Compliance · Healthcare

HIPAA Email Explained: Encryption, BAAs, and the 2026 Security Rule Shift

Healthcare organizations send patient information by email constantly, and a persistent myth is that HIPAA forbids it. It doesn’t — but it imposes specific safeguards that most consumer email setups don’t meet, and the rules are about to get stricter. This guide explains what HIPAA actually requires of email handling protected health information, the common mistakes that turn into violations, and the looming 2026 changes. It’s general information, not legal advice — confirm specifics with counsel or a compliance professional.

Does HIPAA allow email for patient information?

Yes, with conditions. The HIPAA Security Rule does not prohibit using email to communicate protected health information, but it imposes strict requirements on how that email must be secured. The rule is built around safeguards designed to ensure the confidentiality, integrity, and availability of PHI: access controls to restrict who can reach it, audit controls to track how it’s handled, integrity controls to keep it from being altered, authentication to verify identities, and transmission security to protect it in transit. Meet those, sign the right agreement, and train your people, and email is compliant.

The reason the myth persists is that ordinary email fails these tests by default. Many healthcare organizations still send unencrypted messages containing patient information, lack a formal email security policy, and have no agreement in place with their email provider — each a potential violation. So the accurate framing isn’t “email is banned” but “email is allowed only when properly secured,” and the work of HIPAA-compliant email is assembling the specific safeguards that turn an ordinary inbox into a compliant one.

Who must comply: covered entities and business associates

Before getting into mechanics, it’s worth being clear about who HIPAA’s email rules actually bind, because that scope has widened in a way many organizations underestimate. The rules apply to covered entities — healthcare providers who transmit health information electronically, health plans, and healthcare clearinghouses — and equally to their business associates, meaning any vendor that handles PHI on their behalf. Your email provider, your IT contractor, a billing service, a cloud storage platform: each is a business associate if it touches PHI, and each must comply.

The critical shift is that business associates are now directly liable for HIPAA compliance, not merely contractually obligated to the covered entity. This matters enormously because business associates were the source of the large majority of breached records in a recent year, and any subcontractor a business associate uses must also comply and be bound by a comparable agreement. The practical consequence is that compliance doesn’t end at your organization’s boundary — it extends down the entire chain of vendors that touch patient data, which is why evaluating a provider’s own HIPAA posture is part of your compliance work, not just theirs.

The two layers of encryption

Encryption is the safeguard most people associate with HIPAA email, and it operates at two layers. In transit, the standard is Transport Layer Security version 1.2 or higher, which protects messages as they travel between servers. At rest, the standard is the Advanced Encryption Standard with 256-bit keys, which protects messages stored in mailboxes and archives. The reason both matter is that an email “rests” on various servers during its journey and sits in storage afterward, and unencrypted PHI is readable by anyone who intercepts or accesses it along the way.

There’s a critical gap that catches organizations out. Major platforms like Microsoft 365 and Google Workspace enforce TLS by default between their own servers, but TLS is not guaranteed when sending to an external recipient on a different platform — if the receiving server doesn’t support it, the message can fall back to unencrypted. For external communications, that means adding message-level encryption through a secure portal or a protocol like S/MIME, or using a dedicated encryption service. Historically these specifications were “addressable,” meaning you could implement an equally effective alternative, but as the diagram shows, the safeguards span well beyond encryption alone.

Why do you need a Business Associate Agreement?

The Business Associate Agreement is the requirement people most often miss, and skipping it makes everything else moot. Under HIPAA, your email provider is a “business associate” if it processes, stores, or transmits protected health information on your behalf — which an email service handling PHI inevitably does. A BAA is the contract that binds the provider to HIPAA’s protections, defines its security obligations and liability, and is legally required before you may disclose PHI to it. Without a valid BAA, any disclosure of PHI to that provider is itself a violation.

The practical trap is that having a BAA-capable provider isn’t the same as having a BAA. Microsoft and Google offer HIPAA Business Associate Agreements, but you must specifically request and sign them — using Outlook or Gmail doesn’t automatically make your email compliant, and you need a paid plan, such as Microsoft 365 Business Premium or Google Workspace, not a free account. Free consumer services like personal Gmail, Yahoo, and AOL don’t offer BAAs at all and must never be used for PHI. The agreement itself must cover roughly ten specific legal requirements to be valid, which is why it warrants careful review rather than a quick click-through, much as our data residency guide stresses for where the data lives.

Choosing a HIPAA email provider

The provider decision shapes how much of the compliance burden you carry yourself versus how much the platform handles. There are broadly three categories, and only two of them can ever be compliant. The table compares them.

The trade-off between the two compliant options is configuration effort versus cost. A major platform like Microsoft 365 or Google Workspace gives you a BAA, TLS, at-rest encryption, message encryption for external recipients, and data loss prevention — but you configure and maintain those controls yourself. A dedicated healthcare email provider bundles encryption, DLP, and the BAA together, often with the workflow advantage of encrypting external messages without forcing the recipient to create an account or enter a password, at a per-user monthly cost. Smaller practices often prefer the dedicated route for simplicity; larger organizations already on a major platform usually configure it in place.

Access and audit controls

Beyond encryption and the BAA, HIPAA requires controls over who can access PHI and a record of what they did. On the access side, email accounts handling PHI need multi-factor authentication, unique credentials for each user rather than shared clinical accounts, automatic session timeouts, and role-based permissions that enforce the “minimum necessary” standard — giving each person only the access their job requires. These controls ensure that a compromised password or an over-broad account doesn’t expose patient data wholesale.

On the audit side, organizations must maintain logs recording who accessed which messages and when. This isn’t bureaucratic box-ticking: those logs are what let you investigate a suspected breach and respond to an audit from the HHS Office for Civil Rights, and an inability to produce them is itself a weakness. The two work together — access controls limit exposure, while audit logs provide accountability after the fact, ensuring that every interaction with PHI is both restricted and traceable, the same defense-in-depth logic behind strong email authentication.

Retention, forwarding, and common violations

Two operational requirements round out the technical picture. First, retention: HIPAA requires that PHI and related documentation be kept for at least six years, which means email containing PHI needs an archiving system capable of preserving it and producing it in response to a patient’s access request or an accounting-of-disclosures request, generally within thirty days. Second, forwarding controls: auto-forwarding to external domains should be disabled, because PHI escaping to an uncontrolled inbox is a breach waiting to happen.

That second point connects to the most common violations, which are mundane rather than exotic. The classic mistake is an employee emailing PHI to their personal account to work on at home, which strips away every safeguard at once. Others include sending unencrypted PHI, losing an unencrypted device, and sharing PHI with a third party that lacks adequate protections. None of these are sophisticated attacks — they’re everyday lapses, which is exactly why workforce training is a HIPAA requirement, not an optional nicety. A patient’s written consent before emailing them PHI is also considered best practice.

How do you make email HIPAA-compliant?

Pulling it together, there are two practical routes. The first is configuring a major platform: take a paid Microsoft 365 or Google Workspace plan, sign the HIPAA BAA, enforce TLS and at-rest encryption, enable MFA and audit logging, set up data loss prevention to catch PHI leaving in message bodies or attachments, and add message-level encryption for external recipients. The second is a dedicated healthcare email provider — services built specifically for this purpose that bundle encryption, DLP, and a BAA, often with the workflow advantage of encrypting external messages without making the recipient create an account. The terminal lays out the checklist either route must satisfy.

# Making email HIPAA-compliant
BAA … signed with the provider; verify it covers ePHI
TLS … 1.2+ enforced inbound and outbound
AT-REST … AES-256 on mailboxes and archives
EXTERNAL … portal or message-level encryption for outside recipients
MFA … on every account that touches PHI
AUDIT LOGS … who accessed which message, when
DLP … block PHI in bodies, subjects, attachments
NO AUTO-FWD … disable forwarding to external domains
RETENTION … archive for a minimum of six years
TRAINING … document workforce training and policies
# Encryption alone is not compliance — it’s one control among many.

The point the checklist drives home is that encryption alone isn’t compliance. It’s the most visible safeguard, but a HIPAA-compliant email program is the whole stack — the agreement, the access and audit controls, the retention, the training — working together, with encryption as one essential layer rather than the entire answer.

What changes under the 2026 Security Rule?

The biggest development is a proposed overhaul of the HIPAA Security Rule, the first major update since 2013, driven largely by the Change Healthcare breach that compromised the records of nearly 193 million people. The headline change is the removal of the “addressable” category: safeguards that organizations could previously decline to implement if they documented an alternative — including encryption and multi-factor authentication — would become flatly mandatory. The proposal also adds annual security risk assessments, regular vulnerability scanning, network segmentation, and annual compliance audits, shifting HIPAA from a checklist exercise toward continuous, measurable security.

The honest status, as of mid-2026, is that this is proposed rather than final. The target was to finalize the update around May 2026, but no final rule has been issued and there’s no confirmed timeline, partly because of significant industry pushback — a coalition of healthcare organizations asked HHS to withdraw it, citing a projected first-year cost around nine billion dollars and the strain on small and rural providers. So the right posture is to prepare for the direction without assuming a date: MFA and strong encryption are already best practice and trending toward required, and business associates now bear direct liability — they were the source of most breached records in a recent year. For organizations that want direct control over their email infrastructure, encryption, and access logging to meet HIPAA’s demands, our PowerMTA server hosting gives you command of the sending stack — while the surrounding discipline of agreements, controls, and training is what actually makes email compliant.