HIPAA-Compliant Email for Healthcare

Email is one of the most common ways PHI is inadvertently disclosed. Get the technical and policy controls right with this practical guide.

Published April 7, 2026 4 min read

Why Standard Email Is Not HIPAA Compliant

Standard email — Gmail, Outlook, Yahoo Mail, and most consumer and business email services — is not HIPAA compliant for transmitting PHI because:

Emails in transit may not be encrypted end-to-end (TLS between mail servers is opportunistic, not guaranteed)
Email providers typically do not offer HIPAA BAAs for standard accounts
Email is stored in the provider's servers, which constitute a third-party ePHI repository without a BAA
Email is easily forwarded, shared, or accessed by unauthorized parties
Standard email provides no audit trail of who has accessed sensitive messages

The risks are not theoretical — email is consistently one of the top sources of HIPAA breaches reported to HHS. Misdirected emails (sent to wrong recipient) and unauthorized forwarding to personal accounts are common breach causes.

What Makes Email HIPAA Compliant

HIPAA-compliant email requires three elements working together:

Encrypted transmission: Email containing PHI must be encrypted during transmission. S/MIME or TLS with enforced delivery are common approaches. Some solutions use secure message portals where the email notifies the recipient to log in to retrieve a secured message.
Encrypted storage: Email stored on servers must be encrypted at rest. This applies to both your mail server and any backup systems.
Business Associate Agreement: Your email provider must sign a HIPAA BAA before you use their services to send or store PHI.

Additionally, your organization must have policies governing when email can be used for PHI, staff training on those policies, and access controls to email systems that limit exposure.

Email Providers That Offer HIPAA BAAs

Several major email providers offer HIPAA BAAs for business accounts:

Google Workspace (Business or Enterprise): Google offers a BAA that covers Gmail and Google Drive for Workspace users. Must be explicitly activated in account settings — it is not automatic.
Microsoft 365 (Business Premium or higher): Microsoft includes a BAA in its Online Services Terms for qualifying plans. Review which specific M365 services are covered.
Proton Mail for Business: End-to-end encrypted email with HIPAA BAA available for business accounts.
Paubox: HIPAA-compliant email service designed specifically for healthcare, with end-to-end encryption and BAA included.
LuxSci: Healthcare-focused email provider with BAA, encryption, and detailed compliance documentation.

Email from Website Forms

One of the most overlooked HIPAA email risks is the automated notification email generated by website forms. When a patient submits an appointment request or health questionnaire, many form platforms automatically email the submission contents to staff. If this notification email goes to a standard inbox without HIPAA controls, it creates a violation.

Configure form notifications to send a link to the secure submission rather than the PHI itself
If you must send PHI via form notification emails, ensure the destination email account is covered by a BAA
Do not allow form notification emails to be auto-forwarded to personal accounts
Review all automated email workflows in your website platform — CMS plugins, booking systems, and intake tools often have undocumented email notification behaviors

Patient-Initiated Email Communication

Patients have the right to request communication by any means they choose, including unencrypted email. If a patient requests to receive their health information via standard email after being informed of the risks, you may honor that request. Document the patient's informed preference.

However, this patient preference exception is narrow:

The patient must initiate the preference for unencrypted communication
You must inform the patient of the risks of unencrypted email
The preference should be documented in their record
This exception covers communications with the patient — it does not authorize unencrypted email among your own staff or with business associates

Check your site for free — Instant HIPAA compliance scan, no signup required.

Scan Now

Frequently Asked Questions

Is Gmail HIPAA compliant for healthcare providers?

Standard Gmail (personal accounts) is not HIPAA compliant. Google Workspace for business includes a HIPAA BAA that covers Gmail when properly activated. If your practice uses Google Workspace and has executed the BAA through your admin console, you can use Gmail for PHI — but you must also configure Gmail appropriately (enforce TLS, manage retention policies, and train staff on proper use).

Can I fax PHI instead of emailing it?

Traditional fax transmissions are not subject to the HIPAA Security Rule's ePHI requirements in the same way as email, as analog fax is generally not considered electronic. However, digital fax services (fax-to-email, internet fax) do create ePHI and must comply with the Security Rule. Additionally, fax carries its own HIPAA risks — misdirected faxes are a common breach source. Use secure fax with delivery confirmation and staff procedures to prevent misdirection.

What is the minimum standard for email encryption under HIPAA?

HIPAA does not specify encryption algorithms or standards by name. It requires that ePHI be protected in accordance with the NIST guidelines referenced in HHS guidance. In practice, NIST recommends AES-256 for encryption at rest and TLS 1.2 or higher for transmission. For email specifically, enforced TLS (where the message is rejected if the receiving server cannot support TLS) is more secure than opportunistic TLS.

Do appointment reminder emails contain PHI?

Appointment reminder emails that include the name of the practice, the appointment time, and the provider's name typically constitute PHI because they identify an individual in relation to receiving healthcare services. Reminders that only say 'you have an appointment tomorrow' without identifying the healthcare context are generally not PHI. Review the content of your automated appointment reminders against this standard.

Explore More HIPAA Resources

HIPAA Website Compliance Checklist What Makes a Website HIPAA Compliant Is My Website HIPAA Compliant?Understanding the HIPAA Security Rule for Websites HIPAA Compliance Guide for Telehealth Platforms HIPAA-Compliant Web Forms: Complete Guide How HIPAA Website Scanning Works Free HIPAA Compliance Checker: What You Get and What You Miss HIPAA Risk Assessment for Websites Choosing HIPAA-Compliant Web Hosting HIPAA Covered Entities: Who Needs to Comply with HIPAA HIPAA Business Associate Agreement: What You Need to Know HIPAA Breach Notification Rules for Websites Protecting PHI on Websites HIPAA Compliance and Website Cookies and Tracking Pixels HIPAA-Compliant Email for Healthcare HIPAA Compliance for Small Medical Practices HIPAA Guard Automated Scanning vs Manual HIPAA Audits How do I choose the best HIPAA compliance tool?What is a HIPAA website scanner?How does a HIPAA risk assessment tool work?HIPAA Website Scanner vs. Free Compliance Checker: Which is better?How do I fix HIPAA compliance failures identified by a tool?What factors influence the cost of HIPAA compliance tools, and how can I budget for them?