HIPAA-Compliant Email: Requirements, Encryption and Provider Checks

Yes, you can email protected health information (PHI) under HIPAA, but no email product is compliant on its own. Compliance depends on how you set up and use the service: a signed business associate agreement (BAA) with your provider, encryption, access controls, audit logging and a written staff policy. This page turns those requirements into a checklist, explains the rules for emailing patients and running email marketing, and shows where Mailchimp, Proton Mail and Virtru stand. Each vendor answer is marked for verification and dated.

Is email HIPAA compliant? The short answer

HIPAA does not ban email containing PHI. It allows it when appropriate safeguards are in place. No email product is "HIPAA certified" or "HIPAA approved," because HHS does not certify or approve software. When a vendor says its email is "HIPAA compliant," it usually means it will sign a BAA and offers the controls you need. You still have to configure and use those controls.

In practice, "HIPAA-compliant email" means three things together:

• A provider that signs a BAA for the plan you are on.
• Your configuration: encryption settings, multi-factor authentication (MFA), logging and retention.
• Your people and policy: who may email PHI, what they may send, and how they handle mistakes.

Standard consumer accounts such as free Gmail, Outlook.com and Yahoo Mail are not designed for PHI and should not be assumed to come with a BAA. Do not use them for PHI, including "just this once" from a personal phone.

The five requirements are a signed BAA, encryption in transit and at rest, access controls and authentication, audit controls and integrity protection, and a written policy with staff training. Each is covered below. For related topics, see our healthcare communication and HIPAA guides.

HIPAA email requirements: what makes email compliant

1. Business associate agreement

Any email host or encryption service that creates, receives, maintains or transmits PHI on your behalf is a business associate. It must sign a BAA before PHI flows through it. Check two things:

• Which plan or edition the BAA covers.
• Which services inside the vendor's suite it covers. Mail may be covered while an add-on is not.

2. Encryption

Under the Security Rule, encryption of stored data and encryption during transmission are "addressable" implementation specifications. Addressable does not mean optional. It means you must:

1. Assess whether encryption is reasonable and appropriate for your environment.
2. Implement it if it is.
3. If it is not, document why and put an equivalent alternative in place.

For email, few clinics can justify skipping encryption. The practical baseline is:

• TLS in transit, enforced where possible, so mail is not delivered in plain text.
• Encryption at rest on the provider's servers.
• Message-level encryption or portal delivery for sensitive mail to outside recipients whose servers may not support TLS.

HHS has proposed changes to the Security Rule that could affect how encryption is treated. Check the current status before you finalize your policy.

3. Access controls and authentication

• A unique user ID for every staff member. No shared "frontdesk@" logins without individual credentials behind them.
• MFA on every mailbox that can contain PHI.
• Automatic logoff on shared front-desk workstations.
• Same-day offboarding when someone leaves: disable the account, revoke mobile sessions, and decide who takes over the mailbox.

4. Audit controls and integrity

Your email system should log sign-ins, admin changes and mailbox access, so you can answer "who opened this and when." Set retention rules that match your records policy, and protect messages from improper alteration or deletion.

5. Policy and training

You need a written HIPAA email policy, applied with the minimum-necessary standard, and staff trained on it. A disclaimer at the bottom of an email is a notice, not a safeguard. For the wider program, use our HIPAA compliance checklist for clinics.

Safeguard	Status under HIPAA	What it looks like in email
BAA	Required before PHI is shared with the vendor	Signed BAA on the plan you use
Unique user identification	Required	Named accounts for each staff member
Automatic logoff	Addressable	Session timeouts on shared workstations
Encryption at rest	Addressable	Provider-side storage encryption
Transmission encryption	Addressable	Enforced TLS; message-level encryption or portal
Audit controls	Required	Sign-in and access logs, retained
Person or entity authentication	Required	MFA or SSO

Emailing patients, medical records and photos

Patients who ask for unencrypted email. Under the right of access, a patient can ask to receive their PHI by unencrypted email. You should first warn them of the risk. If they still want it, you may send it. Document both the request and the warning in the patient's record.

Medical records to patients or other providers. Use encrypted delivery or a secure portal. Before sending:

• Confirm the address. Read it back over the phone if needed.
• Send only what the request requires. A referral coordinator asking for last month's visit note does not need five years of history.

Photos. An identifiable image, such as a face, a tattoo or a wound photo with a wristband in frame, is PHI. The same email rules apply. Be especially careful with staff phones that auto-sync camera rolls to personal iCloud or Google Photos accounts. A photo can leave your control before anyone presses send. Texting raises similar issues; see our HIPAA-compliant texting rules.

Checks before sending any patient email:

• Verify the recipient, especially with autocomplete.
• Keep PHI out of subject lines ("Your lab results," not "Your HbA1c results").
• Use individual sends or BCC for groups. Never CC a list of patients.
• Turn on encryption for anything clinical or financial.

How to choose a HIPAA-compliant email service

Clinics usually take one of three routes:

1. A business email suite that signs a BAA, such as Google Workspace or Microsoft 365. Confirm which editions and services the BAA covers.
2. A healthcare-focused encrypted email provider.
3. An encryption add-on layered over your existing email.

Evaluation checklist:

• Is a BAA available, and on which plan?
• Encryption method: TLS enforcement, message-level encryption, or portal pickup for outside recipients
• MFA and SSO support
• Admin-accessible audit logs
• Configurable retention
• Admin tools to offboard users and recover mailboxes
• US data hosting, if your policy requires it

Free and "cheapest" HIPAA-compliant email. Free tiers rarely include a BAA, because the BAA comes with paid business plans that include admin and security controls. Compare entry prices by plan:

• Check each vendor's current pricing page for the lowest plan that includes a BAA.
• Confirm the BAA applies to that specific tier, not only to higher editions.

Hosting vs. encryption. Hosting covers mail stored on the provider's servers, inside your organization. Encryption covers mail in transit, especially to outside recipients. Most clinics need both addressed. A BAA-covered host with weak outbound encryption leaves a gap. So does an encryption add-on running on a host that has not signed a BAA.

Vendor checks: Mailchimp, Proton Mail and Virtru

Is Mailchimp HIPAA compliant? Check Mailchimp's current terms and Acceptable Use Policy for its position on PHI and BAAs before you use it with any patient data. Your patient list is PHI. Do not upload patient names, emails or appointment data to any marketing platform unless that platform has signed a BAA with you. This applies to appointment reminders and patient newsletters too.

Is Proton Mail HIPAA compliant? Check Proton's current HIPAA page for whether it signs a BAA and on which plans. Proton handles messages between Proton users differently from messages sent to non-Proton addresses such as a patient's Gmail. Map this to the requirements: a BAA on your plan, plus a defined method for encrypting mail to outside recipients.

Is Virtru HIPAA compliant? Check Virtru's current HIPAA page for BAA availability and supported email platforms. Virtru adds encryption on top of an existing email platform. Your underlying email host still needs its own BAA. Encryption on top does not replace the host's agreement.

Vendor	Signs a BAA?	Encryption type	Notes	Last verified
Mailchimp	See current terms	Marketing platform, not a secure email service	Marketing platform; patient lists are PHI	Check before signup
Proton Mail	See current terms	Differs between Proton-to-Proton and external mail	Check how mail to non-Proton patients is handled	Check before signup
Virtru	See current terms	Encryption add-on	Host email needs its own BAA	Check before signup

Vendor policies change. Re-check before you sign up or renew. You can also check whether other popular tools are HIPAA compliant.

HIPAA-compliant email marketing

When marketing involves PHI. A patient list from your practice is PHI. Using it to promote products or services can count as marketing under HIPAA, which generally requires the patient's written authorization.

Treatment communications are generally handled differently. These include appointment reminders, recall notices and messages about a patient's own care. Keep the two clearly separated in your workflows.

The platform must sign a BAA if it handles patient lists. Not every mainstream marketing platform offers one, so confirm before uploading any patient data.

Watch for PHI leaking through the campaign itself:

• List and segment names. A segment called "Diabetes patients – Q3" reveals health information to anyone with platform access, and to the vendor.
• Tracking pixels and link tracking in emails and on landing pages.
• Campaign names and UTM tags that reference conditions or procedures.

Dental and specialty practices. A cleaning-reminder newsletter to your patient base follows the same rules. Opt-out handling under CAN-SPAM is a separate obligation and does not replace HIPAA authorization.

HIPAA email policy and common violation examples

What your HIPAA email policy should cover:

• Approved accounts and devices
• What PHI may be emailed, and to whom
• When encryption is mandatory
• How to handle patient requests for unencrypted email, including the warning and documentation
• Retention periods
• What to do when a device is lost or stolen
• How to report a suspected breach internally

Common violation examples:

• Lab results sent to the wrong "J. Smith" through autocomplete
• A front desk invites patients to a support group using CC instead of BCC
• A biller forwards claim spreadsheets to a personal account to work from home
• A phishing email compromises a mailbox containing years of referral correspondence

After a misdirected email:

1. Report it internally right away.
2. Ask the recipient to delete the message, and document that you asked.
3. Run a risk assessment to decide whether it is a reportable breach.
4. If it is reportable, meet the notification timelines for affected individuals, HHS and, at higher volumes, the media.

Disclaimers. A disclaimer tells an unintended recipient what to do. It does not protect the data. See HIPAA email disclaimer examples for wording.

Email is one channel: where internal staff coordination fits

A lot of internal email in clinics is not about patients at all. It is shift swaps, supply orders, "who's covering the Tuesday phones," policy updates and IT requests. These threads grow long and are hard to search. Every reply-all is another chance to misaddress a message. When a patient detail slips in, such as a reschedule note or a billing question, it ends up in dozens of inboxes.

Many practices move internal operational coordination to a staff chat covered by a BAA, and keep email for patients, payers and outside providers. Care-team messaging about patients is a separate category; see clinical communication platforms explained.

Chanty is a team chat for staff. It brings chats, calls, announcements, files and assigned tasks into one workspace, so a front-desk question can become a task with an owner and a deadline. HIPAA compliance with a signed BAA is available on the Business and Enterprise plans, not on Free.

Chanty works alongside your email and clinical systems. It does not replace email for patients or outside parties, and it is not a patient messaging tool. Your organization still configures roles and permissions, signs the BAA before any PHI is handled, and trains staff.

Learn more about HIPAA-compliant chat for staff and how Chanty handles security and the BAA.

FAQ

Is regular Gmail or Outlook HIPAA compliant?

Consumer Gmail and Outlook.com accounts should not be assumed to come with a BAA. Business editions such as Google Workspace and Microsoft 365 can be covered by a BAA on eligible plans. You still need to configure them correctly.

Is encrypted email automatically HIPAA compliant?

No. Encryption is one safeguard. You also need a BAA with every vendor that handles PHI, access controls, audit logging and a written policy.

Do I need a BAA with my email provider?

Yes, if the provider stores or transmits PHI for you. If you use an encryption add-on, you need a BAA with that vendor and with your email host.

Can I email patients without encryption if they ask for it?

Yes. Warn them of the risk first, and document both their request and your warning.

Is it HIPAA compliant to email medical records to another provider?

Yes, with safeguards. Use encrypted delivery or a portal, confirm the address, and send only the minimum necessary.

Can I email a photo of a patient and stay HIPAA compliant?

Yes, if you treat it as PHI. Use an encrypted, BAA-covered channel, and keep it off personal phones that auto-sync to personal cloud accounts.

Is there a free HIPAA-compliant email service?

Free tiers rarely include a BAA. Without a BAA, a free service should not be used for PHI.

Is Mailchimp HIPAA compliant?

Check Mailchimp's current terms for its position on PHI and BAAs. Do not upload patient lists to any platform that has not signed a BAA with you.

Is Proton Mail HIPAA compliant?

Check Proton's current terms for BAA availability, eligible plans and how mail to non-Proton recipients is encrypted.

Is Virtru HIPAA compliant?

Check Virtru's current terms for BAA availability. Your underlying email host still needs its own BAA.

Do appointment reminder emails need patient authorization?

Reminders about a patient's own care are generally treated as treatment communications, not marketing. The sending platform still needs a BAA if it holds patient data.

Does a HIPAA email disclaimer make an email compliant?

No. A disclaimer is a notice to the recipient. It does not encrypt, restrict access to or protect the message.