What are the HIPAA Email Rules?

The HIPAA email rules are that covered entities and business associates must ensure the confidentiality, integrity, and availability of PHI created, received, maintained, or transmitted by email, protect against threats and hazards to the security of PHI in emails, and protect against uses and disclosures of PHI in emails not permitted by the Privacy Rule.

The HIPAA email rules above are a modified version of §164.306(a) of the Security Rule. There is no single section of the HIPAA Administrative Simplification Regulations that stipulates the requirements for HIPAA compliant email. As such, the “HIPAA email rules” is an umbrella term covering the relevant standards and implementation specifications of the General Provisions and the Privacy, Security, and Breach Notification Rules.

Contents

The Relevant Standards of the HIPAA General Provisions

• Definitions and the Preemption of State Law

Privacy Rule HIPAA Compliance for Email

Get the FREE
HIPAA Compliance
Email Checklist

Learn How To Prevent All Email Related HIPAA Violations

Business Email *

Name *

First

Last

Number *

Company Name *

Get Checklist

Immediate Access

Privacy Policy

• Impermissible Uses and Disclosures of PHI
• Business Associate Agreements
• Patients’ Rights Considerations

Security Rule Safeguards for HIPAA Compliant Email

• Administrative Safeguards for HIPAA Email Compliance
• Physical Safeguards for HIPAA Email Compliance
• Technical Safeguards for HIPAA Email Compliance

The HIPAA Email Encryption Requirements

• What HHS Says about HIPAA Email Encryption
• How to Comply with the HIPAA Email Encryption Requirements
• HIPAA Compliant Encrypted Email Providers

The HIPAA Email Requirements for Breach Notifications

Recent HIPAA Violation Email Examples

Training Workforces on HIPAA Email Policy

When Do State Laws Preempt the HIPAA Email Rules?

HIPAA Email Rules: FAQs

The Relevant Standards of the HIPAA General Provisions

There are several standards relevant to the requirements for sending PHI via email in the HIPAA General Provisions (Part 160 Subpart A). The first relevant standard is the Applicability standard – that HIPAA applies to health plans, health care clearinghouses, healthcare providers that qualify as HIPAA covered entities, and to business associates that provide a service for or on behalf of a covered entity that involves a use of disclosure of PHI.

This is relevant because if a provider does not qualify as a HIPAA covered entity – because, for example, they bill clients directly – they are not required to comply with the HIPAA email requirements. Similarly, if a third party provides a service for on or behalf of a provider that does not qualify as a HIPAA covered entity, the third party does not qualify as a business associate and is also not required to comply with the HIPAA email requirements.

Definitions and the Preemption of State Law

The next relevant standard in the HIPAA General Provisions is the Definitions standard (§160.103). This standard is relevant because it defines what is considered as PHI under HIPAA. Emails that do not contain PHI are not subject to the HIPAA email requirements – although they may be subject to state data protection laws depending on the location of the covered entity and whether they are exempted from complying with state law.

On the topic of state laws, Subpart B of Part 160 (“Preemption of State Law”) is relevant to any discussion about the application of the HIPAA email rules because it states HIPAA preempts state law unless a provision of state law offers greater protection to personal data than HIPAA or unless a provision of state law provides individuals with more privacy rights. Examples of when state law preempts the HIPAA email rules are provided later in this article.

Privacy Rule HIPAA Compliance for Email

Many sources discussing the HIPAA email rules tend to focus on Security Rule safeguards for HIPAA compliant email and overlook Privacy Rule HIPAA compliance for email. Although it is important to comply with the Security Rule safeguards, it is equally important to know when Privacy Rule compliance applies due to §164.306(a) requiring organizations to “protect against uses and disclosures of PHI not permitted by the Privacy Rule”.

Impermissible Uses and Disclosures of PHI

When §164.306(a) states covered entities and business associates must protect against uses and disclosures of PHI not permitted by the Privacy Rule, the standard not only applies to when sending patient information via email is required or permitted by the Privacy Rule, but also to what happens to the patient information when it is received by the recipient if the recipient is a covered entity, a business associate, or a member of either’s workforce.

Required uses and disclosures of PHI are limited to when PHI is requested by HHS’ Office for Civil Rights or the subject of the PHI (see “Patients’ Rights Considerations” below), Permissible uses and disclosures of PHI include treatment, payment, and healthcare operations, and when disclosures are allowed under §164.512 of the Privacy Rule. In all “permissible” cases, uses and disclosures must be limited to the minimum necessary to achieve the purpose of the use or disclosure.

Business Associate Agreements

A covered entity is also permitted to disclose PHI to a business associate by email, subject to the business associate complying with the HIPAA rules for emailing patient information. For a business associate, this may not only mean implementing Security Rule safeguards for HIPAA compliant email, but also training members of the workforce on applicable Privacy HIPAA Rules for email as well as providing security awareness training.

In addition, before a disclosure of PHI is permitted to a business associate, it is necessary for a Business Associate Agreement to be in place between the covered entity and the business associate. The Business Associate Agreement stipulates the terms under which PHI is disclosed to the business associate, agrees that the business associate will implement safeguards to protect PHI, and lists the obligations of the healthcare provider to the business associate.

Patients’ Rights Considerations

As mentioned above, patients have rights under HIPAA. These include the right to request copies of their PHI by email, to receive an accounting of disclosures by email, to receive any confidential communications by email, and a Notice of Privacy Practices by email – not necessarily secured email. Patients also have the right to authorize disclosures of PHI not permitted by the Privacy Rule, which can also be communicated by unsecured email.

A challenge this creates is that the use of email for transmitting PHI is permissible in some circumstances, but not in others. The circumstances can depend on who is requesting PHI, the purpose of the use or disclosure, whether a Business Associate Agreement is in place (if required), and whether the Security Rule Safeguards for HIPAA compliant email have been implemented. It may also be necessary for a Business Associate Agreement to be in place with the email service provider.

Security Rule Safeguards for HIPAA Compliant Email

The Security Rule safeguards for HIPAA compliant email vary depending on whether a covered entity or business associate hosts its email server on-premises. If so, the Physical Safeguards are more significant. If not – for example, if a covered entity subscribes to HIPAA compliant hosted email service such as Google Workspace – the HIPAA compliant hosted email service provider is responsible for most of the Physical Safeguards.

Administrative Safeguards for HIPAA Email Compliance

The Administrative Safeguards for HIPAA email compliance require covered entities and business associates to conduct a HIPAA risk assessment to identify risks and vulnerabilities to PHI created, received, maintained, or transmitted by email. The assessment should consider both external and internal threats.  It is then necessary to implement security measures that reduce the identified risks and vulnerabilities to a reasonable and appropriate level.

In the context of HIPAA email compliance, the security measures stipulated by the Administrative Simplification standards of the Security Rule and subsequent guidance published by HHS’ Office for Civil Rights include:

• Ensuring workforce members have appropriate access to email accounts (i.e., users, team leaders, admins, etc.).
• Developing procedures to terminate a workforce member’s access to their email account when they leave their job.
• Providing security awareness training to all members of the workforce which should include phishing susceptibility testing.
• Developing procedures for reporting phishing attacks, disclosures of login credentials, and other email security events.
• Enforcing a sanctions policy for members of the workforce who share individual email login credentials impermissibly.
• Developing and testing email back up and retrieval procedures, emergency mode operation plans, and disaster recovery plans.
• Ensuring that Business Associate Agreements are in place with email service and email encryption service providers.

Physical Safeguards for HIPAA Email Compliance

The reason who hosts an email system matters is because the hosting entity will be responsible for complying with physical HIPAA email security requirements such as controlling access to where the mail server is stored, managing maintenance records for mail servers, and ensuring a continuity of service during a disaster or emergency. HIPAA compliant hosted email service providers may also be responsible for the physical security of email backups and archives.

Thereafter, regardless of whether a HIPAA compliant email service in hosted in-house or subcontracted to a HIPAA compliant email service provider, covered entities and business associates are required to:

• Create and manage an inventory of which devices can access emails containing PHI – including personal devices
• Wherever practical, restrict physical access to devices on which authorized users can access emails containing PHI.
• Ensure devices used in public spaces are positioned so emails containing PHI cannot be seen by unauthorized users.
• Track the receipt and removal of devices with access to PHI in emails, and – wherever possible – the movement of devices.
• Implement policies and procedures to purge devices of email PHI before the devices are disposed of or repurposed.

Note: The Physical Safeguards for HIPAA email compliance were developed before most mobile devices had Internet connectivity, cameras, or email capabilities. As a result, there can be logistical challenges of complying with this section of the HIPAA email rules for healthcare providers. Healthcare providers who struggle to comply with this section of the HIPAA email rules are advised to review the “flexibility of approach” standard ( §164.306(b)).

Technical Safeguards for HIPAA Email Compliance

The majority of the Technical Safeguards for HIPAA email compliance have “addressable” implementation specifications. How covered entities and business associates comply with the Technical Safeguards may depend on the results of HIPAA risk assessments and interpretations of the flexibility of approach standard. It is important to be aware that, if an addressable specification is not implemented, the reason must be documented.

To save time, the “required” Technical Safeguards for HIPAA email compliance could be completed at the same time as the Administrative Safeguards – i.e. the Safeguards relating to Access Controls and Emergency Access procedures. Addressable Safeguards include:

• Audit controls to monitor who accesses email accounts containing PHI. These could be anything from manual audit logs to SOAR integrations.
• Integrity controls to ensure PHI contained in emails is not altered without authorization – for example, versioning control software.
• Automatic logoff to ensure email accounts cannot be accessed by unauthorized persons when devices are left unattended.
• Encryption and transmission security – a HIPAA and email security issue which is discussed in greater detail in the next section.

In addition to the Administrative, Physical, and Technical Safeguards, the Security Rule has “Organizational Requirements” for Business Associate Agreements and disclosing PHI to plan sponsors. The Security Rule also includes a section requiring covered entities to document policies and procedures, and retain records of the policies and procedures for at least six years. You can read about the HIPAA record retention requirements here.

The HIPAA Email Encryption Requirements

Although the HIPAA email encryption requirements are addressable implementation specifications, it is hard to conceive when they might not be “reasonable and appropriate” for protecting PHI in emails or when “an alternative equivalent measure” would be as effective at ensuring the confidentiality of PHI created, received, maintained, or transmitted by email. However, there is no one-size-fits-all solution for complying with the requirements.

What HHS Says about HIPAA Email Encryption

HHS Office for Civil Rights has confirmed that the HIPAA email encryption requirements are not mandatory. Nonetheless, the agency has published guidance for “rendering unsecured PHI unusable, unreadable, or indecipherable to unauthorized individuals”. The guidance applies to both PHI at rest (i.e., in an email inbox) and PHI in transit (i.e., when an email containing PHI is sent from a covered entity to a patient or business associate).

With regards to the HIPAA encrypted email requirements for PHI at rest, HHS’ Office for Civil Rights suggests covered entities and business associates apply the standards recommended in NIST SP 800-111 (AES-128 or higher). For PHI in transit, HHS’ Office for Civil Rights states “valid encryption processes for data in motion are those which comply with NIST SP 800-52” (TLS 1.2 or higher) or “others which are FIPS 140-2 validated” (for example, OpenPGP and S/MIME).

How to Comply with the HIPAA Email Encryption Requirements

How to comply with the HIPAA email encryption requirements varies depending on whether the organization’s email server is hosted on-premises or hosted in the cloud by a HIPAA compliant email service provider acting as a business associate. In the former scenario, the organization has the responsibility for encrypting PHI at rest. In the latter scenario, the business associate is responsible for encrypting PHI at rest.

Complying with the HIPAA email encryption requirements for PHI in transit can also be situation specific. For example, a covered entity might host an email server on premises, but the email service could still be provided by a business associate (i.e., Exchange Server 2019), or the email service could be provided via an intermediary such as a Managed Service Provider. Covered entities unsure about HIPAA email encryption requirements should seek compliance advice.

A Selection of HIPAA Compliant Encrypted Email Providers

The following HIPAA compliant encrypted email providers offer products that support HIPAA compliance out of the box or that can be configured to support HIPAA compliance. All of the  providers are willing to enter into a Business Associate Agreement; but, because most offer a standard service to all customers, covered entities and business associates must agree to the terms of the providers’ Agreements. Please note, this list is not exhaustive and subject to change.

Microsoft 365/Office 365

Microsoft offers a range of packages that support compliance with the HIPAA encryption requirements. While suitable for most enterprise customers, smaller organizations might find  subscriptions include services they will be paying for, but may never use.

Google Workspace

Google Workspace is more user-friendly for organizations with a remote workforce and offers a wider variety of email encryption options. However, configuring Google Workspace to be HIPAA compliant can be difficult for customers unfamiliar with admin controls.

Proton Mail

Proton Mail is a further suitable solution for HIPAA email security that also offers Drive, Calendar, and VPN options. The platform can be used as a standalone service (e.g., hosted in the cloud) or to encrypt emails sent from an on-premises email server.

Paubox

Paubox is an email encryption service that encrypts all outbound emails by default. The service works with on-premises servers or in front of cloud services (such as Office 365 and Google Workspace) with minimal installation and configuration requirements.

Hushmail

Hushmail is one of several HIPAA compliant encrypted email providers that provides HIPAA email security only when the sender takes a manual action to encrypt the content of an email. This could lead to HIPAA unencrypted email being sent in error.

The HIPAA Email Requirements for Breach Notifications

Despite it appearing logical to notify individuals of a data breach as quickly as possible after the discovery of a breach, the HIPAA email requirements for breach notifications are that individuals can only be notified of data breaches by email “if the individual agrees to [an] electronic notice and such agreement has not been withdrawn” (§164.404). (Notifications to HHS’ Office for Civil Rights are submitted through the HHS Breach Portal.)

If consent has not been given to receive breach notifications by email, individuals must be notified of a data breach by first class mail  even though no PHI is disclosed in breach notifications. Covered entities and business associates are only required to notify individuals of the type(s) of information that has been breached and the steps individuals should take to protect themselves from potential harm resulting from the breach.

However, breach notifications can be potentially sensitive if – for example – a patient is attending a clinic for SAD treatment that partners with access to the patient’s email account  are not aware of. Therefore, it is not safe to assume that because a patient has given their consent (or requested) to receive – for example – appointment reminders by email, the patient also wishes to receive breach notifications by email.

Recent HIPAA Violation Email Examples

It is impossible to determine exactly how many HIPAA violations are attributable to noncompliance with the HIPAA email rules. This is because details about complaints made to covered entities are rarely made public, while only data breaches affecting more than 500 individuals are listed on HHS’ Breach Report (about 10% of all data breaches). From reports that are publicly-accessible, we have found the following recent HIPAA violation email examples:

• In March 2024, the California Correctional Health Care Services notified HHS that one of its workforce members inadvertently sent an email containing the PHI of 1,348 individuals to an unintended recipient. The PHI involved included names, diagnoses, lab results, and other treatment information. The workforce member was sanctioned and retrained.
• Also in March 2024, Orlando VA Medical Center reported that an employee emailed documents containing the PHI of 9,850 individuals to a personal email account. In its mitigation efforts, Orlando VA Medical Center provided complimentary credit monitoring services to affected individuals and obtained a court order requiring the safeguarding of the PHI.
• In January 2024, an employee of Mount Vernon Dental Smiles, VA, sent an email containing the PHI of 1,074 patients to an unauthorized individual. The HHS, affected individuals, and the media were notified. In its mitigation efforts, the Dental Practice strengthened its Administrative Safeguards and HHS provided technical assistance regarding the HIPAA email rules.
• In December 2023, the Lafourche Medical Group settled the first HHS investigation into a data breach attributable to phishing attack for $480,000. The settlement agreement also includes a Corrective Action Plan requiring the Medical Group to conduct a risk assessment, develop a security management process, and train all members of the workforce on the HIPAA email requirements.
• In July 2023, an employee of Eastern Connecticut Health Network sent an email containing the PHI of 912 patients to multiple recipients without using the blind carbon copy (BCC) function. The Network notified HHS, affected individuals, and the media, and retrained the employee on email protocol and the requirement to protect and secure sensitive data.

Although only one of the above HIPAA violation email examples resulted in a financial penalty, violations of the HIPAA email rules often have indirect consequences. In many cases, new policies and procedures have to be developed, new measures have to be implemented to safeguard PHI in emails, and workforce members have to be retrained. There can also be consequences for members of the workforce who impermissibly disclose PHI via email.

Training Workforces on HIPAA Email Policy

When PHI is created, received, maintained, or transmitted via email, it is recommended that covered entities and business associates develop a HIPAA email policy. The HIPAA email policy should be consistent with the organization’s existing policies on permissible disclosures of PHI, patients’ rights, data security, and reinforce standards such as the physical device controls, patient authorizations, and the minimum necessary rule.

Workforce training on HIPAA email policy can either be combined with regular (or refresher) HIPAA training, or provided alongside security awareness training. Ideally, it should be included in both when time and resources allow. However, it is important that the training is documented and that workforce members are given a copy of the training document(s) and the sanctions policy for violating the organization’s HIPAA email policy.

It can also be beneficial to explain to workforce members why policies such as “do not include PHI in subject lines” exist. By explaining that the subject lines of emails and other email metadata are not encrypted in the encryption process (to facilitate searches) it could raise security awareness and help prevent security violations in other scenarios in which PHI is created, received, maintained, or transmitted electronically.

When Do State Laws Preempt the HIPAA Email Rules?

It was mentioned previously that HIPAA preempts state laws unless a provision of a state law offers greater protection to personal data than HIPAA or provides individuals with more privacy rights. This section of the HIPAA Administrative Simplification Regulations was last updated in 2002, since when multiple states have passed privacy legislation – some of which have provisions that preempt the HIPAA email rules.

For example – according to HHS guidance published in 2008 – healthcare providers can assume that, if a patient initiates contact by unencrypted email, it is permissible to reply to the patient via unencrypted email and continue to communicate with the patient via the same channel of communication. The guidance recommends, but does not mandate, the healthcare provider alerts the patient to the risks, and lets the patient decide whether to continue communicating via email.

However, a number of states have recently introduced or extended their privacy laws to include an “affirmative opt-in” requirement for individuals’ email addresses. This means that covered entities can continue to follow HHS guidance only if the individual is not a resident of a state in which greater protection to personal data exists (regardless of where the healthcare provider is located or where the individual was at the time contact was made).

Some state privacy laws (i.e., CCPA, Texas HB 300, etc.) exempt HIPAA covered entities – and sometimes business associates – and/or do not apply to individually identifiable health information protected by the Privacy Rule. But, not all states have the same exemptions. If you are in any doubt your organization may not be in compliance with the HIPAA emails rules or a state law that preempts the HIPAA email rules, you should seek compliance advice.

HIPAA Email Rules: FAQ