Decorative HIPAA-compliant email title card illustration

HIPAA Compliant Email: What Small Practices Must Do Now

August 19, 2026

Yes, you can send protected health information by email, but only if you back it with specific safeguards, a documented risk decision, and a signed business associate agreement with any vendor that touches that data. The HIPAA Security Rule does not ban email. It requires covered entities to prove they thought about the risk and did something about it. Encryption counts as an “addressable” safeguard, meaning you have to either implement it or document a legitimate reason you didn’t, not skip it because it sounds optional.

Before you send another patient message, do three things:

Run a focused risk analysis on your email workflow and write it down. An undocumented decision is the same as no decision to an auditor.
Get a signed BAA from every vendor that creates, receives, stores, or transmits electronic PHI (ePHI) on your behalf, including your email provider and any archiving tool.
Turn on transport encryption and lock down access controls before another PHI-bearing message leaves your server.

Table of Contents

Key Takeaways

HIPAA-compliant email is achievable for any small practice that documents a risk analysis, signs vendor BAAs, and layers encryption with access controls and audit logging.

Point	Details
Email is allowed with safeguards	HHS permits PHI by email when access control, transmission security, and documented risk analysis are in place.
BAAs are non-negotiable	Any vendor touching ePHI, including your email host, needs a signed business associate agreement first.
Encryption plus operational controls	TLS enforcement, MFA, unique user IDs, and audit logging together satisfy Security Rule expectations.
Unencrypted email needs documentation	Patients can request unencrypted delivery if you warn them of the risk and document their acceptance.
Managed support closes common gaps	tekRESCUE’s managed IT and compliance work helps small practices implement BAAs, encryption, and logging without hiring dedicated IT staff.

What Does HIPAA Compliant Email Actually Require?
What Are the Practical Options for Sending PHI by Email?
What Must Be in a Business Associate Agreement for Email?
What Technical and Operational Safeguards Does Email Compliance Require?
When Is Unencrypted Email Allowed for Patient Communication?
What Is the Step-by-Step Checklist to Make Email HIPAA Compliant?
How Do You Choose Between DIY Encryption and a Managed Provider?
When Should You Hire a Managed Compliance Partner?
Sources
FAQ

What Does HIPAA Compliant Email Actually Require?

HIPAA splits into two rules that matter here, and small practices routinely confuse them. The Privacy Rule governs who can see PHI and under what circumstances. The Security Rule governs how you technically protect electronic PHI once you’ve decided to send it. A HIPAA compliant email setup has to satisfy both: the Privacy Rule question (“should this information leave the practice this way?”) and the Security Rule question (“is the transmission itself protected?”).

HHS has been explicit that email is allowed over open networks when covered entities implement access control, integrity controls, and transmission security, and document the risk analysis behind those choices. That last part trips up more practices than the technology does. HHS doesn’t require perfection. It requires evidence you evaluated the risk and made a reasoned decision.

Here’s the addressable versus required distinction that catches administrators off guard: a “required” safeguard means you must implement it, full stop. An “addressable” safeguard, like encryption, means you must assess whether it’s reasonable and appropriate for your environment, and either implement it or document an equivalent alternative measure. Most practices sending ePHI over the internet find encryption is reasonable and appropriate almost every time, which is why “addressable” functions as “expected” in practice.

A few regulatory action points to nail down early:

Determine whether you’re a covered entity, a business associate, or both. Most physician practices, dental offices, and behavioral health clinics are covered entities.
Identify every vendor relationship that touches ePHI. Your email host, your backup provider, and your practice management software vendor likely all need BAAs.
Set a retention schedule for email records containing PHI and for your risk analysis documentation itself. Auditors ask for the paper trail, not just the current configuration.

The Security Rule’s summary page lays out the administrative, physical, and technical safeguard categories in full, and it’s worth bookmarking as your baseline reference.

What Are the Practical Options for Sending PHI by Email?

You have four realistic paths, and each one trades security for convenience differently. Understanding the trade-offs upfront saves you from picking a tool that’s technically secure but that your staff will route around within a month.

Technician connecting encryption device in server rack

Enforced TLS with modern versions. Transport Layer Security encrypts the connection between mail servers. It’s invisible to staff and patients, which is its biggest strength and its biggest weakness: if the receiving server doesn’t support TLS, some mail systems fall back to unencrypted delivery without warning anyone. NIST’s guidance on secure email recommends enforcing current TLS configurations rather than allowing opportunistic fallback.

End-to-end encryption (S/MIME or PGP). These encrypt the message content itself, not just the connection, so the message stays protected even if it lands on a compromised server. The catch is key management. Someone has to issue, rotate, and revoke certificates or keys, and most small practices don’t have that staff capacity in house.

Secure message portals with identity verification. The patient logs into a portal to read the message rather than receiving PHI directly in their inbox. This gives you the strongest audit trail and the fewest surprises, but it adds a login step that some patients abandon.

Patient portal or EHR messaging instead of email entirely. Many practices sidestep the email question by routing communication through their EHR’s built-in messaging. It’s often the lowest-friction option if your EHR already supports it, though it doesn’t help when a patient specifically wants a document like a lab result sent to their personal inbox.

Option	Security Level	Staff Friction	Audit Trail
Enforced TLS only	Moderate	Very low	Weak (depends on logs)
End-to-end encryption	High	Moderate to high	Moderate
Secure portal with login	High	Moderate	Strong
EHR/patient portal messaging	High	Low for staff	Strong

Pro Tip: Reach for a secure portal instead of ad hoc encryption tools whenever your practice regularly sends lab results, billing statements, or anything with a Social Security number. Portals give you a verifiable access log, which is exactly what an auditor or a breach investigator asks for first.

What Must Be in a Business Associate Agreement for Email?

Any vendor that creates, receives, maintains, or transmits ePHI on your behalf needs a signed BAA before you send them a single patient record. That includes your email hosting provider, your archiving vendor, and your IT support company if they have access to mailboxes. Skipping this step is one of the most common findings in HHS enforcement actions, because it’s the easiest thing to check during an audit and the easiest thing to overlook during a rushed vendor signup.

HHS business associate guidance spells out what a compliant BAA must describe: permitted uses and disclosures of PHI, required safeguards, breach reporting obligations, and a requirement that any subcontractor the vendor uses agrees to the same restrictions.

Run this checklist against any vendor contract before you sign:

Does the agreement name the specific permitted uses and disclosures of PHI, rather than vague catch-all language?
Does it require the vendor to implement appropriate safeguards matching Security Rule expectations?
Does it specify a breach notification timeline, ideally in hours or days, not “as soon as reasonably possible”?
Does it require any downstream subcontractor to sign an equivalent BAA before touching your data?
Does it grant you audit rights or at least require the vendor to provide compliance documentation on request?

Questions to ask a vendor directly, and red flags if the answers are vague:

Can you provide a copy of your standard BAA before we sign the service agreement?
What is your breach notification timeline, and is it stated in the contract or just in marketing materials?
Do you use subcontractors for storage, backup, or support, and are they under a chained BAA?
Can you provide access logs or audit reports on request, and how quickly?
What happens to our data, including backups, if we terminate the contract?

If a vendor hesitates to sign a BAA at all, that’s not a negotiating point. Walk away.

What Technical and Operational Safeguards Does Email Compliance Require?

Encryption is the headline, but auditors look well past it. The Security Rule’s technical safeguard provisions expect a layered set of controls, and email is where most of them intersect at once.

On the technical side, enforce TLS 1.2 or higher for all SMTP connections and disable fallback to older, deprecated versions. Use AES-256 for data at rest, including any archived or backed-up email store. For messages carrying especially sensitive data (mental health records, HIV status, substance use treatment), layer end-to-end encryption on top of transport security. Set up journaling or immutable archiving so messages can’t be silently altered or deleted after the fact. Practical implementation guidance from AccountableHQ pairs these technical measures with data loss prevention tools and consistent logging, which is the combination auditors actually want to see.

On the operational side:

Assign every staff member a unique user ID. Shared logins make it impossible to reconstruct who accessed what.
Apply role-based access control so front-desk staff can’t open clinical email threads they don’t need for their job.
Require multi-factor authentication on every mailbox that touches PHI, no exceptions for “just the billing account.”
Set up automated login monitoring that flags impossible logins, like a login from Texas and another from overseas within an hour.
Terminate email access the same day a staff member leaves, not at the next IT review cycle.
Enforce mobile device encryption and remote wipe capability on any phone or tablet with practice email configured.

Control Category	Example Safeguard	What It Prevents
Access control	Unique IDs, MFA, role-based permissions	Unauthorized viewing of PHI
Transmission security	TLS 1.2+, end-to-end encryption	Interception in transit
Data at rest	AES-256 encryption, encrypted backups	Exposure from stolen devices or servers
Audit controls	Immutable logs, journaling	Undetected tampering or access
Device management	Mobile encryption, remote wipe	Exposure from lost or stolen phones

Audit logs should capture who accessed a message, when, from what device or IP address, and whether it was forwarded or downloaded. Retain those logs for at least six years to match HIPAA’s general documentation retention expectation, and store them somewhere separate from your primary email system so a single compromise can’t erase the evidence.

Pro Tip: Require phishing-resistant MFA, like a hardware key or authenticator app rather than SMS codes, and split key management duties so no single person holds both the encryption keys and the access to change the logging configuration. That separation of duties is exactly what limits damage if one account gets compromised.

When Is Unencrypted Email Allowed for Patient Communication?

HHS permits unencrypted email when a patient specifically requests it, provided you’ve warned them of the risk and documented that they still want it that way. This isn’t a loophole; it’s a deliberate balance between security and patient access rights. HHS guidance on individual access requests confirms that patients generally have the right to receive their own records in the format they ask for, including plain unencrypted email, as long as the request is reasonable.

Here’s the workflow that keeps you covered:

Warn. Tell the patient, in plain language, that unencrypted email can be intercepted and isn’t a secure channel.
Confirm. Get their explicit acknowledgment that they understand the risk and still want unencrypted delivery.
Document. File the warning and the patient’s acceptance in their record, dated and specific to the request.

A short acknowledgment you can adapt for your intake forms:

“I understand that email sent without encryption may be intercepted by third parties. I am requesting that [Practice Name] send my health information to me by unencrypted email despite this risk, and I accept responsibility for that choice.”

You can reasonably refuse unencrypted email in a narrow set of cases: when your system architecture makes it technically impossible to route around encryption, or when the specific request creates a risk you can’t reasonably mitigate (sending highly sensitive records to a shared family email address, for example). In those cases, offer an alternative, such as a secure portal login or a mailed printed copy, rather than simply declining the request outright.

Pro Tip: Keep a standing folder of signed acknowledgment forms separate from clinical charts. When an auditor asks for evidence of patient consent to unencrypted communication, you want that answer in under a minute, not a chart-by-chart search.

What Is the Step-by-Step Checklist to Make Email HIPAA Compliant?

Scope a risk analysis (1 to 2 weeks). Map every place PHI touches email: intake forms, referral letters, lab results, billing statements. The HIPAA Journal’s compliance guidance recommends treating this mapping exercise as the first deliverable, not an afterthought. Evidence an auditor expects: a written risk analysis document with dates and named reviewers.
Select your technical controls (1 week). Decide between enforced TLS, end-to-end encryption, or a secure portal based on your patient volume and staff capacity. Evidence expected: a written policy stating which controls apply to which message types.
Negotiate and sign BAAs (2 to 4 weeks, often the bottleneck). Contact your email host, backup provider, and IT support vendor. Evidence expected: signed BAAs on file for every vendor touching ePHI.
Configure and test (1 to 2 weeks). Enable TLS enforcement, set up MFA, and confirm encryption at rest on your mail server and any archive. Evidence expected: configuration screenshots or a vendor attestation letter.
Train staff (ongoing, initial session 1 to 2 hours). Cover what can and can’t go in an email, how to handle patient requests for unencrypted delivery, and how to report a suspected mishandled message.
Document and schedule review (annual, minimum). Revisit the risk analysis at least once a year or after any major system change.

Training script bullets worth putting directly in front of staff:

Never put a diagnosis, treatment detail, or Social Security number in an email subject line.
If a patient asks for unencrypted email, follow the warn, confirm, document workflow before hitting send.
Report any email sent to the wrong recipient within the same business day, not at the next staff meeting.

A cybersecurity risk assessment checklist gives you a broader framework to run alongside this email-specific plan, since PHI risk rarely lives in email alone.

How Do You Choose Between DIY Encryption and a Managed Provider?

The right approach depends less on your specialty and more on whether you have someone on staff who can own ongoing configuration and monitoring. A solo practitioner with no IT staff faces a different calculation than a ten-provider group with a part-time office manager doing double duty as the compliance lead.

Small solo or two-provider practice, no in-house IT: lean toward a patient portal built into your existing EHR, or a managed provider that handles configuration and monitoring for you. DIY encryption tools require someone to maintain them, and that someone usually doesn’t exist in a two-person office.
Mid-size practice with a designated office manager: add-on encryption tools paired with a documented policy can work, provided the office manager has real time carved out for quarterly reviews and vendor management, not just a line in their job description.
Multi-location or higher patient volume: a managed HIPAA-compliant email provider or a compliance-focused IT partner usually costs less over time than the staff hours spent babysitting DIY tools, and it centralizes the audit trail across locations.

Vendor questions worth asking regardless of size: Will you sign a BAA before we send a single test message? What’s included in your breach notification process, and is the timeline in writing? Can you provide access logs on request without a support ticket delay?

Pro Tip: Price the DIY route honestly. A $10 monthly encryption add-on looks cheap until you count the hours your office manager spends troubleshooting certificate errors. Managed services bundle that labor into a predictable fee.

When Should You Hire a Managed Compliance Partner?

Common fixes a managed IT partner makes for practices: closing a gap where the email host never had a signed BAA, replacing shared logins with unique credentials and MFA, and setting up immutable audit logging that didn’t exist before. These aren’t exotic problems. They’re the same three or four gaps showing up across most small practices that never had a dedicated IT resource.

A compliance-focused partner should deliver vendor BAA management, ongoing configuration and monitoring, encrypted backups with proper key management, and incident response support if something goes wrong.

If a vendor promises “full HIPAA compliance” without offering a signed BAA, a documented risk analysis, or evidence of the safeguards they’ve configured, that promise is worth exactly nothing in an audit.

Managed IT partners built for healthcare-specific operations typically bring this experience already baked into their onboarding process, which shortens the timeline considerably compared to building it from scratch in house.

A note from tekRESCUE

I’ve spent years watching small healthcare practices treat email as an afterthought until a near-miss forces the issue. The pattern is consistent: the technology usually isn’t the hard part, the documentation is. tekRESCUE’s compliance and managed IT work with small practices centers on closing exactly the gaps this guide covers, from BAA management to audit logging. Use the checklist above, ask vendors the hard questions, and you’ll be ahead of most practices we encounter.

How tekRESCUE handles HIPAA-compliant email setup

If your practice doesn’t have the staff hours to own risk analyses, BAA negotiations, and ongoing log monitoring in house, that’s exactly the gap tekRESCUE’s managed IT services for small business are built to close. Rather than leaving your office manager to chase down vendor BAAs and configure TLS enforcement between patient calls, tekRESCUE scopes the implementation, handles vendor coordination, and sets up the monitoring and documentation an auditor expects to see. Reach out for a scoped assessment of your current email setup, and you’ll walk away with a concrete list of what’s compliant, what’s exposed, and what it takes to close the gap.

Sources

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

Is Gmail HIPAA compliant?

Standard Gmail is not HIPAA compliant on its own. Google Workspace can support HIPAA compliance for covered entities that sign Google’s BAA and configure the required security settings correctly.

Is Google Drive HIPAA compliant for storing patient records?

Google Drive can serve as HIPAA compliant cloud storage only under a Google Workspace plan with a signed BAA and properly configured access controls, not under a free personal account.

Is OneDrive HIPAA compliant?

Microsoft OneDrive can support HIPAA compliance with a signed BAA, with encryption and access controls configured to match Security Rule requirements.

Do I need a business associate agreement for my email provider?

Yes. Any email vendor that creates, receives, maintains, or transmits ePHI on your behalf must sign a BAA before you send them patient information.

Can I hire a company to set up HIPAA compliant email for my practice?

Yes, a managed IT and compliance partner like tekRESCUE can scope your risk analysis, negotiate vendor BAAs, and configure encryption and logging so your practice meets Security Rule expectations without hiring dedicated IT staff.