HIPAA compliant email

A Self-Help Resource for Rural Hospitals, Clinics, Nursing Homes, and Other Small Health Care Organizations

In 2023, St. Joseph's Medical Center settled a HIPAA investigation for disclosing patient information to a news reporter [Source: HHS.gov Resolution Agreements]. In April 2025, PIH Health paid $600,000 after a phishing campaign exposed 189,763 individuals' PHI through compromised email accounts [Source: ChartRequest.com].

When it comes to HIPAA compliance, email encryption isn’t optional — it’s essential. Yet most health care organizations still rely on outdated, overpriced, or incomplete solutions that don’t actually protect them from real-world risks — like misrouted emails, user error, or forgotten encryption triggers.

Here’s the brutal truth:

"But we tell patients not to email us PHI…"

Spoiler: It doesn't matter. You're still liable.

If your health care organization is using a free Gmail, Hotmail, Outlook.com, MSN, or Yahoo account for any patient-facing communication, you're already in violation of HIPAA—whether you realize it or not. And unfortunately, disclaimers in your footer, verbal warnings to patients, or additional security measures can't change that legal reality.