HIPAA email security requirements: what the rule actually says

HIPAA doesn't forbid email, and it doesn't name a single email product or setting that makes you compliant. It sets standards for protecting electronic protected health information (ePHI), and you decide how to meet them based on a risk analysis. This guide quotes what the Department of Health and Human Services (HHS) actually says about email, so you can separate the rule from the marketing.

This is general information, not legal advice. How HIPAA applies to your practice depends on your facts, so check your decisions with qualified counsel or a compliance adviser.

Does HIPAA allow you to send patient information by email?

Yes. HIPAA allows email containing patient information, as long as it's adequately protected. HHS states that "the Security Rule does not expressly prohibit the use of email for sending e-PHI" and that it "allows for e-PHI to be sent over an electronic open network as long as it is adequately protected" (HHS FAQ).

The same FAQ says you "must assess its use of open networks, identify the available and appropriate means to protect e-PHI as it is transmitted, select a solution, and document the decision." In plain terms: decide how you protect email, then write that decision down.

The Privacy Rule takes the same line for talking to patients. HHS says providers may communicate with patients by email "provided they apply reasonable safeguards," such as "checking the e-mail address for accuracy before sending" and "limiting the amount or type of information disclosed through the unencrypted e-mail" (HHS FAQ). If a patient emails you first, HHS says you can assume email is acceptable to them unless they've said otherwise.

A few terms used throughout:

• Covered entity: a health plan, a health care clearinghouse, or a health care provider that conducts certain transactions electronically, such as a medical or dental practice that bills insurance.
• Business associate: a person or organization that creates, receives, maintains or transmits protected health information on a covered entity's behalf.
• ePHI: protected health information in electronic form, including in email bodies and attachments.

Which HIPAA Security Rule standards apply to email?

Several Security Rule standards apply to any system that holds or moves ePHI, and email is one of those systems. A standard must always be met. Under each standard sit implementation specifications marked "Required" or "Addressable". Quoted wording below is from the regulation as published by HHS.

HHS's Security Rule summary explains that the rule is "flexible, scalable, and technology neutral". A two-dentist practice and a hospital system meet the same standards in different ways.

Does HIPAA require email encryption?

Encryption is addressable under the current HIPAA Security Rule, which is not the same as optional. HHS says the "addressable" designation "does not mean that an implementation specification is optional." You must adopt it where it's reasonable and appropriate. Where it isn't, you adopt "an alternative measure that achieves the purpose of the standard" and "document why" (HHS summary).

Encryption also matters after something goes wrong. Breach notification applies only to "unsecured" PHI. HHS guidance on rendering PHI unusable says data in motion counts as secured when encryption complies with NIST publications such as SP 800-52 for TLS, and the decryption key hasn't been breached.

Email encryption comes in layers, and they protect different things:

• TLS between servers (STARTTLS) encrypts each hop. It's usually opportunistic, so a message can travel unencrypted if the other server doesn't support it. See STARTTLS explained.
• MTA-STS lets your domain tell sending servers to require TLS when delivering to you. See MTA-STS and TLS-RPT.
• Portal or message encryption protects the content itself, whatever the recipient's server supports.

Our guide to email encryption types for business compares them.

Can patients choose unencrypted email?

Yes. HHS guidance on the right of access says individuals "have a right to receive a copy of their PHI by unencrypted e-mail" if they ask for it that way. You must give "a brief warning" about the risk and confirm they still want it. If the individual "was warned of and accepted the risks", HHS says you aren't responsible for a disclosure while the message is in transit, including breach notification. You still need reasonable safeguards, such as entering the address correctly. A short, plain warning works. Here's an example:

Example: "Regular email isn't encrypted and could be read by others while it travels. Do you still want us to send your records to this address?"

Keep a record of the warning and the patient's answer.

Are your email provider and spam filter business associates?

A vendor that creates, receives, maintains or transmits ePHI for you is generally a business associate. You need a business associate agreement (BAA) with it before ePHI flows through its service. HHS explains on its business associates page that a covered entity must first obtain "satisfactory assurances", in a contract or other written arrangement, that the business associate will appropriately safeguard the information.

There's a narrow exception for "conduits", such as a postal service. HHS's cloud computing guidance says the conduit exception is "limited to transmission-only services" with temporary storage "incident to such transmission". A service that maintains ePHI is a business associate "even if the CSP cannot view the ePHI because it is encrypted."

Apply that to email:

The final call depends on what each service does with your mail, so check with your compliance adviser. On our healthcare page we tell practices to ask us about a BAA for their setup before changing any DNS, and we don't claim HIPAA compliance.

What happens if a phished mailbox exposes patient data?

An impermissible use or disclosure, such as an attacker reading a mailbox that holds patient information, is presumed to be a breach unless you can show a low probability that the information was compromised. HHS says you base that on a risk assessment of at least four factors (Breach Notification Rule):

1. The nature and extent of the PHI involved, including identifiers and the likelihood of re-identification.
2. The unauthorized person who used it or received it.
3. Whether the PHI was actually acquired or viewed.
4. The extent to which the risk has been mitigated.

If it's a breach of unsecured PHI, the deadlines are fixed:

Mailbox takeovers are often found late. Learn the signs an email account is compromised and check for malicious inbox rules and auto-forwarding, which attackers use to copy mail out quietly.

Is the HIPAA Security Rule changing?

A proposed update would tighten the Security Rule, but at the time of writing (October 2026) it isn't final. On December 27, 2024, HHS's Office for Civil Rights issued a Notice of Proposed Rulemaking (NPRM); it was published in the Federal Register on January 6, 2025. The HHS fact sheet lists proposals that would affect email directly:

• Remove the distinction between "required" and "addressable", with limited exceptions.
• "Require encryption of ePHI at rest and in transit, with limited exceptions."
• "Require the use of multi-factor authentication, with limited exceptions."
• Require written documentation of all Security Rule policies, procedures, plans and analyses.
• Require "deploying anti-malware protection".

HHS states that "the current Security Rule remains in effect" while rulemaking continues. The Unified Agenda entry lists the rule as a long-term action, with final action targeted for July 2027. Plan for the current rule, and treat MFA and encryption as sensible steps now rather than waiting.

HIPAA email security checklist for a practice

Use this to organize your work and your documentation. Each item supports a standard; none makes you compliant on its own.

1. Add email to your risk analysis. Cover phishing, misdirected messages, compromised mailboxes and vendor access.
2. Give everyone their own account and remove access the day someone leaves. See employee offboarding.
3. Turn on multi-factor authentication for every mailbox and admin account, and block legacy sign-in methods that skip it.
4. Filter inbound mail for malware, phishing and spoofing, and block risky attachment types.
5. Decide and document your encryption approach: TLS for every hop, MTA-STS on your domain, and a portal or message encryption for records and results.
6. Write a patient email policy, including the warning you give patients who want unencrypted email.
7. List every email vendor and confirm a BAA where one is needed.
8. Publish SPF, DKIM and DMARC so criminals can't easily send mail as your practice. Start with DMARC from none to reject.
9. Train staff on phishing and on checking addresses before sending.
10. Prepare a compromised-mailbox plan with the breach assessment steps above. Our email security incident response plan is a starting template.

Next steps

• Check your domain's SPF, DMARC and MTA-STS setup with the free Email Health Check and MTA-STS Checker.
• Ask each email vendor, in writing, whether it will sign a BAA and how long it keeps your mail.
• Review your risk analysis with your compliance adviser, and record your encryption decision.
• If you run a medical or dental practice, our healthcare page explains where inbound filtering fits and what it doesn't do.

See more buying and compliance guides.