What Are The Requirements For HIPAA Emailing Medical Records?

HIPAA Compliant Email
Erik Kangas
April 10, 2025

HIPAA emailing medical records mandate that healthcare organizations implement encryption, access controls, and audit protections when transmitting protected health information electronically. Organizations must obtain patient authorization for medical record disclosures, ensure secure transmission methods, and maintain detailed logs of all email activities involving PHI to comply with Privacy and Security Rule obligations. Medical record transmission via email has become routine in healthcare operations, yet many organizations struggle with balancing convenience and compliance requirements. Understanding specific HIPAA obligations for email communications helps healthcare providers avoid costly violations while maintaining efficient patient care workflows.

Patient Authorization and Disclosure Requirements

Patient access rights under HIPAA allow individuals to request copies of their medical records in electronic format, including email delivery when requested. Healthcare organizations must honor these requests within 30 days and cannot require patients to provide justification for their preferred delivery method. Third-party disclosures require explicit patient authorization before medical records can be emailed to family members, attorneys, or other healthcare providers. These authorizations must specify what records will be shared, with whom, and for what purpose to ensure HIPAA compliance with privacy standards. Minimum necessary standards apply to HIPAA emailing medical records, requiring healthcare organizations to limit disclosures to only the information needed for the intended purpose. Complete medical records should only be shared when specifically authorized or when the entire record is necessary for the disclosed purpose.

Encryption Standards and Message Security

End-to-end encryption provides the strongest protection for medical records transmitted via email by ensuring that only authorized recipients can access patient information. This encryption method protects data throughout the entire transmission process, including temporary storage on email servers. Transport layer security protects medical records during transmission between email servers but may not encrypt messages while stored on recipient systems. Healthcare organizations should verify that this level of protection meets their risk tolerance and patient expectations for privacy. Secure portal delivery offers an alternative to direct email transmission by providing encrypted storage where patients or authorized recipients can access medical records through password-protected websites. This method maintains organization control over access and provides detailed audit trails.

Identity Verification and Recipient Authentication

Patient identity confirmation helps ensure that HIPAA emailing medical records reach intended recipients and prevents unauthorized disclosure to wrong email addresses. Healthcare organizations should implement verification procedures that confirm patient identity before emailing sensitive medical information. Recipient authentication systems verify that authorized individuals access emailed medical records rather than unintended recipients who might gain access through shared email accounts or compromised systems. Multi-factor authentication provides additional security layers for sensitive record access. Email address validation helps prevent medical record disclosure to incorrect recipients due to typographical errors or outdated contact information. Healthcare organizations should confirm email addresses with patients before transmitting medical records electronically.

Record Integrity and Transmission Controls

Digital signatures help ensure that medical records remain unchanged during email transmission and provide verification that documents originated from legitimate healthcare sources. These signatures help recipients confirm record authenticity and detect any unauthorized modifications. File format standards help ensure that emailed medical records can be accessed by recipients while maintaining security protections. PDF formats with password protection offer good compatibility while providing basic security controls for medical record transmission. Attachment size limitations may require healthcare organizations to split large medical records across multiple email messages or use alternative delivery methods. These constraints must be managed while maintaining record completeness and patient access rights.

Audit Trail and Documentation Obligations

Transmission logs must capture detailed information about medical record email activities including sender identity, recipient addresses, transmission timestamps, and record types shared. These logs support compliance monitoring and provide documentation for potential breach investigations. Access tracking helps healthcare organizations monitor who views emailed medical records and when access occurs. This information supports audit requirements and helps identify potential unauthorized access to patient information shared via email. Retention policies for email logs and transmitted medical records must align with state and federal requirements while supporting potential legal discovery and compliance audit needs. Healthcare organizations should establish clear schedules for maintaining and disposing of HIPAA emailing medical records transmission records.

Managing Failed Deliveries and Bounced Messages

Error handling procedures must protect medical record information when email transmissions fail or bounce back to senders. Healthcare organizations need policies for managing failed deliveries that prevent PHI exposure through error messages or automated responses. Alternative delivery methods should be available when email transmission fails to ensure that patients receive requested medical records within required timeframes. These backup procedures might include secure portals, encrypted file transfer, or physical mail delivery options. Notification protocols help healthcare organizations inform patients when medical record email deliveries fail while maintaining confidentiality about record contents. These communications should provide alternative access methods without revealing specific medical information in potentially unsecured messages.

Staff Training and Policy Implementation

Email usage policies must provide clear guidance for healthcare personnel about when and how to issue HIPAA emailing medical records while maintaining HIPAA compliance. These policies should address authorization requirements, encryption standards, and procedures for handling transmission errors. User training programs should cover both the mechanics of secure email transmission and the regulatory requirements for medical record disclosure. Staff need to understand patient rights, authorization procedures, and security measures required for different types of record sharing. Compliance monitoring helps healthcare organizations identify policy violations and training needs related to medical record email transmission.

Erik Kangas

With 30 years engaged in to both academic research and software architecture, Erik Kangas is the founder and Chief Technology Officer of LuxSci, playing a core role in building the company into the market leader for HIPAA compliant, secure healthcare communications solutions that it is today. An international lecturer on messaging security, Erik also advises and consults on email technology strategies and best practices, secure architectures, and HIPAA compliance. Erik holds undergraduate degrees in physics and mathematics from Case Western Reserve University, and a doctoral degree in computational biophysics from MIT. Erik Kangas — LinkedIn

Get in touch

Find The Best Solution For Your Organization

Talk To An Expert & Get A Quote

First Name

Last Name

Work Email

Phone

Company

Type of Inquiry

Company Size

Message (optional)

Acceptance

I consent to be contacted by LuxSci for this inquiry and other relevant content, products, and services. You may unsubscribe from these communications at any time. We're committed to your privacy. For more information, check out our Privacy Policy.

A member of our staff will reach out to you

Search

Get Your Free E-Book!

LuxSci High Email Deliverability Best Practices Paper

What you’ll learn:

The HIPAA Security Rule Missed Its May Deadline — Here’s What We Know

June 9, 2026
Pete Wermter

The proposed HIPAA Security Rule update has become one of the most closely watched healthcare compliance developments in recent years. Designed to strengthen cybersecurity protections for electronic protected health information (ePHI), the proposal could significantly reshape how healthcare organizations approach risk management, ePHI encryption, and mandatory email encryption requirements.

A final rule was expected as early as May 2026. However, that deadline has now passed without publication from the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR).

So, what happens next—and what should healthcare IT directors, CISOs, and compliance officers do now?

Where Things Stand Today

The HIPAA Security Rule Notice of Proposed Rulemaking (NPRM) was published on January 6, 2025, with the goal of strengthening cybersecurity protections for ePHI in response to escalating ransomware attacks, healthcare breaches, and growing concerns about cyber resilience across the healthcare sector.

The proposal generated thousands of public comments from healthcare providers, payers, business associates, technology vendors, and industry groups. OCR has spent much of the past year reviewing this feedback and evaluating the operational and financial impact of the proposed changes.

Although the Spring Unified Regulatory Agenda identified May 2026 as a target date for a final rule, that milestone came and went without publication. As of June 2026, the proposed HIPAA Security Rule update remains under review.

While some organizations may be tempted to take a wait-and-see approach, the missed deadline should not be interpreted as a signal that the initiative has stalled. If anything, the proposal offers valuable insight into the future direction of healthcare cybersecurity regulation.

The Growing Focus on Mandatory Email Encryption

One of the most discussed aspects of the proposed HIPAA Security Rule update is encryption.

Under the current HIPAA Security Rule, encryption is generally classified as an “addressable” implementation specification. Organizations can choose alternative safeguards if they document and justify their decisions through a risk analysis process.

The proposed changes would significantly reduce that flexibility. Instead, many security safeguards, including encryption controls, would become more prescriptive and difficult to avoid.

While the final language has not yet been released, healthcare organizations should pay close attention to the proposal’s clear message: protecting ePHI through encryption is increasingly viewed as a baseline cybersecurity requirement.

This is particularly important for email communications.

Email remains one of the most widely used communication channels in healthcare, supporting everything from patient engagement and care coordination to billing, scheduling, and marketing communications. As regulators continue to focus on reducing data breach risks, mandatory email encryption is emerging as a likely area of increased scrutiny.

What Healthcare Organizations Should Do Now

The current delay creates an opportunity, not a reason to postpone action.

Healthcare organizations can begin preparing for likely requirements today by evaluating the security controls highlighted throughout the proposed rule.

Key areas to review include:

Encryption of ePHI across systems and communications channels
Comprehensive asset inventories and ePHI data mapping
Enhanced risk analysis and risk management processes
Multifactor authentication (MFA)
Vulnerability scanning and penetration testing
Incident response planning and testing
Backup and recovery procedures
Email security and secure email encryption practices

Organizations that proactively strengthen these areas now will be better prepared regardless of the final rule’s implementation timeline.

Why Secure Email Encryption Should Be a Priority

For many healthcare organizations, email remains one of the largest compliance and security risks.

Human error, misdirected messages, phishing attacks, and inconsistent encryption practices continue to contribute to breaches involving protected health information. As a result, secure email encryption is increasingly becoming a foundational component of healthcare cybersecurity strategies.

Organizations that rely on manual encryption processes or employee judgment alone may find it difficult to meet evolving regulatory expectations.

Instead, healthcare organizations should look for solutions that automate encryption decisions, reduce user error, and provide flexibility based on the sensitivity of the communication.

At LuxSci, we have long believed that security and usability must work together. We are 100% focused on secure healthcare communications, helping healthcare providers, payers, and suppliers protect sensitive data while improving patient and customer engagement. Our proven secure email solutions, used by leading companies including Athenahealth, 1-800 Contacts, and Hinge Health, help organizations protect ePHI with automated encryption capabilities that support both compliance and operational efficiency. Our unique SecureLine encryption technology enables organizations to apply the appropriate level of protection while maintaining a seamless experience for patients, customers, and staff.

For organizations already using Microsoft 365 or Google Workspace, LuxSci Secure Email Gateway can add HIPAA-compliant email security and encryption without requiring users to change their existing workflows. This approach helps reduce risk, while preserving productivity and user adoption.

The Bottom Line

The HIPAA Security Rule final rule may have missed its anticipated May deadline, but the cybersecurity challenges driving the proposal remain very real.

The OCR is still expected to make the rule change, which could require mandatory encryption of ePHI by early 2027.

The time to prepare is now!

Healthcare organizations should view the proposed HIPAA Security Rule update as an advance warning of where regulatory expectations are heading. Stronger cybersecurity controls, enhanced risk management, ePHI encryption, and mandatory email encryption requirements are all likely to remain central themes in future compliance efforts.

The organizations that begin preparing now will not only be better positioned for future regulatory changes, but will also strengthen their ability to protect patient data, reduce risk, and build trust in an increasingly challenging threat landscape.

At LuxSci, we’re proud to support the healthcare industry’s ongoing digital transformation through secure healthcare communications. Our HIPAA-compliant solutions for secure email, email marketing, and forms empower organizations to safely use and protect PHI, while delivering better patient experiences and outcomes.

Ready to strengthen your healthcare cybersecurity strategy?

Learn more about LuxSci and our complete suite of HIPAA compliant email and marketing solutions, or schedule a consultation with one of our healthcare communication experts today.

LuxSci Awarded 20 Badges in the G2 Summer 2026 Reports

May 28, 2026
Pete Wermter

We’re excited to announce that LuxSci has again been recognized by G2 with 20 badges in its just-released Summer 2026 Reports, highlighting our continued leadership in secure healthcare communications and HIPAA compliant email solutions.

The new LuxSci G2 recognitions span several categories, including:

Best Estimated ROI
Best Support
High Performer
Leader

These latest LuxSci G2 awards reflect what matters most to our customers: delivering secure, HIPAA compliant healthcare communications backed by responsive support and measurable business results.

As one of the most trusted providers of HIPAA compliant email, marketing, and forms solutions, we’re proud to see our commitment recognized across multiple product categories and customer satisfaction metrics.

Recognition Built on Customer Experience

LuxSci’s G2 rankings are based on verified customer feedback and real-world user experiences, making these badges especially meaningful to our team.

This year’s Summer Reports recognized LuxSci for consistently delivering value to healthcare organizations looking to securely engage patients and customers while maintaining compliance with HIPAA requirements.

Among the highlights, the LuxSci G2 recognition includes:

Best Estimated ROI, reflecting the measurable value customers achieve through secure healthcare communications and personalization
Best Support, reinforcing LuxSci’s long-standing reputation for responsive, knowledgeable customer service
High Performer badges across multiple categories for customer satisfaction and product performance
Leader recognition for delivering secure, scalable communications solutions trusted by healthcare organizations

At LuxSci, we believe secure communications should also drive better engagement, stronger outcomes and operational efficiency. These recognitions reinforce our focus on helping healthcare providers, payers and suppliers personalize communications while protecting sensitive patient data.

Supporting the Future of Personalized Healthcare Engagement

LuxSci’s secure healthcare communication and patient engagement solutions empower organizations to safely communicate with patients and customers through:

HIPAA-compliant high volume email
Secure email marketing
Secure forms and data collection
Flexible encryption with SecureLine technology

Our solutions are designed to help healthcare organizations improve engagement, streamline workflows and personalize the healthcare journey while maintaining the highest standards of security and compliance.

These latest LuxSci G2 recognitions also build on LuxSci’s broader reputation for security, performance and customer success. Security and trust remain foundational to everything we do, alongside our commitment to delivering smart, responsive support for our customers.

Thank You to Our Customers

We’re grateful to our customers for their continued trust, collaboration and feedback. Their reviews and insights help shape our products and drive ongoing innovation across the LuxSci product set.

To learn more about LuxSci’s secure healthcare communications solutions, contact our team to schedule a secure email assessment or demo.

Connect with us today!

Is OCR Already Enforcing Email Encryption Under the New HIPAA Security Rule?

May 12, 2026
Pete Wermter

Healthcare organizations waiting for the final HIPAA Security Rule updates before improving email encryption and security may already be behind.

While the proposed changes to the HIPAA Security Rule are expected to be finalized in May, the direction from the U.S. Department of Health and Human Services Office for Civil Rights (OCR) is becoming increasingly clear. Across investigations, settlements, and enforcement actions, OCR continues emphasizing stronger technical safeguards, encryption, documented security programs, multi-factor authentication (MFA), risk analysis, and proactive cybersecurity operations.

For healthcare organizations, one area stands directly in the middle of all of these priorities: email.

Email remains a primary communication channel in healthcare — and one of the industry’s largest security vulnerabilities. From unauthorized PHI exposure to phishing attacks and ransomware delivery to account compromise, email continues to be at the center of healthcare cybersecurity incidents.

So, are the proposed HIPAA Security Rule changes hypothetical future guidance or a preview of OCR’s future enforcement expectations?

For healthcare email security, the implications are significant.

Email = Healthcare Cybersecurity Risk

Healthcare organizations rely on email for critical communications and healthcare workflows, including:

Patient communications
Care coordination
Claims and billing notifications
Marketing and engagement
Internal collaboration
Third-party vendor communications
Delivery of sensitive PHI

At the same time, attackers continue targeting email systems because they remain one of the easiest entry points into healthcare environments.

Insecure email workflows create unnecessary exposure of protected health information. Phishing campaigns are becoming more sophisticated. Credential theft attacks are bypassing traditional MFA methods. And business email compromise (BEC) attacks continue rising.

Recent OCR enforcement actions increasingly reflect these realities.

Organizations are being evaluated not simply on whether a breach occurred, but whether they implemented reasonable safeguards beforehand, including encryption, authentication controls, monitoring, access management, and documented risk mitigation processes.

For email systems specifically, that means healthcare organizations should expect increased scrutiny around:

Email encryption enforcement
MFA deployment
Audit logging and retention
Conditional access policies
Vendor security controls
Secure email delivery best practices
Segmentation and infrastructure isolation
Ongoing patch and vulnerability management

In many ways, email infrastructure is becoming a visible test of an organization’s overall cybersecurity posture.

Email Encryption Is Moving From Addressable to Required

Historically, healthcare organizations often interpreted HIPAA email encryption requirements with flexibility because encryption was technically categorized as an “addressable” safeguard under the Security Rule. But, OCR enforcement and broader cybersecurity realities are changing that interpretation rapidly.

Today, failing to encrypt sensitive healthcare communications increasingly creates both security and regulatory risk. The proposed Security Rule updates place even greater emphasis on encryption and technical safeguards. At the same time, OCR investigations continue examining whether organizations properly protected PHI in transit and at rest.

For healthcare email specifically, this creates several growing expectations:

Email encryption should be automated wherever possible
Human error should not determine whether PHI is protected
Organizations should maintain documented encryption policies
Secure delivery methods should adapt dynamically to recipient capabilities
Audit trails should demonstrate how messages were secured

At LuxSci, we have long believed that encryption should operate as a strategic layer of healthcare communications infrastructure, not as a manual user decision.

Our SecureLine email encryption technology automatically applies appropriate encryption methods based on organizational policies and delivery requirements, helping reduce the risks associated with human error while maintaining usability, deliverability and compliance. As enforcement expectations rise, this type of automated security enforcement is becoming increasingly important.

Traditional MFA May No Longer Be Enough

Another major shift emerging from both OCR enforcement trends and the proposed rule updates is the growing importance of stronger authentication models.

Healthcare organizations have historically viewed MFA deployment as sufficient protection. But attackers have adapted quickly.

MFA bypass attacks, token theft, session hijacking, and consent phishing campaigns are increasingly targeting healthcare users. As a result, regulators and cybersecurity experts are placing greater emphasis on phishing-resistant authentication approaches and contextual access controls.

For email environments, organizations should increasingly evaluate:

Whether MFA methods are resistant to phishing attacks
Conditional access policies based on device, location, and behavior
Account monitoring and anomaly detection
Administrative access protections
Session management controls
Logging and authentication auditing

The broader message is clear: healthcare organizations need authentication strategies designed for today’s threat landscape, not yesterday’s compliance checklist.

OCR Wants Proof, Not Just Policies

One of the clearest trends emerging from recent OCR activity is the increasing importance of documentation and operational evidence. Healthcare organizations must increasingly demonstrate not only that safeguards exist, but that they are consistently enforced, monitored, tested, and maintained over time.

For email systems, organizations should be prepared to demonstrate:

Email encryption policies
MFA enforcement records
Audit logs and message tracking
Vendor security documentation
Risk assessments involving email infrastructure
Patch management procedures
Employee security awareness training
Incident response procedures for email-based threats

This represents a broader shift in healthcare cybersecurity expectations.

The question is no longer: “Do you have email security controls?”

The question is increasingly: “Can you prove they are operationally effective?”

Healthcare Organizations Need a New Email Security Strategy

The healthcare industry is entering a new phase of cybersecurity enforcement.

OCR’s direction is becoming increasingly clear: organizations are expected to proactively secure systems handling PHI using modern, documented, and continuously maintained safeguards. For email security specifically, that means organizations should stop treating encryption, MFA, and secure communications as optional compliance requirements. Instead, they should view secure email infrastructure as a strategic component of enterprise cybersecurity and patient trust.

At LuxSci, we help healthcare organizations modernize secure communications with HIPAA compliant email infrastructure designed specifically for healthcare environments, including flexible encryption, secure delivery, auditability, high deliverability, access controls, and dedicated infrastructure options.

The proposed HIPAA Security Rule updates may not yet be final. But, OCR is already signaling where healthcare cybersecurity enforcement is headed next. For organizations relying on email to communicate with patients, members, customers, and partners, the time to examine your secure email infrastructure is now.

Connect with our experts to learn more using the form at the top of this page!

LuxSci Launches Enterprise-Grade HIPAA Compliant Email Security for Mid-Sized Healthcare Organizations

May 5, 2026
Pete Wermter

New right-sized offering brings advanced encryption, easy API integration, and HITRUST-certified compliance to the most underserved segment in healthcare email — with pricing starting at $99/month

CAMBRIDGE, MA — May 5, 2026 — LuxSci, a leading provider of HIPAA compliant secure healthcare communications, today announced the launch of LuxSci Secure High Volume Email for mid-sized healthcare organizations, the industry’s trusted HIPPA-compliant email solution now packaged and priced for mid-size healthcare organizations. Regional health systems, health plans, specialty group practices, urgent care networks, and multi-site regional providers can now access LuxSci’s enterprise-grade email security and encryption infrastructure at published, volume-based pricing — with no custom quote required.

LuxSci Secure High Volume Email for mid-sized healthcare organizations delivers the same HITRUST CSF r2-certified email security and flexible encryption capabilities that power communications for some of the largest healthcare organizations in the industry, including Athenahealth, 1-800 Contacts, Hinge Health and Eurofins. The new LuxSci mid-sized offer is tiered and priced for organizations with email sending volumes of between 300 and 99,000 emails per month.

LuxSci Secure High Volume Email is built on the company’s proprietary SecureLine™ encryption technology, which automatically selects the optimal email encryption method — TLS, secure portal fallback, PGP, or S/MIME — on a per-recipient basis at the time of delivery, with no action required from senders or recipients. This intelligent, adaptive encryption method goes significantly beyond TLS-only or portal fallback models offered by basic platforms, giving mid-market healthcare organizations the flexibility and cybersecurity depth they need as HIPAA regulations tighten and email threats continue to get more sophisticated.

Key capabilities include:

Automatic email encryption via SecureLine™ — encrypt every email and its content, including Protected Health Information (PHI), with per-recipient adaptive encryption across TLS, portal fallback, PGP, and S/MIME.
Advanced REST API with webhooks for dataflows into your systems — supports unlimited messages/hour with failover, queuing, plus webhooks can push email engagement data back to EHRs, CRMs, RCM and customer data platforms.
Comprehensive audit logging and reporting — message-level tracking, delivery status, engagement reporting, and downloadable reports for compliance officers.
HITRUST CSF r2 certification, BAA, GDPR-compliant, and US-EU Privacy Framework agreement all included.
Microsoft 365 and Google Workspace overlay — use LuxSci’s Secure Email Gateway add-on to integrate directly with existing M365 or Google Workspace environments, adding HIPAA-compliant encryption without migration or user retraining.
HIPAA-compliant patient engagement — secure outbound email campaigns with PHI-powered hyper-segmentation, automated workflows, and personalized emails for marketing campaigns, proactive patient communications, appointment reminders, care gap outreach, new plan enrollments, healthcare education, and more — with LuxSci Secure Marketing add-on.

New Published LuxSci Pricing

LuxSci Secure High Volume Emai for mid-sized healthcare organizations features published pricing based on monthly sending volume:

Monthly Send Volume	Monthly Price
300 to 9,999 emails/month	$99/month
10,000 – 29,999 emails/month	$199/month
30,000 – 49,999 emails/month	$299/month
50,000 – 99,999 emails/month	$399/month
100,000+ emails/month	Custom

“Mid-size healthcare organizations have been underserved for too long, forced to choose between inadequate email security tools that weren’t built for healthcare and HIPAA compliance and enterprise level solutions that felt too big or too complex,” said Mark Leanord, CEO of LuxSci. “Our new secure email packaging for mid-sized organizations changes that. We’re making the same encryption depth, ease of integration into EHRs, CRMs and other systems, and compliance rigor that powers our largest customers accessible for mid-sized organizations to easily evaluate and buy.”

Timing and Market Context

The launch comes at a critical moment for mid-size healthcare organizations. The HHS HIPAA Security Rule overhaul, expected to finalize in mid-2026, is anticipated to mandate email encryption as a required safeguard, elevating email security from addressable best practice to a regulatory requirement for thousands of organizations that have not yet upgraded their email security and compliance posture. LuxSci secure email is designed to meet these requirements, backed by HITRUST CSF r2 certification and the company’s 20-year track record in secure healthcare communications.

Availability

LuxSci Secure Email for mid-sized healthcare organizations is available immediately. Pricing and product details are published here.

Users can contact LuxSci to set up a call or DEMO.

About LuxSci

LuxSci is a leading provider of secure healthcare communications solutions for the healthcare industry. The company offers secure email, marketing, forms and hosting, delivering HIPAA‑compliant communication solutions that enable organizations to safely manage and transmit sensitive data, including protected health information (PHI). Founded in 1999 and recently merged with digital care and telehealth provider Ovia Health, LuxSci serves more than 2,000 customers across healthcare verticals, including providers, payers, suppliers, and healthcare retail, home care providers, and healthcare systems, as well as organizations operating in other highly regulated industries. LuxSci is HITRUST‑certified with current customers including Athenahealth, 1800 Contacts, Lucerna Health, Eurofins, and Rotech Healthcare, among others.

###

Media Contact:
Pete Wermter, CMO

pwermter@luxsci.com

How to Secure SMTP Email Delivery with TLS

August 29, 2023
Erik Kangas

Secure email sending is a priority for organizations that communicate sensitive data externally. One of the most common ways to send secure emails is with SMTP TLS. TLS stands for Transport Layer Security and is the successor of SSL (Secure Socket Layer). TLS is one of the standard ways that computers on the internet transmit information over an encrypted channel. In general, when one computer connects to another computer and uses TLS, the following happens:

Computer A connects to Computer B (no security)
Computer B says “Hello” (no security)
Computer A says, “Let’s talk securely over TLS” (no security)
Computers A and B agree on how to do this (secure)
The rest of the conversation is encrypted (secure)

In particular:

The conversation is encrypted
Computer A can verify the identity of Computer B (by examining its SSL certificate, which is required for this dialog)
The conversation cannot be eavesdropped upon (without Computer A knowing)
A third party cannot modify the conversation
Third parties cannot inject other information into the conversation.

TLS and SSL help make the internet a more secure place. One popular way to use TLS is to secure SMTP to protect the transmission of email messages between servers.

Secure SMTP Email Delivery with TLS

The mechanism and language by which one email server transmits email messages to another email server is called Simple Mail Transport Protocol, or SMTP. For a long time, email servers have had the option of using TLS to transparently encrypt the message transmission from one server to another.

When available, using TLS with SMTP ensures the message contents are secured during transmission between the servers. Unfortunately, not all servers support TLS! Many email providers, especially free or public ones, have historically not supported TLS. Thankfully, the trend is shifting. LuxSci found that most providers now support TLS- approximately 85% of domains tested as of July 2022.

Using TLS requires that the server administrators:

purchase SSL certificates
configure the email servers to use them (and keep these configurations updated)
allocate additional computational resources on the email servers involved.

For TLS transmission to be used, the destination email server must offer support for TLS, and the sending computer or server must be configured to use TLS connections when possible.

The sending computer or server could be configured for:

No TLS: never use it.
Opportunistic TLS: use it if available; if not, send it insecurely.
Forced TLS: use TLS or do not deliver the email at all.

How Secure is Email Delivery over SMTP TLS?

TLS protects the transmission of the email message contents. It does nothing to protect the security of the message before it is sent or after it arrives at its destination. For that, other encryption mechanisms may be used, such as PGP, S/MIME, or storage in a secure portal.

For sending sensitive information to customers, transmission security is the minimum standard for compliance with healthcare and financial regulations. TLS is appropriate to meet most compliance requirements and offers an excellent alternative to more robust and less user-friendly encryption methods (like PGP and S/MIME).

There are different versions of TLS- 1.0 and 1.1 use older ciphers and are not as secure, while TLS 1.2 and 1.3 use newer ciphers and are more secure. When an email is sent, the level of TLS used is as secure as can be negotiated between the sending and receiving servers. If they both support strong encryption (like AES 256), then that will be used. If not, a weaker grade of encryption may be used. The sending and receiving servers can choose the types of encryption they will support. If there is no overlap in what they support, then TLS will fail (this is rare).

What About Replies to Secure Messages?

Let’s say you send a message to someone that is securely delivered to their inbox over TLS. Then, that person replies to you. Will that reply be secure? This may be important if you are communicating sensitive information. The reply will use TLS only if:

The recipient’s servers support TLS for outbound email (there is no way to test this externally).
The mail servers (where the “From” or “Reply” email address is hosted) support TLS for inbound email.
Both servers support overlapping TLS ciphers and protocols and can agree on a mutually acceptable means of encryption.

Unless familiar with the providers in question, it cannot be assumed that replies will use TLS. So, what should you do? Ultimately, it depends on what compliance standards you must meet, the level of risk you are willing to accept, and the types of communications you send. There are two general approaches to this question:

Conservative. If replies must be secure in all cases, assuming TLS will be used is unreasonable. In this case, a more secure method should be used to encrypt the messages in transit and store them upon arrival. The recipient must log in to a secure portal to view the message and reply securely. Alternatively, PGP or S/MIME could be used for additional security.
Aggressive. In some compliance situations like HIPAA, healthcare providers must ensure that ePHI is sent securely to patients. However, patients are not beholden to HIPAA and can send their information insecurely to anyone they want. If the patient’s reply is insecure, that could be okay. For these reasons, and because using TLS for email security is so easy, many do not worry about the security of email replies. However, this should be a risk factor you consider in an internal security audit. Consider nuanced policies that allow you to send less sensitive messages with TLS while sending more sensitive messages with higher security.

What are the Weaknesses of SMTP TLS?

As discussed, SMTP TLS has been around for a long time and has recently seen a great deal of adoption. However, it has some deficiencies compared to other types of email security:

There is no mandatory support for TLS in the email system.
A receiver’s support of the SMTP TLS option can be trivially removed by an active man-in-the-middle because TLS certificates are not actively verified.
Encryption is not used if any aspect of the TLS negotiation is undecipherable/garbled. It is very easy for a man-in-the-middle to inject garbage into the TLS handshake (which is done in clear text) and have the connection downgraded to plain text (opportunistic TLS) or have the connection fail (forced TLS).
Even when SMTP TLS is offered and accepted, the certificate presented during the TLS handshake is usually not checked to see if it is for the expected domain and unexpired. Most MTAs offer self-signed certificates as a pro forma. Thus, in many cases, one has an encrypted channel to an unauthenticated MTA, which can only prevent passive eavesdropping.

The Latest Updates to Secure SMTP TLS

Some solutions help remedy these issues—for example, SMTP Strict Transport Security. SMTP STS enables recipient servers to publish information about their SMTP TLS support in their DNS. This prevents man-in-the-middle downgrades to plain text delivery, ensures more robust TLS protocols are used, and can enable certificate validation.

In addition, users can adopt TLS 1.3. NIST recommends that government agencies develop migration plans to support TLS 1.3 by January 1, 2024. LuxSci supports both SMTP MTA-STS and TLS 1.3.

How Secure SMTP TLS Email Works with LuxSci

Inbound TLS

LuxSci’s inbound email servers support TLS for encrypted inbound email delivery from any sending email provider that also supports that. For selected organizations, LuxSci also locks down its servers to only accept email from them if delivered over TLS.

Outbound Opportunistic TLS

LuxSci’s outbound email servers will always use TLS with any server that claims to support it and with whom we can talk TLS v1.0+ using a strong cipher. The message will not be sent securely if the TLS connection to such a server fails (due to misconfiguration or no security protocols in common). Outbound opportunistic TLS encryption is automatic for all LuxSci customers, even those without SecureLine.

Forced TLS

When Forced TLS is enabled, the message is either dropped or sent with an alternate form of encryption if the recipient’s server does not support TLS. This ensures that messages will never be sent insecurely. Forced TLS is also in place for all LuxSci customers sending to banks and organizations that have requested that we globally enforce TLS to their servers.

Support for strong encryption

LuxSci’s servers will use the strongest encryption supported by the recipient’s email server. LuxSci servers will never employ an encryption cipher that uses less than 128 bits (they will fail to deliver rather than deliver via an excessively weak encryption cipher), and they will never use SSL v2 or SSL v3.

Does LuxSci Have Any Other Special TLS Features?

When using LuxSci SecureLine for outbound email encryption:

SMTP MTA STS: LuxSci’s domains support SMTP MTA STS, and LuxSci’s SecureLine encryption system leverages STS information about recipient domains to improve connection security.
Try TLS: Account administrators can have secure messages “try TLS first” and deliver that way. If TLS is unavailable, the messages would fall back and use more secure options like PGP, S/MIME, or Escrow. Email security is easy, seamless, and automatic when communicating internally or with others who support TLS.
TLS Exclusive: This is a special LuxSci-exclusive TLS sending feature. TLS Exclusive is just like Forced TLS, except that messages that can’t connect over TLS are just dropped. This is ideal for low-importance emails that must still be compliant, like email marketing messages in healthcare. In such cases, the ease of use of TLS is more important than receiving the message.
TLS Only Forwarding: Account administrators can restrict any server-side email forwarding settings in their accounts from allowing forwarding to any email addresses that do not support TLS for email delivery.
Encryption Escalation: Often, TLS is suitable for most messages, but some messages need to be encrypted using something stronger. LuxSci allows users to escalate the encryption from TLS to Escrow with a click (in WebMail) or by entering particular text in the subject line (for messages sent from email programs like Outlook).
Domain Monitoring: When TLS delivery is enabled for SecureLine accounts, messages will never be insecurely sent to domains that purport to be TLS-enabled, i.e., TLS delivery is enforced and no longer “opportunistic.” The system monitors these domains and updates their TLS-compliance status daily.
Double Encryption: Messages sent using SecureLine and PGP or S/MIME will still use Opportunistic TLS whenever possible for message delivery. In these cases, messages are often “double encrypted.” First, they are encrypted with PGP or S/MIME and may be encrypted again during transport using TLS.
No Weak TLS: Unlike many organizations, LuxSci’s TLS support for SMTP and other servers only supports those protocol levels (e.g., TLS v1.0+) and ciphers recommended by NIST for government communications and which are required for HIPAA. So, all communications with LuxSci servers will be over a compliant implementation of TLS.

For customers who can use TLS to meet security or compliance requirements, it enables seamless security and “use of email as usual.” SecureLine with Forced TLS enables clients to take advantage of this level of security whenever possible while automatically falling back to other methods when TLS is unavailable.

Of course, using Forced TLS as the sole method of encryption is optional; if your compliance needs are more substantial, you can turn off TLS-Only delivery or restrict it so that it is used only with specific recipients.

If your email use cases are complicated, LuxSci’s flexibility enables the secure sending of emails to any recipient, regardless of their email service provider’s support for TLS. Contact the LuxSci sales team to learn more about our secure SMTP TLS email sending.

LuxSci vs. Zix Webroot: Choosing the Right HIPAA Compliant Email Provider

March 6, 2025
Pete Wermter

There are many crucial factors to consider when developing and executing successful healthcare communication campaigns. First and foremost, you must ensure the protected health information (PHI) under your organization’s care is handled securely, as mandated by Health Insurance Portability and Accountability Act (HIPAA) regulations, which begins with selecting the right HIPAA compliant email provider for your company’s needs.

With the right email services provider (ESP) in place, healthcare providers, payers, and suppliers can confidently use PHI in their patient and customer engagement campaigns – safe in the knowledge they’re aligned with HIPAA’s tight regulatory guidelines.

To help you choose the best HIPAA compliant email provider for your healthcare organization’s email outreach objectives, this post compares two of the most well-known HIPAA compliant services on the market: LuxSci and Zix Webroot (from here, simply referred to as Zix).

Comparing each email provider’s performance on several criteria, we’ll help you decide which solution best fits the needs of your healthcare organization and will help you better engage with your patients and customers.

LuxSci vs. Zix: Evaluation Criteria

In our evaluation of LuxSci vs. Zix, we’ll be using the following criteria:

Data Security and Compliance: undoubtedly the most important factor when it comes to ensuring HIPAA-compliant email communication within healthcare organizations, this reflects the extent to which each platform secures sensitive patient data as per HIPAA’s regulations.
Performance and Scalability: the email platform’s ability to facilitate high-volume email communication campaigns, which also, subsequently, encompasses the platform’s throughput and how well they’re able to scale in line with an organization’s needs.
Infrastructure: if the email service provider has the necessary security infrastructure in place to both adequately safeguard PHI and support bulk email marketing campaigns.
Marketing Capabilities: if the platform provides features that allow you to personalize and refine your patient engagement strategies.
Ease of Use: how easy each email service is to use; a deceptively important factor in light of the urgent need for employee cyber threat awareness training.
Other HIPAA-Compliant Products: if the platform offers complementary features that aid healthcare organizations with their broader patient engagement, and growth, objectives.

Now that we’ve covered the criteria by which we’ll be assessing each email platform, let’s compare LuxSci vs Zix to determine which is the best fit for your company’s needs.

LuxSci vs. Zix: How Do They Compare?

Data Security and Compliance

LuxSci prides itself on being a fully HIPAA-compliant email service provider, offering end-to-end, flexible, and automated encryption, giving it an advantage in the protection of patient data in the event of its exfiltration by cyber criminals. Additionally, LuxSci is HITRUST-certified, illustrating its additional commitment to data privacy legislation and the securing of PHI.

Zix is also fully HIPAA-compliant and, consequently, enables the use of PHI to personalize your email communications. That said, Zix doesn’t offer as many encryption options as LuxSci. Most notably, Zix doesn’t enforce Transport Layer Security (TLS) encryption or enable automated encryption. The absence of these features means that a healthcare organization’s security teams must perform more manual oversight when it comes to encryption of PHI, increasing the chance of human error.

Performance and Scalability

While Zix supports large email campaigns and provides detailed reporting functionality, LuxSci is the more prudent choice for high-volume email marketing campaigns.

LuxSci maintains the necessary infrastructure to ensure the reliable delivery of hundreds of thousands to millions of emails per month (i.e., throughput – 1000s of emails per hour), all while adhering to HIPAA’s strict guidelines on preserving patient privacy.

Infrastructure

In the same way that LuxSci have advantages over Zix on data security capabilities, it performs well in this category too, which makes sense, as the two factors are interwoven.

While offering a range of customary multi-tenancy infrastructure setups, Zix doesn’t accommodate dedicated, or single-tenancy, infrastructure options – for companies who can’t afford to depend on the security postures of the companies with whom they share servers. Zix, in line with its ability to facilitate large patient or customer engagement campaigns, provides enterprise-scale scalability.

Zix also provides high availability and robust disaster recovery capabilities, so healthcare organizations can retain their operational capabilities in the event of a cyber attack. Or, alternatively, an unforeseen physical disaster that compromises a company’s infrastructure (power outages, fires, storms, intentional damage, etc.).

That said, LuxSci possesses all these features in addition to more comprehensive single-tenancy options, scalability, and secure email hosting.

Marketing Capabilities

As with our comparisons of LuxSci against email platforms like Paubox and Virtru, it’s somewhat futile to compare each platform’s marketing capabilities – as neither LuxSci or Zix are marketing platforms, in the vein of Adobe Campaign or Oracle Eloqua, for example.

That said. LuxSci provides a HIPAA compliant marketing solution, offering automation, for streamlining email marketing campaigns, and, personalization options, for more engaging email communication campaigns.

Ease of Use

Both LuxSci and Zix perform admirably in this category, but the edge goes to Zix, as LuxSci implementations often involve the complexities that come with large-scale, high volume use cases.

LuxSci, however, is known for offering best-in-class customer support backed by HIPAA security experts, honed as a result of over 25 years of facilitating and supporting email communication strategies for healthcare organizations of all sizes.

Other HIPAA-compliant Products

With secure texting functionality, secure forms for HIPAA compliant data collection, and secure file sharing, LuxSci ranks well in this category. Zix, in contrast, provides only secure file sharing – though, because of Zix Webroot’s capabilities, offers superior secure file sharing to LuxSci.

Get Your Copy of LuxSci’s Vendor Comparison Guide

To discover how LuxSci and Zix stack up against the other leading email providers on the market when it comes to HIPAA compliance, take a look at our Vendor Comparison Guide. Evaluating 12 email delivery platforms, the guide offers comprehensive insights on what to consider when selecting a HIPAA compliant provider, and how to choose the best solution for you.

Is Google Drive HIPAA Compliant?

September 19, 2024
Erik Kangas

Google Drive can be HIPAA compliant when used with Google Workspace (formerly G Suite) under a Business Associate Agreement (BAA) and with proper configuration. Standard consumer Google Drive accounts do not meet HIPAA requirements. Healthcare organizations must implement specific security settings, access controls, and usage policies to maintain Google Drive HIPAA compliant status. These measures help ensure protected health information remains secure while benefiting from cloud storage capabilities.

Google’s Business Associate Agreement

Healthcare organizations must obtain a Business Associate Agreement from Google before storing any protected health information in Google Drive. This agreement establishes Google as a business associate under HIPAA regulations and outlines their responsibilities for protecting health data. Google offers this BAA as part of Google Workspace (formerly G Suite) business plans, but not for personal Google accounts. The agreement specifically covers Google Drive among other Google services. Organizations should review the BAA carefully to understand which Google services are covered and what responsibilities remain with the healthcare organization. This legal foundation is essential for any Google Drive HIPAA compliant implementation.

Required Security Configurations

Making Google Drive HIPAA compliant requires enabling several security features available in Google Workspace. Two-factor authentication adds an additional verification layer beyond passwords. Advanced protection program features defend against phishing and account takeover attempts. Drive access controls restrict file sharing to authorized users within the organization. Data loss prevention rules can identify documents containing patient information and apply appropriate protection policies. Audit logging must be enabled to track file access and modifications. Organizations need to configure these settings through the Google Workspace admin console rather than relying on default configurations.

File Sharing and Access Controls

Proper management of file sharing is a large aspect of Google Drive HIPAA compliant usage. Healthcare organizations should establish policies restricting how files containing protected health information can be shared. External sharing controls can prevent staff from accidentally exposing patient data outside the organization. Domain-restricted sharing limits file access to users within the organization’s Google Workspace account. Link-based sharing should be disabled for sensitive documents or carefully restricted with additional authentication requirements. Role-based access permissions ensure users can only view files necessary for their job functions. These access controls prevent both accidental exposure and unauthorized access to patient information.

Encryption and Data Protection

Google Drive HIPAA compliant implementation relies on proper encryption to protect healthcare information. Google provides encryption for data in transit between users’ devices and Google servers using TLS. Data at rest in Google Drive receives encryption with AES-256 bit keys. Organizations should use Google Workspace Client-side encryption for particularly sensitive files to maintain control of encryption keys. Staff should avoid downloading protected health information to local devices unless absolutely necessary and with appropriate security measures. Encryption serves as a fundamental protection layer that helps maintain confidentiality even if other security measures fail.

Audit and Monitoring Capabilities

HIPAA regulations require tracking who accesses protected health information. Google Workspace offers audit logging features that support HIPAA compliance. These logs record user activities including file access, sharing changes, and document modifications. Organizations should configure appropriate retention periods for these logs to support compliance verification. Security monitoring tools can analyze these logs to identify unusual access patterns or potential policy violations. Regular review of these logs helps identify potential security issues before they lead to breaches. These monitoring capabilities also provide documentation during compliance audits.

Staff Training Requirements

Technical controls alone cannot ensure compliance without proper staff education. Organizations using Google Drive HIPAA compliant configurations must train staff on appropriate usage policies. Training should cover what types of information can be stored in Google Drive, appropriate sharing practices, and security feature usage. Staff need to understand the risks of downloading sensitive information to personal devices. Regular refresher training helps maintain awareness as features and threats evolve. Documentation of this training provides evidence of compliance efforts during regulatory reviews. Even with robust technical controls, human behavior remains a critical factor in maintaining HIPAA compliance.

How are B2B and B2C Strategies Used in Healthcare Marketing?

December 5, 2024
Erik Kangas

Healthcare marketing employs distinct B2B and B2C strategies to reach different audiences within the medical and healthcare product and services sectors. B2B marketing targets healthcare providers, medical suppliers, and insurance companies, while B2C marketing focuses on patient outreach and service promotion. Both approaches require specialized marketing tactics that comply with healthcare regulations, such as HIPAA, while meeting business objectives.

Marketing to Healthcare Businesses

Medical device manufacturers, pharmaceutical companies, and healthcare technology providers develop B2B marketing plans to reach hospitals, medical practices, and other healthcare organizations. These campaigns focus on technical specifications, return on investment, and operational benefits. Marketing teams create detailed product documentation, research papers, and case studies to support their sales efforts. Teams usually participate in healthcare trade shows, industry conferences, and professional networking events to build relationships with potential buyers, as well as deploying email campaigns and social media engagement programs. B2B healthcare marketing requires extensive knowledge of medical procurement processes, insurance reimbursements, compliance requirements, and industry standards.

Patient-Focused Marketing Strategies

B2C healthcare marketing connects medical providers, payers and suppliers with potential patients through direct outreach and service promotion. Marketing campaigns display treatment options, medical expertise, and patient benefits. Organizations develop educational content about health conditions, preventive care, and treatment outcomes, and typically carry out email campaigns and engagements programs to connect with targets. They use patient testimonials and success stories to build trust with prospective patients and customers. Marketing content and materials should be education and informative, addressing common health concerns and explaining medical procedures and advice in accessible language. Patient engagement and response rates are tracked by teams to measure campaign effectiveness.

Channel Selection and Message Development

Healthcare organizations select different marketing channels based on their B2B or B2C audience. B2B campaigns utilize secure email campaigns, industry websites and media outlets, and LinkedIn for content distribution. B2C marketing can also include advertising, social media awareness and engagement, and consumer health websites. Marketers should develop separate content strategies for each audience type. B2B content emphasizes technical details and business value, while B2C messages focus on patient experience and better health outcomes. Channel selection, such as email and/or patient portals, considers audience preferences, regulatory requirements, and cost-effectiveness.

Building Professional Networks

B2B healthcare marketing can contribute to building relationships through professional networking and industry partnerships. Organizations develop referral networks with other healthcare providers and supplest, and maintain connections with payers, such insurance companies and government health plans. Marketing teams may organize educational events for healthcare professionals, including digital marketing and CX teams, and participate as members in industry associations, where they create partnership programs that benefit both organizations and their patients. These relationships help healthcare providers expand their service reach and improve awareness. Marketing efforts focus on maintaining long-term business relationships that generate consistent referrals and business opportunities.

Managing Patient Relationships

B2C marketing in healthcare focuses on patient acquisition and retention through personalized communication over channels like email and text. Organizations develop patient engagement programs that include regular health updates, marketing promotions, plan renewals, new product offers, appointment reminders, and wellness information. Marketers can create patient education materials and health resource libraries, where they manage online review platforms and patient feedback systems to maintain strong relationships. Patient relationship management includes tracking satisfaction scores and addressing service concerns promptly. Marketing campaigns can encourage patient loyalty through quality care experiences and relevant, responsive communication.

Measuring Healthcare Marketing Performance

Healthcare organizations typically track different metrics for B2B and B2C marketing success. B2B measurements include conversions, contract values, partnership agreements, and referral volumes. B2C metrics focus on patient acquisition costs, service utilization, and satisfaction ratings. Data is analyzed from all channels to optimize their strategies and resource allocation. Team should compare campaign performance across different audience segments and marketing approaches. Regular performance reviews help organizations adjust their marketing mix to achieve better results. Teams will then use analytics tools to track marketing return on investment and guide future campaign planning.