One wrong letter in an email address. That's all it takes.
A staff member types "jsmith" instead of "jsmyth," clicks send, and a patient's lab results land in a stranger's inbox. Nobody intended harm, but under HIPAA, good intentions don't erase a breach. Your practice still has to investigate the incident, document what happened, and possibly report it.
That's the quiet risk behind one of the most common tools in healthcare. According to The Radicati Group, about 4.5 billion people used email in 2024, sending and receiving roughly 361.6 billion messages every day. Your patients rely on it, and so do your staff, your laboratories, your billing team, and your referral partners.
So it feels natural to use email when you need to share a care plan, a referral, or a billing update. It's fast, familiar, and free, and patients don't need to download another application or learn a new system.
Here's the catch. Email was never designed to protect sensitive health information. A standard message can travel through several servers, sit unencrypted in more than one inbox, and be forwarded to anyone with a single click. Every stop along the way is another place where protected health information (PHI) can leak.
That leaves many practices asking the same question: is email HIPAA compliant?
The short answer is yes, it can be, but only when you configure it correctly and keep using it correctly every day. That means signing the right agreement, activating the right security features, training your entire team, and talking openly with patients about the risks.
In this guide, you'll learn how email moves from sender to recipient and where the biggest vulnerabilities are. You'll also get the practical steps to send HIPAA compliant emails, see what violations can cost in 2026, and discover a simpler alternative.
Emails present an instant solution that makes perfect sense for providers and patients as most people already use email. There’s no need to search for a new channel, download an app, or set up a new system.
Aside from marketing strategy implementations, email offers opportunities for medical practices to provide the following services:
With the vast opportunities for medical information exchange over email, including sensitive patient data or PHI, it’s right to ask, is email safe for healthcare use? Is email HIPAA compliant?
There are required conditions for the safety of exchanging medical information with patients, staff, colleagues, and business associates over email. To grasp the fundamentals of emails and HIPAA compliance, we have to start at the beginning with how an email works.
You can't protect sensitive information if you don't understand exactly where it travels. The security measures your practice needs depend on how email travels and how you plan to use it.
An email is any message sent over a network from one electronic device to another. It can contain text, images, audio, video, or scanned documents, and you can send it to one person or to an entire group.
Once it arrives, the recipient can read, print, save, edit, reply to, or forward it. That last option is important, because after you click send, you lose control over where that message travels next.
Every email takes a four-stop journey, and a copy of the message is often saved at each stop.
| Stop | What happens | Risk to PHI |
|---|---|---|
| 1. Your device | You write and send the message | Lost or stolen laptops and phones, shared logins |
| 2. Your email server | Your provider pushes the message out | Weak server security, no encryption at rest |
| 3. The recipient's server | The message waits to be picked up | Outside servers you don't control |
| 4. The recipient's device | The patient opens and saves it | Shared family computers, public Wi-Fi |
Between those stops, the message travels across the open internet, where anyone who intercepts an unencrypted email can read it. The threats range from simple human mistakes, like a mistyped address, to deliberate and carefully planned cyberattacks.
The good news is that HIPAA gives you a clear framework for closing these security gaps.
The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting patient health information. Covered entities, such as medical practices, and their business associates must follow these standards whenever they share PHI, including electronic PHI (ePHI) sent by email.
Here's how to prepare your email system for compliance.
If you plan to send ePHI by email, your email provider becomes a business associate. HIPAA requires you to have a signed business associate agreement (BAA) with that provider before any PHI moves through its system.
The BAA holds your provider to the same HIPAA standards that your practice follows. It explains how the provider will protect PHI through technical, administrative, and physical safeguards.
Not every email plan qualifies.
For example,
Google will sign a BAA for paid Google Workspace accounts, but not for free personal Gmail accounts. If a provider refuses to sign a BAA, take that as your answer, because it can't support your HIPAA compliance.
Remember that a BAA is only the starting point. It's wise to have a healthcare attorney review your setup and an experienced IT professional configure it correctly.
Encryption scrambles a message so that only the intended recipient can read it. Under the current HIPAA Security Rule, encryption is "addressable," which doesn't mean optional. It means you must use it unless you can document why another safeguard provides equal protection, and for email, that's very difficult to prove.
The standard is also getting stricter. In January 2025, HHS proposed updates that would make encryption of ePHI mandatory, both in transit and at rest. As of fall 2026, that rule hasn't been finalized, but it clearly shows where regulations are heading.
You'll also need access controls that guarantee only the sender and the intended recipient can open the message.
Some providers offer encryption but don't activate it by default, so you can either:
The second option is safer because it removes human error from the process. For encryption strength, follow current recommendations from the National Institute of Standards and Technology (NIST). If you don't have an IT expert on staff, ask your provider exactly which encryption standards it uses before you sign up.
HIPAA doesn't set a specific retention period for emails. However, it does require a data backup plan that lets you restore exact copies of ePHI during an emergency, and your email system needs to fit into that plan.
Retention also matters for legal reasons. Patients can request a record of certain PHI disclosures, and you may need to produce emails if your practice ever faces a lawsuit. Many states also have their own record-keeping requirements.
Storage needs grow quickly, because attachments like health records and visit summaries take up a lot of space. Review your state's requirements with a lawyer before you send your first email containing PHI.
A dedicated platform can take this responsibility off your plate. Curogram, for example, uses automatic backups on Amazon Web Services (AWS) servers that you can access during an emergency.
Technology only works when your people use it correctly. Write clear policies that explain when staff members can use email, what information they can send, and who they're allowed to send it to.
Then train everyone, from the front desk to your providers. Each person should know how to send an encrypted email, how to double-check a recipient's address, and what to do immediately if something goes wrong.
Small mistakes add up over time. As an illustrative example, imagine your team sends 150 emails containing PHI each week, and just 1% go to the wrong person. That's 1 to 2 misdirected emails every week, or about 78 potential breaches a year, and each one has to be reviewed and documented.
Secure every account as well. Use strong passwords and two-factor authentication on every email account that handles PHI.
HHS allows you to email patients as long as you apply reasonable safeguards. Before you send any PHI, confirm the patient's email address, and consider sending a short test message first.
If a patient prefers to receive unencrypted email, HIPAA generally lets them make that choice. However, you should first explain the risks in plain language and record their preference in writing. If they decide unencrypted email isn't secure enough, offer an alternative, such as a secure patient portal, regular mail, or a phone call.
It also helps to add a brief notice to your emails. This notice can remind patients that the message contains private health information and that they shouldn't open it on a shared or public device.
|
Many email mistakes don't come from hackers; they come from busy employees clicking send too quickly. Before anyone on your team sends PHI by email, build in a 10-second pause to confirm four things: Is the address correct? Is encryption activated? Is this the minimum necessary information? Would a secure text or patient portal message work better? Post these four questions near every workstation so they become a daily habit. It's one of the least expensive safeguards your practice will ever implement. |
Breaking HIPAA rules can lead to civil fines and, in serious cases, criminal charges. HHS adjusts civil penalties for inflation, and the latest amounts took effect on January 28, 2026.
| Violation tier | Minimum per violation | Maximum per violation | Yearly cap |
|---|---|---|---|
| Didn't know, and couldn't have known with reasonable care | $145 | $73,011 | $2,190,294 |
| Reasonable cause, not willful neglect | $1,461 | $73,011 | $2,190,294 |
| Willful neglect, fixed within 30 days | $14,602 | $73,011 | $2,190,294 |
| Willful neglect, not fixed within 30 days | $73,011 | $2,190,294 | $2,190,294 |
Since 2019, the HHS Office for Civil Rights (OCR) has applied lower yearly caps to the first three tiers. Even so, the costs can climb quickly.
Here's an illustrative example.
Say 10 misdirected emails are found to be reasonable-cause violations. At the $1,461 minimum for each one, that's $14,610 in fines, before you add legal fees, breach notices, and lost patient trust.
Criminal penalties are separate. Knowingly misusing PHI can lead to fines of up to $250,000 and up to 10 years in prison, depending on the offense.
This means configuring email correctly costs far less than recovering from a breach.
Debates regarding HIPAA compliance and email have been raging ever since changes to the Health Insurance Portability and Accountability Act took effect in 2013.
Despite various interpretations, the HIPAA Security Rule clearly states that all forms of communication must accompany the “appropriate administrative, physical, and technical safeguards” to ensure the confidentiality and integrity of ePHI.
Whereas the rule doesn’t explicitly prevent healthcare providers from using email to communicate and share ePHI, it does enforce several requirements.
Healthcare providers must implement access control ID authentication and provide audit, integrity, and transmission control mechanisms to:
That suggests that, in theory, emails are HIPAA compliant when adequately configured before using them as a HIPAA-compliant communication channel. The trouble is, most consumer email providers, like Gmail and Yahoo, don’t offer sufficient security mechanisms necessary to meet the HIPAA requirements.
Healthcare professionals must seek out email providers that offer advanced security mechanisms and enter into a BAA before email is HIPAA compliant and safe to transmit ePHI.
With so many technical and legal steps, it's no surprise that many practices look for a different option. That's where Curogram comes in.
Curogram is a secure, HIPAA compliant two-way messaging platform built for healthcare. Your team can communicate with patients quickly without managing encryption settings or complex server setups. It also supports HIPAA compliant staff messaging and telehealth appointments.
98% |
| Average SMS open rate, so patients actually see your messages |
50% |
| Reduction in phone call volume when routine questions move to text |
Unlike email, Curogram integrates with most major EHR systems. Your front desk doesn't have to enter the same information twice, and your team spends less time on busywork.
Telehealth is just as simple. You text the patient a secure link, they tap it, wait a few minutes in a virtual waiting room, and then connect with their provider.
Email may look quick and convenient on paper. But once you add up the setup, the training, and the ongoing risk, it's rarely the best tool for patient messaging.
So, is email HIPAA compliant? It can be, but reaching compliance takes real effort, and maintaining it takes even more.
You need a signed BAA with your email provider and encryption that protects messages both in transit and at rest. You also need a backup plan, clear policies, well-trained staff, and honest conversations with patients about the risks. If you miss even one piece, a simple email can turn into a reportable breach.
That's a lot to manage for a communication tool most people consider simple. The stakes are also rising, because civil fines now reach more than $73,000 per violation. Proposed updates to the HIPAA Security Rule would also make encryption a firm requirement instead of an addressable one.
None of this means your practice has to abandon email completely. It still has a legitimate place for internal notes, general announcements, and administrative messages that don't include PHI. The key is knowing when email is the right tool and when it isn't.
For most everyday patient conversations, there's a more practical option available. Patients read text messages far more often than emails, and a platform designed for healthcare handles the security for you. You won't have to second-guess encryption settings or worry that someone on your team skipped an important security step.
That's the value of a purpose-built solution. Curogram gives your team a secure, HIPAA compliant way to text patients, share updates, and run telehealth appointments, all while integrating with the EHR you already use. The result is less setup, less compliance risk, and more time for meaningful patient care.
If you're ready to move past the guesswork, book a demo to see how Curogram makes HIPAA compliant patient messaging simple. You'll see how it fits into your daily workflow and how quickly your team can get started.