HIPAA Email Encryption: What Healthcare Workers Need to Know

If you're taking HIPAA compliance training and searching for answers, you're in the right place. This guide answers the most common HIPAA email encryption test questions — and explains what your training probably didn't tell you about choosing a secure email service.

Is Encrypting Sensitive Information a Technical Safeguard?

If your HIPAA training test asks "encrypting sensitive information is an example of a technical safeguard" — the answer is TRUE.

HIPAA divides security requirements into three categories:

Encryption falls under Technical Safeguards (specifically 45 CFR § 164.312). It's the technology that converts readable data into unreadable code that can only be unlocked with the right key. HIPAA requires covered entities to implement encryption — or document why they chose not to.

When Do You Need to Encrypt an Email Containing PHI?

If your HIPAA test asks "you need to encrypt an email containing phi" — the key distinction is between internal and external transmission.

PHI (Protected Health Information) is any health data that can be tied to an individual — names, dates of birth, medical record numbers, treatment information, and 15 other identifiers defined by HIPAA.

Under the HIPAA Security Rule:

• Internal emails within your organization's encrypted network may not require additional encryption — though many organizations encrypt these as well as a best practice.
• External emails to patients, other providers, insurance companies, or outside agencies must be encrypted. This applies whether you're using Outlook, Gmail, or any other email service.

Simply put: if PHI leaves your organization's network, it must be encrypted in transit.

What Should Happen When Emails Containing Patient Information Are Sent to Outside Agencies?

If your test asks "emails containing patient information sent to outside agencies should" — there are three requirements:

1. Encryption. The email must be encrypted during transmission (TLS 1.2 or higher for standard email, or end-to-end encryption for maximum protection).
2. Minimum Necessary Rule. Only include the PHI that is absolutely necessary for the purpose — don't attach a patient's entire medical history if the recipient only needs a single lab result.
3. Business Associate Agreement (BAA). If the outside agency handles PHI on your behalf, HIPAA requires a signed BAA. This is a legal contract that holds them to the same privacy and security standards.

If a breach occurs and patient information is exposed, HIPAA requires notification to affected patients within 60 days — and to the Department of Health and Human Services within 60 days for breaches affecting fewer than 500 people, or immediately for larger breaches.

HIPAA-Compliant Email Services Compared

Not all encrypted email services are HIPAA-compatible. For an email service to be used for PHI, it must offer a Business Associate Agreement and support encryption that meets HIPAA standards. Here are the top options:

Proton Mail for Healthcare

Proton Mail uses zero-access encryption — emails are encrypted on your device and even Proton can't read them. Proton offers a BAA on its business and enterprise plans, making it HIPAA-compatible for healthcare organizations. Because Proton is based in Switzerland with all data stored on Swiss servers, PHI benefits from both HIPAA protections and Swiss privacy law — a combination no US-based provider can match.

PBHS Secure Email — Dental-Specific HIPAA Email

PBHS Secure Email is a HIPAA-compliant secure email service purpose-built for dental practices. At $13/month, it's designed for dental offices that need to share PHI with labs, specialists, and patients without worrying about compliance.

PBHS Secure Email works from any browser — no software to install — and includes features like encrypted attachments and read receipts. The ADA (American Dental Association) partnership often waives setup fees for members.

If you're a dental practice looking for a simple, compliance-first email solution, PBHS is worth considering. But if you want a full encrypted productivity suite — email, calendar, cloud storage, and VPN — Proton Mail's business plans offer more capability for a comparable price.

Hushmail for Healthcare

Hushmail offers HIPAA-compatible plans with a signed BAA, built-in secure web forms for collecting patient information, and encrypted messaging. Starting at $5.99/month, it's a solid option for solo practitioners and small clinics. However, Hushmail is not open source and lacks the full ecosystem of tools that Proton provides.

HIPAA Email Encryption: Quick Reference

The Bottom Line

HIPAA email compliance comes down to three things: encrypt your emails, work with providers who sign a BAA, and share only the minimum information necessary. Chances are your HIPAA training test is asking exactly these questions — and now you have the answers.

For healthcare workers who also value personal privacy — or for organizations wanting an encrypted email provider that meets HIPAA standards while offering more than just compliance — Proton encrypted email is the strongest option available.