HIPAA compliant email for small practices

Who this page is for

• You email referrals, lab results, X-rays, superbills or appointment details, and you’re not sure that’s allowed.
• You use a free Gmail or Yahoo address, or your web host’s email.
• You’re on Google Workspace or Microsoft 365 but never looked at the BAA.
• Patients ask you to email them their records.

The problem in plain words

A solo therapist uses a personal Gmail address for scheduling and intake forms. A dental front desk emails radiographs to an oral surgeon from Outlook. Neither is automatically a violation.

What’s missing is a BAA with the email provider, MFA on the mailbox, and a decision about when PHI gets encrypted.

What HIPAA requires for email

There is no email-specific HIPAA rule. The Security Rule’s general standards apply to any ePHI you send.

HHS’s FAQ on email says the rule “does not expressly prohibit the use of email for sending e-PHI.” It points to access control (164.312(a)), integrity (164.312(c)(1)) and transmission security (164.312(e)(1)).

Encryption in transit is an addressable specification under 45 CFR 164.312(e)(2)(ii). HHS says ePHI may be sent over an open network “as long as it is adequately protected,” and that you must document how you chose to protect it.

On the Privacy Rule side, HHS’s FAQ on emailing patients allows it with reasonable safeguards. Its examples include checking the address before sending and limiting the amount or type of information in unencrypted email.

The BAA is not optional

An email provider stores and transmits your ePHI. That makes it a business associate. Under 45 CFR 164.502(e), you need satisfactory assurances, documented in a written contract that meets 164.504(e).

HHS’s cloud computing guidance says a cloud provider that stores ePHI is a business associate “even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data.” It also says the conduit exception is “limited to transmission-only services,” which doesn’t describe a mailbox.

Is Gmail HIPAA compliant?

The short version: Gmail in Google Workspace can be used with PHI after your administrator accepts Google’s BAA. Gmail is on Google’s HIPAA Included Functionality list as of August 31, 2026.

Google’s HIPAA help page says the BAA is reviewed and accepted by a super administrator in the Admin console. A free @gmail.com account has no Admin console, so there’s nowhere to accept that BAA [VERIFICAR].

The full setup is on the Google Workspace and HIPAA page.

Microsoft 365 and HIPAA

Microsoft’s HIPAA offering page says its BAA “is available through the Microsoft Online Services Data Protection Addendum by default” to customers who are covered entities or business associates. Microsoft also says it “can’t use a customer’s Business Associate Agreement.”

The in-scope list for Office 365 commercial includes Exchange Online, Microsoft Teams, SharePoint Online, OneDrive for Business, Forms and Microsoft Defender for Office 365. Microsoft Bookings did not appear on that list when I checked, so don’t use it for patient details until you confirm.

Microsoft is direct about the limits: “using Microsoft services doesn’t on its own achieve HIPAA compliance.”

Encryption in transit vs end to end

TLS encrypts the connection between mail servers, much like HTTPS for a website.

TLS has two limits. It only protects the message while it moves, and each provider along the path can read it. It also depends on the receiving server; if that server doesn’t support TLS, some setups fall back to sending without it.

End-to-end or portal encryption keeps the message encrypted until the recipient opens it. Depending on the product, the recipient opens it through a secure link, a portal or a plug-in. Each vendor handles this differently, so ask how a patient with a plain Yahoo or Gmail address opens the message before you buy.

HICP’s small-organization guidance, sub-practice 1.S.A in Technical Volume 1, lists implementing email encryption alongside MFA and spam and malware filtering.

When a patient asks for unencrypted email

Some practices get this wrong by refusing.

HHS says “individuals have a right to receive a copy of their PHI by unencrypted e-mail” if they ask, in its right of access FAQ. You first give “a brief warning” that there is some risk, and confirm they still want it.

HHS’s FAQ 2061 adds that covered entities “are not responsible for a disclosure of PHI while in transmission to the individual,” assuming the individual was warned and accepted the risk. You still have to type the address correctly.

The right of access FAQ also says you can’t require a patient to accept an unsecure method. So offer the secure option, and honor the unencrypted request when the patient makes it after the warning.

Options compared

Option	Best for	How it works	Pricing info (as of October 2026)	Pros	Cons
Google Workspace (I don’t work with them)	Practices already on Google, or starting fresh	Business email under Google’s BAA, accepted in the Admin console	Prices didn’t display on Google’s pricing page when I checked [VERIFICAR]	Gmail, Drive, Calendar, Meet and Voice for managed users are on the covered list	You configure sharing, DLP and any added encryption yourself
Microsoft 365 (I don’t work with them)	Practices using Outlook and Office	Business email under Microsoft’s BAA in the DPA	Business Basic $7.00 per user per month, paid yearly (Microsoft)	Exchange Online, Teams and OneDrive in scope; Business Premium adds Defender for Business and Intune	Not every Microsoft app is in scope; check before using one with PHI
Paubox (I don’t work with them)	Practices that want a HIPAA-focused email suite with security and archiving tiers	Email suite in tiers: Standard, Plus (adds email security), Premium (adds archiving and DLP)	Price didn’t display when I checked [VERIFICAR]; 5 senders included; 14-day trial (Paubox)	Paubox says it includes a BAA with all accounts	Separate bill on top of your mailbox
Virtru (I don’t work with them)	Google Workspace or Microsoft 365 users who want add-on encryption	Encryption add-on, with Virtru for Gmail and Virtru for Outlook listed as products	Starter $119 per month billed annually, includes 5 users (Virtru)	Starter lists a signed BAA; works with Microsoft 365 and Google Workspace	Per-user price above 5 users isn’t published
LuxSci (I don’t work with them)	Practices that also send high volumes of patient email	Secure email gateway, plus high-volume and marketing plans	Secure Gateway from $50 per month for up to 5 users (LuxSci)	BAA included on its plans	Larger tiers are quote-only
Coro (I work with them)	Practices that want email security bundled with endpoint protection	Email security, inbound gateway and secure messages modules in several packages (Coro)	Not published; quote-based	One console for email and endpoint threats	BAA and outbound encryption details not confirmed [VERIFICAR]

What it costs

Published prices as of October 2026:

• Microsoft 365 Business Basic: $7.00 per user per month, paid yearly.
• Virtru Starter: $119 per month, billed annually, for 5 users.
• LuxSci Secure Gateway: $50 per month for up to 5 users.

Check Google Workspace and Paubox prices on their own pricing pages before you budget [VERIFICAR]. What changes the price: number of mailboxes, whether you need archiving or DLP, whether encryption is a separate add-on, and annual versus monthly billing.

My recommendation by scenario

• If you’re a solo or 2 to 3 person practice on free Gmail, move to Google Workspace or Microsoft 365, accept the BAA, turn on MFA, and send records through a portal or encrypted option. Use plain email only for what HHS allows with the safeguards above.
• If you already have Google Workspace or Microsoft 365, you probably don’t need a new email provider. Confirm the BAA, lock down settings, and add encryption only for messages with PHI that go outside the practice.
• If staff email PHI to outside providers every day, compare a dedicated encryption service like Paubox, Virtru or LuxSci. Ask each one whether encryption happens automatically or depends on staff clicking a button.
• If phishing is your bigger worry than encryption, put money into email filtering and training first. Coro bundles email security with endpoint protection.

Setup checklist

• Accept or confirm the BAA with your email provider, and save a dated copy or screenshot.
• Turn on MFA for every mailbox, including shared and former-employee boxes.
• Remove email accounts on hosting or website platforms that have no BAA.
• Decide, in writing, which messages must be encrypted and how staff do it.
• Set up spam, phishing and malware filtering and tag external messages.
• Write a short script for the warning you give patients who ask for unencrypted email.
• Block auto-forwarding to personal accounts.
• Add the email system to your risk analysis.

Questions to ask any email provider

1. Do you sign a BAA, and which of your services does it cover?
2. Does the recipient need an account or plug-in to open an encrypted message?
3. What happens if the receiving server doesn’t support TLS?
4. Can I revoke an encrypted message sent to the wrong person?
5. Is there DLP that detects PHI and prompts encryption automatically?
6. How long do you keep messages, and can I export them when I leave?

Common mistakes

1. Assuming “business email” means a BAA. With Google, a super administrator has to accept it. With Microsoft, confirm the DPA applies to your subscription.
2. Using an unlisted app with PHI. Google says third-party add-ons aren’t covered, and not every Microsoft app is in scope.
3. Refusing a patient’s unencrypted email request. HHS says patients have that right, after a brief warning.
4. Sending PHI in the subject line. Even encrypted services may leave the subject visible. Keep names and diagnoses out of it.
5. MFA for the owner only. Attackers look for the one mailbox without it.

For faxes and documents that still go by fax, see the HIPAA compliant online fax page. The healthcare cybersecurity guide shows where email fits with everything else.

If you want me to compare email options for your practice, including what you already pay for, send me your current email setup.