HIPAA Email Rules: What Each Practice Email Needs

There is no one HIPAA compliant email setup: a practice sends three kinds of email, and each follows its own rule. Patient messages need safeguards, the staff mailbox needs a contract with the company that holds it, and newsletters need a tool whose terms allow your list.

I am not a lawyer, and this is not legal advice. The HIPAA rules below are US law; your counsel decides how they apply to you.

Quick answer

• Sort last week's sent mail into patient messages, internal mail and promotions before you shop.
• Open your mail admin settings and confirm a business associate agreement (BAA, a contract to protect patient data) exists.
• Keep diagnoses, procedures and results out of newsletter lists.
• Ask any secure-email vendor for the BAA document, the plan it covers and the per-sender price.

Which email job needs what

Each job runs on its own rule, so each needs a different purchase. The table below is the whole post in one view.

Texts are a fourth job with their own rules; I cover them in HIPAA text messaging.

Patient messages: check the address, trim the detail

HHS says the Privacy Rule lets a provider email patients with reasonable safeguards. It also says the rule does not prohibit unencrypted email for treatment messages. The examples are checking the address before sending, sending an alert to confirm it, and limiting the detail.

The Security Rule adds a transmission standard. Encryption there is addressable: implement it "whenever deemed appropriate". Addressable is not optional. The practice must assess it and, if it does not fit, document why and adopt an equivalent measure where reasonable.

In my reading, a patient's OK on email does not cover a reminder you chose to send with details.

Patients can also steer the channel. HHS says a provider should accommodate a request for appointment reminders by email instead of a postcard, if email is a reasonable option. If a patient finds unencrypted email unacceptable, HHS says to offer another route.

Ontario practices answer to PHIPA, not HIPAA. The privacy commissioner's email guidance expects encryption between providers. It also asks practices to tell patients about a written email policy and get their consent before any unencrypted email.

Does the staff mailbox need its own contract?

Yes, if it holds patient details. Microsoft's own page says a cloud provider serving a HIPAA-covered practice is a business associate.

Google has an administrator accept its BAA electronically in the Admin console, and Gmail is on its list of covered services. Google adds that third-party apps and add-ons are not covered. Microsoft says its BAA comes through its data protection terms by default, that it cannot use a customer's own BAA, and that the BAA alone does not make you compliant.

Check four things:

1. On Google, sign in as a super administrator and open Account settings, then Legal and compliance. Look for the BAA acceptance record. A free @gmail.com address has no Admin console, so there is no record to find.
2. On Microsoft, confirm the staff mail runs on Exchange Online, which the page lists as covered, not a free outlook.com address.
3. List every extension and connected app that touches the mailbox, such as email trackers and scheduling add-ons.
4. Write down who sends patient details by email. Those people are who a secure route is for.

If a web form on your site emails entries to the front desk, patient details land in the staff mailbox; see HIPAA website hosting.

Newsletters: the list and the terms

Two things govern a newsletter: HIPAA's marketing definition and the tool's own terms.

HIPAA defines marketing as a communication that encourages people to buy or use a product or service. It excludes messages that describe your own health-related services, unless a third party pays you to send them. If one does, using patient information for it needs an authorization that states the payment. Whether a given cosmetic offer counts as health-related is a question for your counsel.

That reads to me as: a plain patient list may pass, a list segmented by procedure or condition may not. Mailchimp's Standard Terms take the other road. They say that if you are subject to regulations like HIPAA, Mailchimp is not liable when the service does not meet them.

The email law is separate. The FTC says CAN-SPAM needs a valid postal address, an opt-out honored within 10 business days, and no misleading subject lines, with penalties up to $53,088 per violating email. In Canada, CASL asks for consent, identification and an unsubscribe mechanism that stays valid at least 60 days.

Do you need a secure-email service at all?

Only if staff must send patient details by email and no portal or secure messaging inside your practice software carries them. Then compare what each vendor's page states.

• Paubox's pricing page says it includes BAAs with all accounts at no additional charge. Its Standard email plan is $32 a month, billed annually, for up to 5 senders. Each sender above 5 adds to the price.
• Hushmail's pricing page marks a BAA "Yes" on its three Healthcare plans and "No" on its Small Business, Law and Personal plans. The same product bought on the wrong plan has no contract.

One imaginary week, sorted

Tracking a promotional email without patient data

A newsletter can be tied to booked visits with no patient data in the link. The campaign tag names the email, never the person: utm_campaign=november-newsletter, not a name or an address. A booking that arrives with that tag counts toward the campaign.

That is how I work: no patient data in URLs, UTM tags or analytics. I call that HIPAA-conscious. The method is in HIPAA-conscious conversion tracking.

Prices and rules checked on 2026-11-02.