Email can be part of patient communication, but the way a practice uses it matters. A secure product alone cannot establish that the practice’s entire workflow meets HIPAA requirements.
This overview is for general education. Your practice’s privacy or security lead and qualified advisers should review its specific obligations and current rules.
Start with the information and the workflow
Identify where electronic protected health information, or ePHI, is created, received, stored, and sent. Include mailboxes, attachments, connected devices, backups, and services that handle messages on your behalf.
HIPAA’s Security Rule applies to covered entities and business associates. It requires administrative, physical, and technical safeguards and a risk analysis addressing ePHI. Use that analysis to guide your email controls rather than relying on a product’s marketing label. HHS Security Rule summary
Understand the encryption requirement accurately
Under the Security Rule described in HHS’s current summary, encryption implementation specifications are addressable. This does not mean they can simply be ignored: the organization must assess whether they are reasonable and appropriate, implement them when they are, and document the required reasoning and appropriate alternative measures when they are not.
Avoid treating that framework as a reason to send sensitive information without protection. Have qualified advisers evaluate the actual systems, risks, and applicable requirements. HHS distinguishes the current rule from proposed changes; a proposal should not be presented as an effective requirement. HHS encryption guidance
Handle patient communication thoughtfully
HHS permits providers to communicate with patients by email when reasonable safeguards are applied. Its guidance discusses verifying addresses, limiting information in unencrypted messages, and accommodating reasonable requests for alternative communication methods.
It also addresses patients who initiate email and the opportunity to explain the risks of unencrypted communication. Those situations need an established practice policy; they are not blanket permission to send any information through any channel. HHS patient-email guidance
Separate record retention from compliance documentation
Separate record retention from compliance documentation
HIPAA does not create a universal six-year retention period for every patient email or medical record. HHS explains that the Privacy Rule does not specify medical-record retention periods and that state laws generally govern them. Separate HIPAA documentation requirements apply to required compliance records.
Have your advisers define a retention and secure-disposal schedule that accounts for the records involved and other applicable requirements. HHS medical-record retention guidance, HHS Security Rule documentation requirements
Review the whole workflow with your privacy and security team before changing how patient information is sent, stored, or deleted.