HIPAA compliant email

A Self-Help Resource for Rural Hospitals, Clinics, Nursing Homes, and Other Small Health Care Organizations

When it comes to HIPAA compliance, email encryption isn’t optional — it’s essential. Yet most health care organizations still rely on outdated, overpriced, or incomplete solutions that don’t actually protect them from real-world risks — like misrouted emails, user error, or forgotten encryption triggers.

Here’s the brutal truth:

"But we tell patients not to email us PHI…"

Spoiler: It doesn't matter. You're still liable.

If your health care organization is using a free Gmail, Hotmail, Outlook.com, MSN, or Yahoo account for any patient-facing communication, you're already in violation of HIPAA—whether you realize it or not. And unfortunately, disclaimers in your footer, verbal warnings to patients, or additional security measures can't change that legal reality.