Cybersecurity · Healthcare
No email service is HIPAA compliant on its own. Here is what a BAA covers, which settings matter, how encryption works and when you may email patients.
A BAA comes first
Settings matter as much
Encryption options compared
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
Email is HIPAA compliant when three things are true: your email provider has signed a business associate agreement (BAA) with you, your account is configured with HIPAA’s safeguards (unique logins, multi-factor authentication, access controls, audit logs, encrypted devices), and messages containing protected health information (PHI) are protected in transit, usually through encryption, with staff trained on when to use it.
Microsoft 365 and Google Workspace both offer BAAs for their business services. Free consumer Gmail and personal Outlook.com accounts should not be used for PHI. Both Microsoft and Google say plainly that signing their BAA does not by itself make you compliant; how you set up and use the service is your responsibility. This is general information, not legal advice; confirm your approach with a healthcare attorney or compliance advisor.
Under HIPAA, a cloud email provider that stores or transmits PHI for you is a business associate, so you need a BAA with them before PHI goes into the account.
The HIPAA Security Rule’s technical safeguards apply to email like any other system holding electronic PHI. For a small practice that means:
If you are on Microsoft 365, our Microsoft 365 security settings guide walks through most of these, including where to find each setting in the admin center.
Want to know whether your practice’s email setup would pass a close look? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, backups and business continuity as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
HIPAA treats encryption in transit as an addressable specification: you must implement it or document why an equivalent alternative is reasonable. In practice, encryption is the expected answer. There are three common approaches.
Microsoft 365 and Google Workspace encrypt mail in transit with TLS when the receiving server supports it. It is invisible to users but depends on the other side. Some services let you require TLS for specific partners, such as a lab or billing company.
The recipient gets a link and signs in or uses a one-time code to read the message. Microsoft Purview Message Encryption works this way. It protects mail to any recipient, including patients on free Gmail accounts.
Add-on services that encrypt automatically or by policy, usually with their own BAA. Useful if you want encryption without staff remembering to trigger it.
Whatever you choose, make it simple: a single rule such as “type in the subject line” or automatic encryption when PHI is detected works better than relying on judgment.
HHS guidance says HIPAA does not prohibit emailing patients, as long as reasonable safeguards are used. Under the HIPAA right of access, if a patient asks to receive their information by unencrypted email, a provider may send it that way after warning the patient of the risks and the patient still prefers it. Document the patient’s choice, and keep the warning language consistent so every staff member gives the same explanation.
Practical rules for staff: confirm the email address before sending, send the minimum necessary, never put diagnoses in subject lines and use encryption by default unless the patient has chosen otherwise.
Settings handle most of the risk; people handle the rest. A short written policy, signed by every staff member and covered in yearly training, should answer these questions:
Misdirected email is one of the most common causes of small privacy incidents. A clear rule to report it immediately lets the practice assess whether it is a reportable breach, which is a decision for your privacy official and counsel, not the staff member.
Our cybersecurity services cover MFA, access reviews, same-day removal of leavers, email security, encryption and monitored backups. For the full picture of what HIPAA expects from your IT, see HIPAA IT requirements for small medical practices.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Free consumer Gmail should not be used for PHI. Google Workspace can be used for PHI once an administrator accepts Google’s BAA and the account is configured with appropriate safeguards. This is general information.
Microsoft offers a HIPAA BAA by default through its Data Protection Addendum for in-scope services, including Exchange Online. Microsoft says the BAA alone does not make you compliant; your configuration and use must meet HIPAA’s requirements.
Encryption in transit is an addressable specification, meaning you must implement it or document a reasonable alternative. Most practices use encryption as the standard answer.
HHS guidance says a provider may send a patient their information by unencrypted email if the patient requests it after being warned of the risks. Document the patient’s preference.
If PHI, such as a patient list tied to treatment, goes into the platform, yes. Many marketing platforms do not sign BAAs, so keep PHI out of them or choose a vendor that will sign one.
