HIPAA-Compliant Email: What Actually Qualifies (and What Doesn't)

What makes email HIPAA-compliant?

Email is HIPAA-compliant when the way your practice uses it meets the Security Rule, not when the vendor’s marketing says so. HHS says plainly that the Security Rule does not prohibit email for ePHI. It does require you to protect it, and you have to document how.

The requirements live in the technical safeguards at 45 CFR 164.312. For a mailbox that means:

• Access control. A unique login for every person. No shared front-desk password.
• Audit controls. A record of who got into which mailbox, and when.
• Integrity. Mail can’t be quietly altered or deleted.
• Person authentication. Proof the person signing in is who they claim to be. In practice, that’s MFA.
• Transmission security. Protection for PHI while it moves across the internet.

Practice managers usually hear “encrypted” and stop there. Encryption is one line on that list. HHS also doesn’t certify or endorse any product, so a “HIPAA certified” badge on an email service means nothing official.

One more trap. Encryption is marked “addressable” in the rule, and people read that as optional. It isn’t. Under 45 CFR 164.306(d), you either implement it or document why it isn’t reasonable and put an equivalent measure in its place. For email that crosses the internet, I have never seen a good reason to skip it.

Is Microsoft 365 / Google Workspace HIPAA-compliant?

Both can be. Neither is set up that way on day one. Microsoft and Google each sign a BAA covering their email, and each one says in writing that the BAA doesn’t make you compliant. The configuration is on you or your IT provider.

Microsoft lists Exchange Online among the services covered by its HIPAA Business Associate Agreement. Their own FAQ asks whether having the BAA ensures compliance and answers “No,” because “using Microsoft services doesn’t on its own achieve HIPAA compliance.”

Google lists Gmail in its HIPAA Included Functionality. Their HIPAA guidance for Workspace says third-party add-ons are not covered by the BAA, and that customers without a signed BAA “must not use PHI” in Workspace.

Transit is the other gap. Google’s own docs say Gmail tries TLS by default, but if the receiving server doesn’t use it, the message still goes out unencrypted. So “Gmail is encrypted” is true right up until someone emails a referral to a small office running an old mail server. That’s why you need a deliberate path for outbound PHI, not a default.

The free consumer versions of either product are a different story. If the account has no BAA behind it, PHI doesn’t go in it.

Do you need a BAA with your email provider?

Yes. Your email provider stores your messages, which makes it a business associate. HHS’s cloud computing guidance says a cloud provider that stores ePHI is a business associate “even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data.”

Some vendors lean on the “conduit” exception, the idea that they’re like the post office. HHS shuts that down too. The conduit exception covers transmission-only services with temporary storage. A provider that keeps your mailbox is storing PHI, so it isn’t a conduit.

Getting the BAA works differently on each platform:

• Microsoft 365. The BAA is included by default through the Microsoft Online Services Data Protection Addendum for customers who are covered entities or business associates. Nothing to sign, but you should know it exists and keep a copy.
• Google Workspace. A super administrator accepts it electronically in the Admin console under Account settings, then Legal and compliance. If nobody has clicked it, you don’t have one.

Your IT provider touches your mail too, so they need a BAA with you as well. We sign one with every medical practice we support.

Can you email patients?

Yes. HHS says the Privacy Rule lets providers email patients about health issues and treatment, as long as you use reasonable safeguards. Their examples are simple ones: check the address before you hit send, confirm it with the patient first, and limit how much detail goes into an unencrypted message.

Patients also have a say in how you reach them. Under the Privacy Rule, a patient can ask you to communicate by alternative means, and you honor that if it’s reasonable.

Records requests are where practices get nervous. HHS’s right of access guidance is direct. If a patient asks for a copy of their records by unencrypted email, they have a right to it. You give a brief warning that someone could read it in transit, and confirm they still want it that way. If they say yes, you send it. Once they’ve been warned and accepted the risk, you aren’t responsible for it being intercepted in transit. You still have to type the address right.

What you can’t do is make them drive in to pick up a printout because email feels risky to you. Write the warning once, keep it on file, and have the front desk use the same script every time.

What we check on day one

When we take over a practice’s email, these are the first things we look at, before anything else changes:

1. Is there a BAA? For Google, did a super admin actually accept it? For Microsoft, is a copy of the BAA from the Service Trust Portal on file?
2. Is MFA enforced or just available? On an inherited tenant, a title company closer’s inbox was taken over because 2-Step Verification was enrolled but not enforced. Same risk in a clinic, different data.
3. Where is mail being forwarded? Auto-forward rules to personal Gmail or Yahoo accounts move PHI out of the BAA’s reach without anyone noticing.
4. Who has access to what? Shared inboxes, former employees still holding mailbox access, and one login shared across the front desk all fail the unique-user requirement.
5. Is audit logging on, and kept long enough to answer a question later?
6. What happens when a device walks off? Every phone and laptop with the mail app synced is a copy of the mailbox. We once wiped a stolen laptop 16 minutes after the theft. That only works if the device is managed before it’s stolen.
7. What’s the outbound path for PHI? Staff need one clear way to send encrypted mail, and they need to know when to use it.

None of this is exotic. It’s the same list I’d expect an auditor to ask about.

What this looks like when we do it

For a medical practice, email is one piece of the Security Rule work, not a separate product. We confirm the BAAs, enforce MFA at the tenant, kill risky forwarding, turn on and keep audit logs, set up an encrypted path for outbound PHI, and put every device that touches the mailbox under management with encryption and remote wipe. Then we write down what we did and why, because a risk assessment needs that paper trail.

It runs on our month-to-month managed IT, three-user minimum, with under-15-minute response on anything critical. Our best fit is a regulated practice of 5-100 users. If you aren’t sure your mail would hold up to a question from OCR, book a call. Fifteen minutes is enough to find out what’s missing.