, won’t be transmitted in plaintext if the recipient’s mail server doesn’t support encryption. Organizations assume they’re protected simply because TLS is technically “on,” without realizing it isn’t enforced.
That gap has real consequences under HIPAA. The Security Rule currently treats transmission encryption as an “addressable” safeguard, meaning covered entities can, in theory, implement an equivalent alternative measure instead. In practice, regulators and auditors from the Office for Civil Rights (OCR) expect enforced encryption as the standard of care. “Addressable” has never meant optional — it means an organization needs a documented, defensible reason if it isn’t doing enforced encryption, and few reasons hold up under scrutiny. Finally, under OCR’s proposed changes to the HIPAA Security Rule for ePHI, scheduled for final publication in July 2027, email encryption moves from addressable to mandatory.
Beyond the encryption gap, standard consumer and even most business email plans typically lack:
A BAA that’s actually offered and signed (available on some enterprise tiers, but not automatic)
Audit logging sufficient to meet HIPAA Security Rule requirements
Built-in encryption at rest guarantees for stored messages
None of this means Gmail or Microsoft 365 are inherently insecure products. It means their default configuration is built for general business use, not for an environment where every misrouted or intercepted message carries breach notification liability. Making either platform HIPAA-appropriate requires layering on additional tools, policies, and critically, a provider relationship that includes a signed BAA covering the exact services in use.
The Technical Components of Secure Email
Secure email is built upon five technical layers. Understanding each one, and where it fails in standard email, clarifies exactly what a compliant solution needs to deliver.
Encryption in Transit (TLS)
Transport Layer Security (TLS) encrypts the connection between mail servers as a message travels from sender to recipient. There are two flavors, and the difference between them is the crux of most healthcare email compliance failures:
Opportunistic TLS attempts an encrypted connection but falls back to unencrypted delivery if the receiving server doesn’t support it. This is the default across most consumer and business email platforms.
Enforced TLS requires an encrypted connection for delivery to succeed. If encryption can’t be established, the message fails to send rather than going out in plaintext, or a link to secure portal can be sent to securely access the information.
HIPAA’s Security Rule lists encryption as addressable, but enforced TLS has become the de facto standard that auditors and OCR expect from covered entities and business associates handling PHI over email. As one healthcare IT professional put it while debating this exact tradeoff internally: the goal is to require TLS for all outbound email and then document the remaining controls around it, treating enforced TLS as the technical baseline, with policy and process built on top.
Encryption at Rest
Transit encryption only protects a message while it’s moving. Once it lands on a mail server — sender’s outbox, recipient’s inbox, backups, archives — it needs to remain encrypted in storage. This is encryption at rest, and it’s where many organizations underestimate their exposure.
Encryption in transit alone offers zero control over a message after it’s been delivered. If the destination server isn’t itself encrypting stored data, or if a backup snapshot is taken without encryption, PHI sitting in an inbox is exposed regardless of how securely it arrived. HIPAA’s Security Rule requires safeguards for ePHI both in transit and at rest, a compliant secure email provider needs to guarantee both, not just one.
End-to-End Encryption (S/MIME, PGP)
End-to-end encryption (E2EE) encrypts message content itself, not just the connection it travels over — meaning even the email provider can’t read the content. Two standards dominate here:
S/MIME uses certificate-based encryption and is common in enterprise environments, such as healthcare, particularly where organizations already manage a public key infrastructure.
PGP (Pretty Good Privacy) uses a public/private key model and is more common in technical or security-conscious communities, though it’s less frequently deployed at scale in healthcare due to key management complexity.
E2EE isn’t a baseline requirement for every PHI-containing email, enforced TLS plus encryption at rest satisfies most use cases. But it becomes necessary for especially sensitive communications, cross-organization data sharing where you don’t control the recipient’s infrastructure, or when a business associate agreement specifically requires it.
Authentication (SPF, DKIM, DMARC)
These three protocols work together to prevent domain spoofing and email impersonation, a growing attack vector against healthcare organizations specifically, given how often phishing campaigns impersonate providers, payers, or patients.
SPF (Sender Policy Framework) specifies which mail servers are authorized to send email on behalf of a domain.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature verifying a message wasn’t altered in transit.
DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers what to do when SPF or DKIM checks fail, and provides reporting visibility.
Without these configured correctly, an organization’s domain can be spoofed to send convincing phishing emails to patients or staff, creating a security failure that compounds the compliance risk of email interception.
Digital Signatures
Digital signatures verify sender identity and confirm a message hasn’t been tampered with between sending and receipt. Paired with encryption, they close the loop on message integrity, confirming not just that content was protected, but that it came from who it claims to have come from and arrived unaltered.
Standard Email vs. Secure Email: Feature Comparison
Feature
Standard Email
Secure Email (HIPAA-Compliant)
Encryption in Transit
Opportunistic TLS — attempted but not enforced
Enforced TLS — connection fails if encryption unavailable, can include delivery via secure portal option
Encryption at Rest
Not guaranteed; provider-dependent
Required — server-side encryption of stored messages
End-to-End Encryption
Not available
Supported via S/MIME and/or PGP
Digital Signatures
Not available
Included — verifies sender identity and message integrity
Authentication (SPF / DKIM / DMARC)
Optional, rarely enforced
Required — spoofing and impersonation protection
Business Associate Agreement (BAA)
Not provided on standard plans
Required — must be signed before sending PHI
Audit Logs
Basic or none
Full audit trail — required under HIPAA Security Rule
Access Controls
Basic password only
Role-based access, MFA, admin controls
Misdirected Email
Reportable HIPAA breach
Non-reportable if properly encrypted (safe harbor)
HIPAA Compliant by Default
No
Yes
What Makes Email HIPAA-Compliant Specifically
Technical safeguards alone don’t make email HIPAA-compliant. Compliance is a combination of technology, contracts, and documented processes — all four need to be in place simultaneously. This includes:
A signed BAA with your email provider – Any vendor that transmits, processes, or stores PHI on your behalf is a business associate under HIPAA, and business associates are legally required to sign a BAA before handling that data. Email providers have persistent access to ePHI — even end-to-end encrypted messages pass through their infrastructure at some point — which makes this requirement absolute, not situational. If a provider won’t sign a BAA, using them to send or store PHI isn’t a compliance risk you can mitigate; it’s a violation from the start.
Encryption as an addressable safeguard – Under 45 CFR §164.312(e)(2)(ii), the HIPAA Security Rule lists encryption of ePHI in transit as “addressable” rather than strictly “required.” In practice, this doesn’t mean optional, it means an organization must implement it, or document and justify an equivalent alternative safeguard. Enforced encryption has become the expected standard, and with the newly proposed HIPAA Security Rule planned for July 2027 publication, NPRM would formalize that expectation by making encryption of ePHI in transit and at rest mandatory rather than addressable. Organizations still relying on opportunistic TLS as their “equivalent alternative” should treat this as a closing window.
Access controls and audit logs – HIPAA requires the ability to track who accessed PHI, when, and what they did with it. This means role-based access permissions, multi-factor authentication, and a complete, retained audit trail — not just for compliance reporting, but for identifying and responding to incidents quickly.
The encryption safe harbor – This is one of the most consequential, and most underused, provisions in HIPAA. If PHI is sent via properly encrypted email and ends up misdirected to the wrong recipient, it is not a reportable breach under the Breach Notification Rule, because the encrypted content is considered unreadable and therefore not “unsecured PHI.” The exact same misdirection with unencrypted email is a reportable breach, triggering notification obligations to the individual and to HHS/OCR. Encryption isn’t just a security best practice here, it’s the line between a non-event and a formal breach investigation.
HITRUST certification as a trust signal – When evaluating vendors, HITRUST CSF certification is a strong external indicator that a provider’s security controls have been independently assessed against a recognized healthcare-specific framework. It’s not a HIPAA requirement in itself, but it meaningfully reduces the diligence burden on your side when vetting a provider.
Types of Healthcare Email That Must Be Secure
Not all internal debate here is about “should we secure email” — it’s about scope. Which specific email flows actually carry PHI, and therefore need to run through a compliant channel? In practice, the answer is broader than most teams initially assume.
The common thread: if a message references anything that could identify a patient in connection with health information — a name next to a diagnosis, an account number tied to a service date, an annual test reminder — it needs to move through a secure channel, regardless of whether it’s clinical, financial, or administrative in nature.
How to Evaluate a Secure Email Provider for Healthcare
Vendor evaluation in this category tends to go one of two ways: teams either take a provider’s “HIPAA-compliant” label at face value, or they get buried in RFP questions without knowing which answers actually matter. Ask these key questiosn to focus the evaluation on what’s operationally and legally significant.
“Does the provider sign a BAA? This is the first filter, not the last. If a vendor won’t sign a BAA — or offers a heavily limited one — everything else is irrelevant. Some organizations go a step further and negotiate indemnity or make-whole clauses into the BAA itself, seeking financial protection beyond the baseline liability allocation.
What encryption methods are supported? Confirm specifically whether the provider offers TLS only, or also supports S/MIME and/or PGP for end-to-end encryption where needed. TLS-only coverage is sufficient for most standard PHI communication; organizations with cross-border data sharing or especially sensitive use cases may need E2EE options available.
Is encryption enforced or opportunistic? This is the single most important technical question to ask directly, in those terms. A vendor that describes its encryption vaguely, without distinguishing enforced from opportunistic delivery, hasn’t answered the question. Push for specifics.
How are large attachments handled? Lab results, imaging files, and clinical documents often exceed standard attachment size limits. Confirm the provider has a secure, compliant method for large file transfer that doesn’t force users onto an unencrypted workaround.
What audit logging and reporting capabilities exist? You need visibility into delivery, access, and any failed encryption attempts, not just a generic sent/received log. Ask whether logs are retained for a period consistent with your organization’s HIPAA documentation requirements.
Do they support high-volume transactional email? Appointment reminders, billing notices, and patient communications at scale require infrastructure built for volume without sacrificing per-message compliance. Confirm the provider’s platform is built for this your specific pattern, not just person-to-person messaging.
Is the platform US-based with US data residency? For many healthcare organizations, where data physically resides — and under which jurisdiction — is a material factor in vendor risk assessment, particularly for payers and larger provider organizations with strict data governance policies.”
One operational factor worth weighing alongside these questions: secure email portals — the kind that require recipients to click through to a separate web page to read a message — solve the encryption problem but often create a real adoption problem. IT teams have reported a direct conflict between phishing-awareness training and portal-based workflows: staff and patients trained not to click suspicious links in emails are, understandably, reluctant to click the “secure link” a portal email contains. This is a legitimate reason many organizations increasingly prefer platforms that enforce encryption transparently in the background — like LuxSci’s SecureLine encryption technology — rather than routing every message through a separate portal experience.
Secure Email Checklist for Healthcare Organizations
Every safeguard covered in this guide comes down to a handful of concrete, verifiable actions. Use the checklist below as a working reference for what needs to be in place across your legal agreements, technical controls, and internal processes. This is not a one-time setup task, but something worth revisiting as your email volume, vendors, and regulations evolve. Share it across your compliance and IT teams as a starting point for an internal audit.
Legal and Contractual – BAA signed with email provider and all third-party vendors handling PHI.
Encryption – Forced TLS, not opportunistic only for emails in transit and all stored data encrypted with AES-256 bit encryption.
Access and Audit – Unique user IDs, role-based access, and login monitoring with advanced MFA enabled for all email accounts; audit logs active and maintained.
People and Processes – Staff trained in PHI handling, established breach response plan, annual email security policy review.
What Should I Do Now?
Secure email isn’t a single setting you switch on — it’s a combination of enforced encryption, a signed BAA, access controls, and documented process working together. Get any one piece wrong, and the rest doesn’t hold up under an OCR audit or a breach investigation.
If your organization is still relying on opportunistic TLS, an unsigned or incomplete BAA, or a patchwork of workarounds to move PHI through email, now is the time to close that gap, especially with the proposed 2025 HIPAA Security Rule update poised to make encryption a mandatory requirement rather than an addressable one in 2027.
Below are three ways you can continue your journey to securing your healthcare email:
Email can be HIPAA compliant, but only when the right safeguards are in place — enforced encryption, a signed BAA with your email provider, access controls, audit logs, and staff training on PHI handling. Standard email without these safeguards is not compliant.
2. Do I need to sign a BAA with my email provider?
Yes. Email providers have persistent access to ePHI — even encrypted messages pass through their servers — making them Business Associates under HIPAA. A signed BAA is required. If your provider won’t sign one, you cannot legally use them to send or store PHI.
3. What is the difference between opportunistic TLS and enforced TLS — and which does HIPAA require?
Opportunistic TLS attempts encryption but falls back to plaintext if the recipient’s server doesn’t support it. Enforced TLS stops delivery rather than sending unencrypted. HIPAA’s Security Rule treats transmission encryption as an addressable specification, in practice, enforced TLS is the standard auditors and OCR expect. The proposed 2025 HIPAA Security Rule NPRM would make encryption of ePHI in transit a mandatory requirement in 2027.
4. What happens if I send PHI in an unencrypted email?
It is an impermissible disclosure under HIPAA’s Privacy Rule and triggers the Breach Notification Rule, requiring you to notify the individual and HHS/OCR within 60 days. Penalties range from $100 to $50,000 per violation. Had the email been properly encrypted, the same incident would qualify for HIPAA’s encryption safe harbor, meaning no notification required.
5. Is Gmail or Microsoft 365 HIPAA compliant for sending patient emails?
Neither is compliant in their default configuration. Both use opportunistic TLS, meaning PHI can be sent in plaintext if the recipient’s server doesn’t support encryption. A signed BAA is available on enterprise plans but doesn’t close the technical gap alone. A purpose-built HIPAA-compliant email platform is the reliable solution.
If you’ve been waiting for the final word on the new HIPAA Security Rule before you touch your email encryption strategy, you now have an official reason to keep waiting.
Our advice: Don’t do it.
What is the new HIPAA Security Rule for ePHI?
The Department of Health and Human Services’ Office for Civil Rights had targeted May 2026 for a final rule implementing the most significant update to the HIPAA Security Rule in over two decades. The proposal eliminates the “addressable” standard and makes encryption of ePHI in transit and at rest mandatory for every covered entity and business associate. That deadline came and went quietly. Now we know why: an updated federal regulatory agenda shows OCR’s timeline has moved to July 2027, with the rule-making downgraded from “final rule stage” to “long-term action.” OCR is still working through more than 4,700 public comments on the January 2025 proposal.
For an industry that had been expecting a tighter deadline, a year-plus delay is the kind of news that invites a collective exhale — and a shelved project plan. At LuxSci, we think that would be a mistake, for three reasons:
The current rule already requires you to address encryption. “Addressable” was never “optional.” It has always meant you must implement the safeguard, implement an equivalent alternative, or document in writing why neither is reasonable for your organization. Most healthcare organizations have never done that documentation rigorously, and OCR’s existing enforcement authority applies today, not in 2027.
Breach costs haven’t waited for the rule.IBM’s 2025 Cost of a Data Breach Report puts the average healthcare breach at $7.42 million, still the highest of any industry. At the same time, email remains the number one attack vector into healthcare organizations. None of that risk is paused by a regulatory delay.
Delay is not withdrawal.OCR has not signaled it’s abandoning the encryption mandate, only that it’s taking longer to finalize it. Organizations that build now toward the standard already proposed will be ahead (and more secure) regardless of exactly when, or in what final form, the rule lands. Organizations that wait risk a compressed scramble once it does.
What should healthcare IT and compliance leaders actually do with this news?
Reevaluate your ePHI security posture, recalibrate its urgency, and use the extra runway to do the job right, instead of racing against a deadline. This includes:
Getting a real inventory of where ePHI moves by email today, inbound and outbound, and where encryption is inconsistent or absent.
Closing the documentation gap on “addressable” now, while you have time to do it well rather than defensively.
Pushing your email vendor for concrete answers on encryption standards, MFA enforcement, audit logging, and breach notification — the same technical controls the proposed rule would make mandatory.
Building (or updating) a written, enforcement-ready posture: policies, vendor agreements, certifications and verifications, test results, and training records that would hold up under an OCR investigation today, not just in a future compliance deadline.
Get LuxSci’s new Definitive Guide on the new HIPAA Security Rule
From Addressable to Mandatory: Email Encryption Under the New HIPAA Security Rule provides the latest update on the rule, what it means for healthcare email encryption, and what you can do now to properly prepare for what’s coming in 2027. The guide also includes an interactive scorecard that lets you evaluate your current email set up and vendor across seven security and compliance dimensions in under two minutes, no email address required.
If you want a second set of eyes on where your organization stands, our team offers a free 30-minute compliance assessment of your current email environment against the proposed rule’s requirements.
Most healthcare organizations view email as a utility, a necessary tool for sending messages between staff, communicating with patients, sending out newsletters, connecting workflows, and so on. Historically, IT teams focused on keeping it running, security teams worried about phishing, and compliance teams made sure sensitive emails were encrypted.
Today, however, that view is rapidly becoming outdated.
Email has evolved into one of healthcare’s most critical digital infrastructure components, and also one of it’s biggest security threats. It’s a core channel for patient engagement, care coordination, revenue cycle operations, digital marketing, remote monitoring, and increasingly, AI-powered communications. The organizations that recognize this shift are building communications platforms designed for security, performance, automation, and growth. With the new HIPAA Security Rule requiring email encryption on the horizon, those companies that don’t may find themselves constrained by systems that were never intended to support modern healthcare.
Email Is No Longer Just a Messaging Tool
Healthcare organizations now depend on email to support dozens of mission-critical workflows every day.
Patients receive appointment reminders, registration instructions, imaging results, billing notifications, Explanation of Benefits (EOBs), prescription updates, preventive care reminders, patient education, and post-discharge follow-up. Marketing teams deliver personalized wellness campaigns and service line promotions. Clinical systems generate transactional notifications. Revenue cycle teams rely on secure digital communications to accelerate payments and reduce paper costs.
For many organizations, mission-critical patient communications flow through email every month.
When viewed collectively, email is more than a simple communications channel. It has become operational infrastructure with high levels of security needed and increasing compliance requirements.
The Stakes Continue to Rise
As healthcare becomes more digital, every communication carries greater business and clinical importance.
A delayed billing email may postpone payment. A failed appointment reminder can increase no-show rates. An undelivered care management message may impact patient outcomes. A misconfigured security policy can expose protected health information (PHI). Poor deliverability can undermine expensive patient engagement initiatives before they ever reach the inbox.
These are no longer isolated IT issues. Email can affect revenue, patient satisfaction, operational efficiency, compliance, and organizational reputation.
Today’s healthcare leaders require email infrastructure to provide the same reliability and visibility they demand from electronic health records, identity management systems, and other core infrastructure.
AI Is Raising the Bar Even Higher
There’s little doubt that artificial intelligence (AI) promises to transform patient communications.
Healthcare organizations everywhere are exploring AI-generated patient education, personalized outreach, intelligent scheduling, multilingual communications, and automated follow-up programs.
But AI also increases the importance of the underlying communications infrastructure.
Generating more personalized emails means little if organizations cannot:
Automatically protect PHI.
Apply consistent security policies.
Maintain complete audit trails.
Deliver messages reliably.
Integrate with EHRs, RCM and CRM platforms, and customer data platforms.
Demonstrate compliance during an audits.
In many ways, AI amplifies both the opportunities and the risks. Your email platform can help determine whether AI initiatives succeed or create new compliance and operational challenges.
Infrastructure Matters More Than Features
Healthcare buyers have traditionally evaluated email platforms based on individual features such as encryption, spam filtering, or secure portals.
Those capabilities remain important, but they no longer tell the whole story.
Today’s healthcare organizations should be evaluating communications platforms the same way they evaluate any mission-critical infrastructure.
Questions increasingly include:
Can it support both transactional and marketing communications?
Does it automatically enforce security policies without relying on user decisions?
Can it integrate with EHRs, CRM systems, CDPs, and business applications?
Will it scale during peak communication periods?
Does it provide detailed audit logging and reporting?
Can it adapt as regulatory expectations evolve?
Does it maintain high deliverability at enterprise scale?
Does it support single-tenant dedicated infrastructure for high performance and increased security?
These infrastructure characteristics often determine long-term success far more than any single feature comparison.
Email and the Future Of Secure Healthcare Communications
Healthcare is steadily moving toward a world where nearly every patient interaction is digital, personalized, and data-driven.
Healthcare leaders often ask whether they need a more secure email solution. That may be the wrong question.
The better question is whether their communications infrastructure is ready for where healthcare is headed over the next decade.
If you want talk about the future of your healthcare email infrastructure, reach out today and schedule a 30-minute assessment call with our experts.
The best HIPAA compliant email providers protect messages in transit and at rest, verify identity with layered controls, and record activity in a way auditors can trust while connecting cleanly with clinical systems. When selecting among the best HIPAA compliant email providers, look for default encryption, reliable authentication, clear logging, and contracts that match HIPAA Privacy and Security Rule expectations so staff can communicate without extra steps.
Why the Best HIPAA Compliant Email Providers Matter in Practice
Email drives everyday healthcare tasks from scheduling and follow ups to sharing discharge details. A service earns its place when protection is automatic and invisible during busy moments. Transport Layer Security should be the baseline for server to server delivery, with message level encryption available when a thread leaves trusted paths so only intended recipients can read the content. Identity deserves equal attention through multi factor sign in, phishing resistant authenticators for sensitive roles, and session rules that make sense on shared workstations. Domain protections like SPF DKIM and DMARC reduce spoofing so patients and partner clinics can trust sender identity, which cuts confusion and keeps conversations in the right hands.
Encryption and Role-Based Access
Strong protection should never slow care. Default rules that apply encryption without user action prevent lapses, while admin policies decide when to escalate from transport protection to content encryption based on recipient or message context. Role based access narrows who can open attachments that carry imaging or lab data, and time bound sessions reduce risk on nursing stations where several people might use the same terminal across a shift. When a platform can prove these controls operate as configured, it stands closer to the standard set by the best HIPAA compliant email providers without demanding constant attention from clinical teams.
Contract Assurances Without Surprises
Patient information requires clear agreements that spell out responsibilities before a single message is sent. A Business Associate Agreement should describe data handling, incident reporting timelines, and how information returns or is deleted when the relationship ends. Contract language needs to align with administrative and technical safeguards referenced in 45 CFR 164.308 and 45 CFR 164.312 so there is no gap between what the law expects and what the vendor delivers. Independent examinations such as SOC 2 Type II or HITRUST provide added assurance that controls operate consistently, while incident procedures and appropriate insurance show the vendor has prepared for difficult days. These pieces lower uncertainty and bring a provider closer to the standard you expect from the best HIPAA compliant email providers.
Integrations That Put Messages Into the Chart
Security works best when it lands in the clinical record without extra clicks. Direct links to electronic health records allow messages and attachments to post into the chart so staff are not copying and pasting under time pressure. Open APIs help route patient replies and flags to the right queue so action happens quickly, and single sign on keeps access simple as clinicians move from room to room. Mobile applications that retain encryption and authentication let providers answer urgent questions away from a desk, which shortens response time while keeping protections intact. A platform that quietly fits this pattern saves minutes every hour and reduces workarounds that create risk, a hallmark shared by the best HIPAA compliant email providers.
Evidence, Logging, and Retention at Scale
Privacy officers need clear visibility when questions arise. Immutable logs that capture access, message views, downloads, and policy changes allow teams to reconstruct events without guesswork. Searchable timelines answer who saw what and when, while retention settings that match record policy keep storage predictable and ready for discovery or legal holds. Alerts that point to unusual sign ins or large exports give early notice without overwhelming teams with noise. This combination turns security features into verifiable history that stands up during reviews, which is where many platforms falter and where mature services establish trust.
How the Best HIPAA Compliant Email Providers Support Audits
Audits move faster when evidence is easy to find. Administrators should be able to export logs for a defined window, filter by user or mailbox, and show exactly how encryption and access rules applied to a thread. Legal teams need clean exports that preserve headers and message bodies without altering content, while compliance staff look for consistent timestamps and clear event labels. When a platform delivers this clarity on demand, investigations remain focused on facts rather than tool limitations, and leadership gains confidence that controls are doing the work they were designed to do.
A Practical Way to Compare Options
Run a focused pilot inside one service line and track the steps that matter. Measure time to send a protected message, the rate at which patients open secure threads, and the ease with which staff can file conversations into the record. Note how many clicks it takes to apply content encryption and how often users need to call for help. Ask for references from similar healthcare organizations and listen for detailed stories about migration quality and support response during the first month. Review pricing beyond a seat line by including storage tiers, archive export charges, and support commitments over a multi year term so totals stay predictable. A platform that performs across these measures will stand out among the best HIPAA compliant email providers without any need to name vendors, and it will do so by making privacy steady and communication smooth rather than by promising features that never show up in daily work.
Microsoft Office 365 can be HIPAA compliant when properly configured and covered under a Business Associate Agreement (BAA) with Microsoft. The platform includes security features, access controls, and encryption capabilities that support HIPAA requirements when implemented correctly. Healthcare organizations must enable specific security settings, configure appropriate access permissions, and train staff on proper usage to maintain compliance within the Office 365 environment.
Microsoft BAA Coverage
Microsoft offers a Business Associate Agreement covering Office 365 services when used by healthcare organizations. This agreement establishes Microsoft as a business associate under HIPAA regulations and outlines their responsibilities for protecting health information. Not all Office 365 services fall under BAA coverage – Microsoft provides documentation specifying which services qualify for healthcare data. Core services like Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams typically qualify with proper configuration. Organizations must execute this agreement before storing any protected health information in Office 365.
Email Protection Capabilities
Exchange Online includes several features supporting HIPAA compliant status for healthcare email. Transport Layer Security (TLS) encrypts email during transmission between systems. Data Loss Prevention policies can identify and protect messages containing patient information. Rights Management Services allows message encryption for sensitive healthcare communications. Organizations can implement archiving and retention policies that maintain healthcare records according to regulatory requirements. These capabilities help protect patient information sent through email while maintaining appropriate documentation for becoming HIPAA compliant.
Document Storage Safeguards
SharePoint Online and OneDrive for Business provide document storage with security features supporting HIPAA compliance. Encryption protects stored healthcare documents from unauthorized access. Permission controls restrict document viewing based on user roles and responsibilities. Audit logging tracks document access and modifications for HIPAA compliant documentation. Version history maintains records of document changes. Organizations can implement information barriers that prevent inappropriate sharing between departments. These features allow healthcare organizations to store and collaborate on patient information while maintaining appropriate security controls.
Collaborative Healthcare Communication
Microsoft Teams offers collaboration capabilities that support HIPAA compliant communication when properly configured. Private channels allow secure discussions about patient cases between authorized healthcare providers. Meeting recordings and chat logs maintain appropriate documentation of clinical consultations. Guest access controls allow external providers to participate in care discussions with proper security boundaries. Organizations can implement retention policies that maintain records according to healthcare requirements. These features enable healthcare teams to collaborate effectively while protecting patient information confidentiality.
Platform Management Tools
Office 365 includes administrative tools that help maintain HIPAA compliance across the platform. Multi-factor authentication adds security beyond passwords for accessing healthcare information. Conditional access policies can restrict system access based on device status, location, and risk factors. Mobile device management enforces security requirements on smartphones and tablets accessing patient data. Security monitoring identifies potential threats and suspicious activities across the environment. These administrative capabilities help organizations implement security programs that protect healthcare information throughout the Office 365 environment.
Workforce Readiness Elements
Achieving HIPAA compliance with Office 365 requires proper implementation and staff training beyond technical configuration. Organizations must develop policies governing appropriate use of Office 365 services for healthcare information. Staff need training on security features and compliance requirements specific to the platform. Regular security assessments help identify potential vulnerabilities in Office 365 implementations. Documentation should include Office 365 security configurations as part of overall compliance planning. These implementation practices help organizations maintain HIPAA compliance while leveraging Office 365 productivity benefits.
SMTP TLS encryption is popular because it provides adequate data protection without creating a complicated user experience for email recipients. Sometimes, though, the experience is too seamless, and recipients may wonder if the message was protected at all.
Luckily, there is a way to tell if an email was encrypted using TLS. To see if a message was sent securely, we can look at the raw headers of the email. However, it requires some knowledge and experience to understand the text. It is actually easier to tell if a recipient’s server supports TLS than to tell if a particular message was securely transmitted.
To analyze a message for transmission security, we will look at an example email message sent from Hotmail to LuxSci. We will explain what to look for when decoding the message headers and how to tell if the email was transmitted using TLS encryption.
An Example Email Message
First, we must understand how an email message typically travels through several machines on its way from the sender to the recipient. Roughly speaking:
The sender’s computer talks to the sender’s email or WebMail server to upload the message.
The sender’s email or WebMail server then talks to the recipient’s inbound email server and transmits the message to them.
Finally, the recipient downloads the message from their email server.
It is step 2 that people are most concerned about when trying to understand if their email message is transmitted securely. They usually assume or check that everything is secure and OK at the two ends. Indeed, most users who need to can take steps to ensure that they are using SSL-enabled WebMail or POP/IMAP/SMTP/Exchange services so that steps 1 and 3 are secure. The intermediate step, where the email is transmitted between two different providers, is where messages may be sent insecurely.
To determine if the message was transmitted securely between the sender’s and recipient’s servers (over TLS), we need to extract the “Received” header lines from the received email message. If you look at the source of the email message, the lines at the top start with “Received.” Let’s look at an example message from a Hotmail user below. The email addresses, IPs, and other information are obviously fake.
LuxSci:
The Outlook email was sent to a LuxSci user. The Received headers appear in reverse chronological order, starting with the server that touched the message last. Therefore, in this example, we see the LuxSci servers first.
Received: from abc.luxsci.com ([1.1.1.1])
by def.luxsci.com (8.14.4/8.13.8) with ESMTP id r7JEfLgH003867
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT)
for <user-xyz@def.luxsci.com>; Mon, 19 Aug 2019 10:41:21 -0400
Received: from abc.luxsci.com (localhost.localdomain [127.0.0.1])
by abc.luxsci.com (8.14.4/8.13.8) with ESMTP id r7JEfK0Z030182
for <user-xyz@def.luxsci.com>; Mon, 19 Aug 2019 09:41:20 -0500
Received: (from mail@localhost)
by abc.luxsci.com (8.14.4/8.13.8/Submit) id r7JEfKXD030178
for user-xyz@def.luxsci.com; Mon, 19 Aug 2019 09:41:20 -0500
Received: from dispatch1-us1.ppe-hosted.com (dispatch1-us1.ppe-hosted.com [2.2.2.2])
by abc.luxsci.com (8.14.4/8.13.8) with ESMTP id r7JEfIkK030002
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT)
for <someone@luxsci.net>; Mon, 19 Aug 2019 09:41:19 -0500
Proofpoint:
LuxSci uses an email filtering service, Proofpoint. Messages reach Proofpoint’s servers before being delivered to LuxSci. Here’s what their servers report about the email transmission:
Received: from unknown [65.54.190.216] (EHLO bay0-omc4-s14.bay0.hotmail.com)
by dispatch1-us1.ppe-hosted.com.ppe-hosted.com
(envelope-from <someone@hotmail.com>);
Mon, 19 Aug 2019 08:41:18 -0600 (MDT)
Outlook:
And finally, here’s what we see from Oultook’s server.
Received: from BAY403-EAS373 ([65.54.190.199]) by bay0-omc4-s14.bay0.outlook.com
with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 19 Aug 2019 07:41:19 -0700
How to Use Received Message Headers to Tell if the Email is Encrypted
The message headers contain information that can help us determine if an email is encrypted. Here are a few helpful notes to help you decode the text:
We said this above, but the message headers appear in reverse chronological order. The first one listed shows thelast server that touched the message; the last one is the first server that touched it (typically the sending server).
Each Received line documents what a server did and when.
There are three sets of servers involved in this example: one machine at Hotmail, one machine at Proofpoint, where our Premium Email Filtering takes place, and some machines at LuxSci, where final acceptance of the message and subsequent delivery happened.
Presumably, the processing of email within each provider is secure. The place to be concerned about is the hand-offs between Hotmail and Proofpoint and between Proofpoint and LuxSci, as these are the big hops across the internet between providers.
In the line where LuxSci accepts the message from Proofpoint, we see:
This section, typical of most email servers running “sendmail” with TLS support, indicates that the message was encrypted during transport with TLS using 256-bit AES encryption. (“Verify=not” means that LuxSci did not ask Proofpoint for a second SSL client certificate to verify itself, as that is not usually needed or required for SMTP TLS to work correctly). Also, “TLSv1/SSLv3” is a tag that means that “Some version of SSL or TLS was used;” it does not mean that it was SSL v3 or TLS v1.0. It could have been TLS v1.2 or TLS v1.3.
So, the hop between Proofpoint and LuxSci was locked down and secure. What about the hop between Hotmail and Proofpoint? The Proofpoint server’s Received line makes no note of security at all! This means that the email message was probably not encrypted during this step.
Hotmail either did not support opportunistic TLS encryption for outbound emails, or Proofpoint did not support receipt of messages over TLS, and thus, TLS could not be used. With additional context, you can know which server supports TLS and which does not.
In this case, we know that Proofpoint supports inbound TLS encryption. In fact, from another example message where LuxSci sent a message to Proofpoint, we see the Received line:
Received: from unknown [44.44.44.44] (EHLO wgh.luxsci.com)
by dispatch1-us1.ppe-hosted.com.ppe-hosted.com
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
with ESMTP id b-022.p01c11m003.ppe-hosted.com
(envelope-from <from@domain.com>);
Mon, 02 Feb 2009 19:28:27 -0700 (MST)
The red text makes it clear that the message was indeed encrypted. Based on the additional context, we can deduce that the Hotmail sending server did not securely transmit the email using TLS.
How To Tell if an Email is Encrypted With TLS
When analyzing your message headers, consider the following items to determine if the email is encrypted:
The receiving server will log what kind of encryption, if any, was used in receiving the message in the headers.
Different email servers use different formats and syntax to display the encryption used. Look for keywords like “SSL,” “TLS,” and “Encryption,” which will signify this information.
Not all servers will record the use of encryption. While LuxSci has always logged encryption use, not every email service provider does. It is possible to use TLS encryption and not log it. Sometimes, there is no way to tell from the headers if a message is encrypted if it is not logged.
Messages passed between servers at the same provider do not necessarily need TLS encryption to be secure. For example, LuxSci has back-channel private network connections between many servers so that information can be securely passed between them without SMTP TLS. So, the lack of TLS usage between two servers does not mean the transmission between them was “insecure.” You may also see multiple received lines listing the same server: the server passes the message between different processes within itself. This communication also does not need to be TLS encrypted.
If you are a LuxSci customer, you can view online email delivery reports to see if TLS was used for any particular message. We record the kind of encryption in the delivery reports, so it’s easy to see which emails were encrypted.
How can you Ensure Emails Are Securely Transmitted?
With some servers not recording TLS in message headers, how can you determine if a message was transmitted securely from sender to recipient?
To answer this question accurately, you must understand the properties, servers, and networks involved. It may be easy to determine that the message was transmitted securely if included in the header information. However, the absence of information does not necessarily mean the message was insecurely transmitted. You can only know this if you know what each system’s servers record.
In our example of a message from Hotmail to LuxSci, you need to know that:
Proofpoint and LuxSci will always log the use of TLS in the headers. We can infer that the Hotmail to Proofpoint transmission was not secure as nothing was recorded there.
The transmission of messages within LuxSci’s infrastructure is secure due to private back channel transmissions. So, even though there is no mention of TLS in every Received line after LuxSci accepts the message from Proofpoint (in this example), transferring the messages between servers in LuxSci is as secure as using TLS. Also, the same server can add multiple received lines as it talks to itself. Generally, these hand-offs on the same server will not use TLS, as there is no need. In the LuxSci example, we see this as “abc.luxsci.com” adds several headers.
We don’t know anything about Hotmail’s email servers, so we don’t know how secure the initial transmissions within their network are. However, since we know they did not securely transmit the message to Proofpoint, we are not confident that the transmissions and processing within Hotmail (which may have gone unrecorded) were secure.
Was the email message sent and received using encryption?
We skipped steps 1 and 3 and focused on step 2 – the transmission between servers. Steps 1 and 3 are equally, if not more, necessary. Why? Because eavesdropping on the internet between ISPs is less of a problem than eavesdropping near the sender and recipient (i.e., in their workplace or local wireless hotspot). So, it’s essential to ensure messages are sent securely and received securely. This means:
Sending: Use SMTP over SSL or TLS when sending messages from an email client or use WebMail over a secure connection (HTTPS).
Receiving: Ensure your POP or IMAP connection is secured via SSL or TLS. If using WebMail to read your email, be sure it is over a secure connection (HTTPS).
WebMail: There is generally no record in the email headers to indicate if a message sent using WebMail was transmitted from the end-user to WebMail over a secure connection (SSL/HTTPS).
You can typically control one side and ensure it is secure; you can’t control the other without taking extra steps. So, what can you do to ensure your message is secure even if it might not be transmitted with encryption or if the recipient tries to access it insecurely?
You could use end-to-end email encryption (like PGP or S/MIME, which are included in SecureLine) or a secure web portal that doesn’t require the recipient to install or set up anything to get your secure email message. These methods meet HIPAA and other regulatory compliance requirements for secure data transmission and provide complete confidence that the message will be sent and received securely.
LuxSci’s SecureLine offers flexible encryption options, including TLS, secure web portal, PGP, and S/MIME. Its dynamic capabilities can determine what types of encryption the recipient’s server supports to ensure your emails are always sent securely. Contact our team today to learn more about how to secure your emails.
WhatsApp is not HIPAA compliant for healthcare communications containing protected health information. Despite offering end-to-end encryption, WhatsApp lacks several required elements for HIPAA compliance, including Business Associate Agreements, adequate access controls, and audit logging. Healthcare organizations cannot legally use standard WhatsApp to communicate patient information without risking regulatory violations and potential penalties under HIPAA compliant enforcement rules.
WhatsApp Encryption and Security Features
WhatsApp provides end-to-end encryption that protects message content during transmission between users. This encryption prevents even WhatsApp itself from accessing message contents, creating a basic level of confidentiality. Two-factor authentication adds protection against unauthorized account access. Message deletion capabilities allow removing content after sending. Screenshot blocking in disappearing messages mode prevents certain forms of message capture. Device linking requires biometric or PIN verification when connecting new devices to accounts. While these security features offer protection for personal communications, they fall short of the structured safeguards required for HIPAA compliant healthcare messaging.
Missing Business Associate Agreement
Meta (WhatsApp’s parent company) does not offer Business Associate Agreements for standard WhatsApp accounts. This absence creates an insurmountable barrier to becoming HIPAA compliant, regardless of any security features or usage policies implemented. Without a BAA establishing WhatsApp as a business associate under HIPAA compliant regulations, healthcare organizations cannot legally use the platform for communications containing protected health information. The WhatsApp terms of service make no provisions for healthcare regulatory compliance or protected health information handling. Healthcare organizations seeking compliant messaging must select platforms from providers willing to enter into appropriate contractual relationships governing healthcare data.
Access Control and Authentication Limitations
WhatsApp lacks the granular access controls needed for healthcare communications. The platform offers limited ability to manage which users can access specific conversations beyond simple group membership. Administrative oversight tools for organizational accounts fall short of healthcare requirements for managing user permissions. Account access remains tied primarily to phone numbers rather than organizational identity systems. The platform lacks integration with enterprise authentication systems used in healthcare settings. Message visibility cannot be restricted based on staff roles or need-to-know principles within healthcare teams. Organizations cannot implement the access management hierarchies typically needed for proper information governance in clinical environments.
Audit and Compliance Documentation Challenges
HIPAA compliance requires detailed records of who accessed information and when this access occurred. WhatsApp provides limited message delivery and reading confirmations but lacks comprehensive audit logs needed for regulatory compliance. The platform offers no administrative portal for reviewing user activities across an organization. Message history may be lost during device changes or app reinstallation. Organizations cannot generate compliance reports showing message handling patterns. Data retention controls do not align with healthcare recordkeeping requirements. Without proper audit capabilities, healthcare organizations cannot demonstrate compliance with HIPAA access monitoring requirements or investigate potential security incidents involving patient information.
Data Management and Retention Issues
WhatsApp creates several data management challenges that conflict with HIPAA requirements. The platform automatically saves received media to users’ personal devices, potentially exposing protected health information. Backup settings may send message history to personal cloud storage accounts outside organizational control. Message deletion features allow recipients to remove content without administrator knowledge. Data retention periods cannot be centrally managed to align with healthcare recordkeeping policies. The platform lacks classification tools for identifying which conversations contain protected health information. Organizations cannot implement consistent data lifecycle management across all communications containing patient information.
Compliant Alternatives to WhatsApp
Healthcare organizations requiring HIPAA compliant messaging should implement appropriate alternatives to WhatsApp. Platforms like TigerConnect, Spok, and Halo Health provide secure messaging designed specifically for healthcare environments. Many electronic health record systems include compliant messaging components within their patient care applications. Telehealth platforms offer secure communication channels as part of virtual visit workflows. Enterprise communication platforms like Microsoft Teams can support HIPAA compliant messaging when properly configured and covered by appropriate agreements. These alternatives provide the necessary security features, administrative controls, and compliance documentation needed for healthcare communications containing protected health information.
Limited Acceptable Use Cases
WhatsApp may have limited acceptable use cases within healthcare environments when properly restricted. Administrative communications that never include patient information can utilize the platform with clear policies prohibiting any protected health information. Public health outreach and general wellness information that contains no individually identifiable health data may be appropriate for WhatsApp distribution. Patient communications through WhatsApp should occur only when patients have been clearly informed of privacy limitations and have explicitly chosen this communication method despite its risks.
