HorizLogoSm.fw_.png
Start Trial

Author: Chris Almond

Chris Almond is a seasoned entrepreneur and president with a strong background in the computer software industry. He currently heads MailHippo, Inc., a company he founded in 2019 that provides healthcare providers with a secure platform for HIPAA-compliant messaging and online forms. Prior to MailHippo, Chris founded and led ClinicSource Therapy Practice Management Software for nearly 15 years. His experience also includes IT leadership roles at Avantegroup, Inc. and project management positions at Air2Web and iXL, Inc. Chris holds an MBA from the University of South Carolina's Darla Moore School of Business and a Bachelor's degree in Computer Engineering from the University of Miami. He possesses a diverse skillset encompassing operations management, healthcare IT, software development, digital marketing, and project management.
Posted on

PGP Email Encryption Explained for Gmail and Outlook

pgp email encryption guide featured image

[mh_key_takeaways]

PGP email encryption has been the go-to method for security-conscious technical users since the 1990s. The current OpenPGP standard, RFC 9580, still uses the same public-key model that Phil Zimmermann designed in 1991, refreshed with modern algorithms.

PGP is strong, well-audited, and free in its GnuPG form. It is also famous for being harder to use than any browser-based alternative, which is why enterprises pair it with commercial key management and why patient-facing practices usually reach for a portal-based encrypted email service instead.

This guide covers what PGP actually does, how it fits with Gmail, Outlook, and Symantec Encryption, where it stands next to S/MIME, and when a simpler alternative saves days of key management work.

PGP uses public-key cryptography to protect the message body

PGP encrypts the message body with a symmetric AES key that is itself encrypted with the recipient public key. The recipient decrypts the AES key with their private key, then decrypts the body.

The same message can be signed with the sender private key, which lets the recipient verify the sender identity by checking the signature against the sender public key.

Public keys are shared through key servers, personal websites, or attached to a first message. The recipient can verify the public key belongs to the claimed sender by comparing the key fingerprint out-of-band, typically over a phone call.

The full protocol is defined in RFC 9580. GnuPG on Linux and the command line, GPG Suite on macOS, and Kleopatra on Windows all implement the same standard.

PGP does not protect the subject line or the routing headers. It only encrypts the message body and any attached payloads inside the PGP envelope.

PGP for Gmail requires a browser extension

Gmail does not include native PGP support in either the web client or the mobile apps. A browser extension bridges Gmail and the local PGP toolchain.

Mailvelope is the most widely used extension. It stores keys in a browser-managed keyring, wraps the Gmail compose window with an encrypt and sign toolbar, and outputs an armored OpenPGP block that Gmail sends as normal message text.

FlowCrypt is a paid alternative that adds enterprise features like automatic key discovery, a shared keyring, and Outlook integration. It handles the same PGP protocol under the hood.

The recipient side needs the same extension or another PGP-aware client to decrypt. That works well for developer-to-developer mail but breaks down for patient mail because patients do not install extensions.

Practices already on Google Workspace Enterprise Plus can enable hosted S/MIME instead, which handles encryption at the Gmail server side. S/MIME setup and key management is documented in the guide on S/MIME email encryption.

pgp email encryption in article illustration one

PGP for Outlook uses gpg4win or a commercial add-in

Outlook on Windows integrates with PGP through an add-in. Gpg4win with the GpgOL plug-in is the free option and installs a set of encrypt, sign, and decrypt buttons in the compose ribbon.

The add-in reads keys from the local GnuPG keyring. Enterprise deployments typically populate the keyring through a central key server or a directory that stores each user public key alongside their Active Directory entry.

Symantec Encryption Desktop, sold today under the Broadcom Symantec Encryption product line, is the commercial packaging. It adds central policy control, a Symantec Encryption Management Server for key escrow, and support for Outlook and other clients.

Outlook on macOS does not have an official gpg4win port. Users on macOS typically switch to Apple Mail with GPG Suite for PGP, or they run Outlook in a browser and use a PGP-aware webmail extension.

Outlook on the web does not support PGP add-ins directly. Organizations using OWA for their primary interface generally pick S/MIME or Purview Message Encryption instead, or route mail through a gateway that applies encryption at the transport.

Symantec PGP centralizes key management for the enterprise

Symantec PGP was originally sold by PGP Corporation, acquired by Symantec in 2010, and now sold under the Broadcom umbrella. The product line is Symantec Encryption Desktop and Symantec Encryption Management Server.

The Encryption Management Server is the piece that most GnuPG deployments do not have. It centralizes key generation, escrow, revocation, and policy enforcement across the tenant.

Encryption Desktop installs on each endpoint and handles the Outlook add-in, disk encryption, and file encryption. It reads policy from the management server on start and applies encryption rules to outbound mail.

The commercial packaging removes the key management overhead that stops many teams from adopting PGP. It does not remove the recipient-side requirement, so PGP still fits internal enterprise mail and B2B mail with a matched setup better than it fits patient mail.

Support and licensing are through Broadcom. Pricing is not published publicly, and quotes come through a Broadcom sales contact or an authorized reseller.

[mh_example]

PGP compared to S/MIME on the practical decisions

PGP and S/MIME both use public-key cryptography to encrypt email. They differ on trust model, mail client support, and enterprise integration.

PGP relies on a web of trust, where users sign each other keys directly. S/MIME relies on a certificate authority, where a trusted CA signs each user certificate.

S/MIME is built into Outlook, Apple Mail, and Google Workspace Enterprise Plus without a plug-in. PGP requires an extension or an add-in for every mainstream email client.

Feature PGP S/MIME
Trust model Web of trust Certificate authority
Standard OpenPGP RFC 9580 S/MIME RFC 8551
Native Outlook support Add-in required Built in
Native Gmail support Browser extension Hosted S/MIME on Enterprise Plus
Native iPhone Mail Not supported Built in with configuration profile
Key exchange Manual or key server Certificate exchange in signed messages
Typical use case Developer to developer, B2B security teams Enterprise internal, government

For patient mail, neither PGP nor S/MIME is a great fit because patients do not hold keys. Portal-based encrypted email services skip the key exchange step and are documented in the guide on email encryption.

pgp email encryption in article illustration two

Key management is the hard part of PGP

Generating a PGP key pair takes one command. Managing that key pair across a laptop, a phone, a work desktop, and a home machine, over five years and multiple client switches, is the actual work.

Best practice is to keep the private key on a hardware security module or a YubiKey rather than on the disk. That removes the risk of a stolen laptop exposing years of encrypted mail.

Public keys need to be published somewhere the sender can find them. Options include the personal Keyoxide profile, a personal website, a company directory, or the older SKS keyserver network, which is now mostly deprecated.

Key revocation is the other hard problem. When a private key is compromised, the user needs to publish a revocation certificate so that senders stop encrypting to the old key.

Enterprise deployments handle this through a management server. Individual users typically write the revocation certificate to paper when they generate the key and store it in a safe.

HIPAA compliance needs more than PGP encryption alone

PGP encryption satisfies the transmission security part of the HIPAA Security Rule when applied to messages containing protected health information. That is not the full compliance picture.

HIPAA also requires a signed business associate agreement with any vendor that handles PHI, access controls on the mailbox and the key store, audit logs of who sent and received each message, and an incident response procedure for lost or stolen keys.

Google Workspace and Microsoft 365 offer a BAA on eligible paid plans, but the practice must actively request and sign it. Free consumer Gmail and personal Outlook.com are never covered by a BAA, regardless of whether PGP is layered on top.

The HHS Covered Entities reference covers when a BAA is required. Any vendor that touches, stores, or transmits PHI on the covered entity behalf falls under the rule.

Practices building a full patient communication stack also need to think about the surrounding website. Guidance on security features for healthcare websites covers form handling, SSL, and portal integration alongside encrypted mail.

[mh_protip]

PGP fits developer and B2B mail better than patient mail

PGP shines in two common use cases. The first is developer-to-developer mail, where both sides already have keys, run a PGP-aware mail client, and value the strong cryptography.

The second is B2B mail between two security teams, where the setup cost is paid once and the volume justifies it. Enterprises exchanging incident data, threat intelligence, or contract packages often use PGP over commercial email gateways.

Patient mail rarely fits either shape. Patients do not have keys, do not run a PGP-aware client, and will not install a browser extension on the phone they use to check email.

For patient mail, portal-based encrypted email services deliver a link that the patient opens with a passcode. The message and any attachments live inside the portal, and the recipient reads and replies without installing anything.

Referring providers and insurance carriers usually accept portal-based delivery because it does not depend on their own encryption setup. That decouples the practice mail from every partner IT team.

Automation with PGP uses gpg and Bouncy Castle

Automated PGP encryption for batch mail from a report generator or a lab bridge uses the gpg command line on Linux and the Bouncy Castle PGP API on Java.

The gpg –encrypt –recipient email@example.com command reads the file from stdin, encrypts with the recipient public key, and writes the armored output. A shell script pipes the output into mutt or msmtp for delivery.

Bouncy Castle provides the PGPEncryptedDataGenerator, PGPCompressedDataGenerator, and ArmoredOutputStream classes. The Java code loads the recipient public key from a keyring, wraps the message bytes, and writes the resulting armored OpenPGP block into a MimeBodyPart.

For applications sending PHI at scale, calling a secure email API that handles encryption server-side is usually faster than adding key management inside the application. The API pattern also simplifies deployment because the container image does not carry key files.

The choice comes down to whether the recipients already run PGP. If yes, the code path stays inside the application. If no, a portal delivery service handles the recipient side without asking them to set up anything.

When PGP is the right answer and when to pick something else

PGP is the right answer when both sides already run PGP, the recipient will not accept portal links, and the volume justifies the setup cost. It is also the right answer when the recipient is a security team that expects an armored OpenPGP block in the message body.

S/MIME is the right answer for internal enterprise mail where every mailbox is on the same Outlook or Google Workspace tenant and every user already has a certificate through the corporate PKI.

Portal-based encrypted email is the right answer for patient mail, referring providers, and insurance carriers. The recipient opens a link, signs in with a passcode, and reads the message without any account setup.

For a small practice sending a mix of internal, referring provider, and patient mail from Gmail or Microsoft 365, layering a dedicated encrypted email service on top of the existing mailbox covers all three cases with one setup step.

Whichever method fits, run a round-trip test with a real recipient before rolling it out. The most common cause of failed PGP deployments is that the sender got a green Encrypt button but the recipient never received a readable message.

[mh_faqs]

Posted on

How to Encrypt Email Attachment in Gmail and Outlook

how to encrypt email attachment gmail guide featured image

[mh_key_takeaways]

Email attachments are one of the most common sources of PHI exposure in small practices. A lab report, a scanned insurance card, or a discharge summary added to an unencrypted message can put the sender out of HIPAA compliance in a single click.

The native Gmail and Outlook clients each offer attachment encryption on specific paid plans. For teams that need a HIPAA-safe path without upgrading licenses, an encrypted email service sits behind the existing mailbox and encrypts every attachment as part of every outbound message.

This guide walks through the Gmail steps, the Outlook steps, PDF and ZIP password protection, Linux command-line workflows, and Java code. Each option covers a different combination of sender and recipient, and matching the option to the recipient decides whether the workflow actually gets used.

Gmail attachment encryption depends on the account tier

Free consumer Gmail does not encrypt attachments end-to-end. The file rides TLS in transit between mail servers, but Google can read it while it sits on their infrastructure.

Confidential mode is available on every Gmail account and applies expiration, forwarding, and SMS passcode controls to the message and attachment. Those are policy controls, not cryptographic encryption of the file bytes.

Google Workspace Enterprise Plus, Education Standard, and Education Plus include hosted S/MIME. An admin uploads a personal certificate for each user in the Google Admin console under Apps, Google Workspace, Gmail, User settings.

With hosted S/MIME enabled and the recipient public certificate in the Gmail contacts, the compose window shows a lock icon. Attachments are encrypted along with the message body.

For patient mail, S/MIME rarely works because most patients do not have a certificate. Practices sending PHI attachments from Gmail typically pair the mailbox with a portal-based encrypted email service, described later in this guide.

Outlook uses the Encrypt button to lock attachments and body together

Microsoft Purview Message Encryption applies to attachments automatically when the Encrypt button is clicked. The feature ships with Microsoft 365 Business Premium, Apps for Enterprise, and the E3 and E5 tiers.

In new Outlook and Outlook on the web, click Options, then Encrypt, then either Encrypt or Do Not Forward. The Do Not Forward option adds a policy layer that blocks forwarding, printing, and copying by the recipient.

Attachments are rewrapped and delivered through the Microsoft encryption portal. External recipients sign in with Microsoft, Google, or a one-time passcode sent to their inbox, then download the file over TLS.

The Microsoft Purview Message Encryption reference documents which file types are supported. Common office formats, PDFs, and images are handled natively. Files above 25 MB are delivered as an attachment link rather than an inline attachment.

Tenants on Business Basic and Business Standard do not see the Encrypt button by default. Options are to upgrade the affected mailboxes, add Azure Information Protection Premium P1, or layer a third-party how to encrypt email in outlook workflow on top of the existing mailbox.

how to encrypt email attachment gmail in article illustration one

PDF and ZIP password protection is the low-friction fallback

When both mailboxes are on lower tiers and the volume is low, password-protecting the attachment before sending is a defensible fallback. Adobe Acrobat, Foxit PDF Editor, and the free PDF24 tool apply AES-256 encryption to a PDF in a few clicks.

For non-PDF files, 7-Zip supports AES-256 encryption of the archive contents. The -mhe=on option also encrypts the file names inside the archive, which matters because the file name alone can be PHI.

The password must be strong. NIST guidance in SP 800-63B recommends passphrases with at least 8 characters and screening against known-breached password lists.

The password must be shared out-of-band. A phone call, SMS to a verified number, or delivery through a separate messaging channel all count. Sending the password in a follow-up email defeats the purpose.

Older ZIP encryption using the legacy ZipCrypto algorithm is not enough. Any modern archive tool that supports AES-256 is acceptable, but staff need training to select the AES option rather than the default legacy algorithm.

Linux command-line workflows use gpg or 7z

On Linux and macOS, gpg is the standard tool for encrypting a file with a recipient PGP public key. The command gpg –encrypt –recipient email@example.com report.pdf produces a report.pdf.gpg file that only the holder of the matching private key can open.

For symmetric encryption without a key exchange, gpg –symmetric report.pdf prompts for a password and produces an encrypted file. The recipient runs gpg –decrypt with the same password.

7z a -p -mhe=on report.7z report.pdf applies AES-256 to both the payload and the file names. The output attaches cleanly to any mail client and unpacks with 7-Zip, Keka, or The Unarchiver on the recipient side.

Once the file is encrypted, msmtp or mutt handles the actual delivery. A common pattern pipes the encrypted file through mutt -a report.pdf.gpg -s “Encrypted report” recipient@example.com, which sends a normal MIME message with the ciphertext as the attachment.

For scheduled jobs from a cron entry, the same commands work inside a shell script. Applications running under systemd or Kubernetes cron typically prefer a secure email API over shell scripts to avoid managing key files inside container images.

[mh_example]

Java applications use JavaMail with Bouncy Castle for S/MIME

The JavaMail API handles the MIME assembly for a message and its attachments. Adding S/MIME encryption to an attachment requires the Bouncy Castle security provider and the bcpkix-jdk18on package.

The developer loads the recipient X.509 certificate, builds a MimeBodyPart with the raw file, passes both to an SMIMEEnvelopedGenerator, and adds the resulting encrypted part to a MimeMessage. The message goes out through the normal Transport.send call.

For OpenPGP-encrypted attachments, Bouncy Castle offers the PGP API. The workflow reads the recipient public key from a keyring, wraps the file bytes in a PGPEncryptedDataGenerator stream, and attaches the resulting armored output.

Applications that call an encrypted email service through an API avoid the certificate handling entirely. A single POST with the recipient address, subject, body, and attachment moves the encryption to the service side.

For a Spring Boot or Micronaut service that sends patient statements, the API pattern also simplifies the deployment because certificate files do not need to live inside the container image or the config server.

Verify the encryption actually applied before rolling out

Every encrypted attachment workflow needs a round-trip test with a real recipient outside the organization. Sending the encrypted file to a personal address on a different provider is the simplest check.

Common failure modes include Outlook downgrading the message when the recipient tenant does not support Purview, Gmail stripping S/MIME headers when replying, and mobile clients failing to decrypt because the certificate did not sync.

Password-protected PDFs and ZIPs need a check for the algorithm. Opening the file in a hex editor or running a tool like zipinfo confirms whether AES-256 or the legacy ZipCrypto is in use.

The HHS Security Rule guidance covers the technical safeguards that support this kind of verification, including audit controls and access logs for encrypted messages.

Practices that want a shorter verification path can use encrypt email as a single-vendor service that logs every attachment upload, delivery, and open, which reduces the audit to a single report.

how to encrypt email attachment gmail in article illustration two

Large attachments need a link-based delivery pattern

Gmail caps attachments at 25 MB. Outlook caps at 20 MB on most tiers. Medical imaging files, EHR export bundles, and full patient records routinely exceed both.

For large files, the practical pattern is to host the encrypted file on a secure storage service and deliver a link inside the encrypted message. The message body contains the download link and the recipient authentication step.

Microsoft OneDrive for Business supports encrypted sharing links with password protection and expiration. Google Workspace Drive supports similar per-file sharing controls.

Dedicated encrypted email services often include a large-file feature that automatically stages attachments above the SMTP limit on their own storage and delivers the recipient a signed download URL.

For long-term retention of transmitted attachments, the storage service also handles the archival and access log requirements that HIPAA imposes on message and attachment retention.

Shared inboxes need policy-based attachment encryption

Front-desk and billing inboxes that multiple staff share cannot rely on any single person clicking the Encrypt button on every message. They need a mail flow rule or a service-level policy that applies encryption to every outbound attachment automatically.

Microsoft Purview mail flow rules can trigger encryption based on the sender mailbox, the recipient domain, or content patterns like a Social Security Number match. A rule can encrypt every message from the billing inbox regardless of who clicks send.

Google Workspace content compliance rules under Apps, Google Workspace, Gmail, Compliance offer the same pattern. Rules can trigger S/MIME encryption or route the message through a third-party gateway.

Encrypted email services that layer on top of an existing mailbox apply the same policy across every outbound message. The staff workflow is unchanged and every attachment goes out encrypted.

A common rollout mistake is enabling the policy without training the staff on the recipient experience. The first patient who cannot open the portal link will call the front desk, and the policy will be turned off within a week.

[mh_protip]

HIPAA-safe attachments need a signed business associate agreement

Every vendor that touches, stores, or transmits an attachment containing PHI must sign a business associate agreement with the covered entity. Encryption alone does not satisfy the rule.

Google Workspace and Microsoft 365 both offer a BAA on eligible paid plans, but the practice must actively request and sign it through the vendor portal. Free consumer Gmail and personal Outlook.com are never covered.

A dedicated encrypted email service such as Mailhippo includes the BAA in the base plan. Every attachment sent through the account is covered without a separate request or license upgrade.

Practices that build a full patient communication stack also need to think about the receiving side. Guidance on security features for healthcare websites covers the portal, form handling, and file upload controls that complement the attachment side.

For the underlying HIPAA rule text, the HHS Covered Entities and Business Associates guidance is the definitive reference.

Auditing attachment delivery closes the compliance loop

A monthly review of sent attachments confirms that files containing PHI actually went out encrypted. Sampling a handful of messages from each shared inbox catches the most common gaps.

Microsoft Purview reports show which messages triggered the Encrypt policy and which attachments were downloaded. Google Workspace audit logs show S/MIME activity and portal opens.

For password-protected attachments, the audit is manual because the sending mailbox does not log whether the file was encrypted. A short weekly spot-check by the compliance officer keeps the workflow honest.

The NIST SP 800-177 Rev. 1 Trustworthy Email guidance covers the technical controls that support this kind of audit, including DKIM, DMARC, and TLS reporting.

Practices that want a shorter audit can use encrypt email file attachment through a single-vendor service that produces a per-message and per-attachment access log across every mailbox on the plan.

Picking a method comes down to the recipient side and the volume

For internal mail between employees on the same tenant, Purview or hosted S/MIME is the low-friction path because everyone already has the required setup.

For patient mail, referring providers, and insurance carriers, a portal-based encrypted email service removes the certificate exchange problem. Recipients open a link and download the attachment without installing anything.

For occasional attachments in a small practice, password-protected PDFs and 7z archives with an out-of-band password work if the staff follows the pattern every time.

For automated attachments from an EHR export, a lab bridge, or a billing system, a secure email API applies the encryption at the transport layer and covers every message the application sends.

Whichever method fits, run one round-trip test with a real recipient before rolling it out. The most common cause of failed encrypted attachment programs is that nobody tested the recipient side, and the first support call turns off the whole workflow.

[mh_faqs]

Posted on

How to Remove Encryption From Outlook Email in 2026

how to remove encryption from outlook email guide featured image

[mh_key_takeaways]

Removing encryption from an Outlook email sounds like a one-click task. In practice the steps depend on which layer of the Microsoft encryption stack applied the encryption in the first place.

Outlook uses three separate encryption layers. Microsoft Purview Message Encryption at the tenant policy layer, S/MIME at the per-message certificate layer, and Information Rights Management at the sensitivity label layer. Each layer has its own removal path. Users trying to manage encrypted email across a mixed environment need to know all three.

This guide walks through removing encryption from an outbound message before you send it, from a received message so you can reuse the content, and from tenant policy when an admin needs to shut off automatic encryption on a specific rule.

Identifying which Outlook encryption layer applied to a message

Open the message. Click the ellipsis or three-dot menu. Choose Message Options or Properties, depending on the Outlook version.

The Properties dialog shows the message class. rpmsg indicates Purview Message Encryption. IPM.Note.SMIME indicates S/MIME. The Sensitivity field shows any active IRM label. This one dialog answers most encryption-source questions in under a minute.

Once you know the layer, you know the removal path. Purview Message Encryption removes at the Encrypt button on the Options ribbon or through a tenant mail flow rule change. S/MIME removes through the Encryption toggle in the Options ribbon. IRM labels remove through the Sensitivity dropdown near the message subject line.

Users who skip the identification step end up clicking every toggle they can find. The wrong toggle often does nothing because it addresses a different layer than the one applying encryption.

Removing encryption from an outbound Outlook message on desktop

Compose the message as usual. Go to the Options ribbon at the top of the composer window. The Encrypt button lives in the Permission group near the middle of the ribbon.

Click the Encrypt button. If encryption was on, the button toggles off and the shield icon disappears from the composer. If the button opens a dropdown, choose No Encryption at the top of the list.

Send the message. The recipient receives the message without any portal link or password step. Verify by checking the sent copy in the Sent Items folder and reviewing the message class in Properties.

If the Encrypt button is grayed out, a tenant mail flow rule is enforcing encryption based on recipient domain, subject line keyword, or content pattern. The user cannot override the rule. Contact the tenant admin or route the message through how to encrypt email from outlook alternative flows if a genuine business need exists.

how to remove encryption from outlook email in article illustration one

Removing encryption from an outbound Outlook message on web

Outlook web uses a slightly different navigation. Compose the message. Click the three-dot menu at the top of the composer, next to the Send button.

Choose Encrypt from the dropdown. A submenu opens with encryption options. Select No Encryption or click the current option again to toggle it off.

Outlook web shows a lock icon at the top of the composer when encryption is active. The icon disappears after you toggle encryption off. Send the message when the icon is gone.

Outlook web hides some encryption options behind the plan tier. Business Basic users see fewer options than Business Premium users. Enterprise E5 users see the most options because Purview features are all included. Reference the current option matrix at Microsoft Learn Purview Message Encryption.

Removing encryption from an outbound Outlook message on mobile

The Outlook mobile app on iOS and Android places the encryption toggle inside the ellipsis menu of the composer. Tap the ellipsis to open the extended menu.

Tap Encrypt Message. A screen appears with the current encryption setting. Choose No Encryption and tap the back arrow to return to the composer.

The lock icon in the composer header disappears when encryption is off. Send the message from the mobile composer. The recipient receives an unencrypted message that opens in any mail client.

Users on personal iPhones sending occasional PHI often struggle with the mobile encryption workflow. A dedicated app like how to encrypt email from iphone guide setups or a service like Mailhippo simplifies the mobile case without requiring native Outlook encryption at all.

[mh_example]

Removing encryption from a received Outlook message

You cannot un-encrypt a message the sender encrypted. Outlook decrypts the message for display, but the encrypted copy stays in the mailbox database.

The workaround is to reply or forward without encryption when the sender policy allows. Open the message. Click Reply or Forward. Check the composer for the encryption toggle and turn it off if it appears.

Some sender policies apply Do Not Forward or block copy and paste at the label level. In that case the received message cannot be extracted at all. Reach out to the sender and ask them to resend without the restrictive label.

For content you need to move to another system, select all text in the decrypted view, copy, and paste into a fresh unencrypted message. Attachments require a separate step because Outlook often keeps attachments encrypted even when the body decrypts.

Removing encryption from Office 365 mail flow rules as an admin

Sign in to the Exchange admin center at admin.exchange.microsoft.com. Open Mail Flow, then Rules.

Review each rule in the list. Rules that apply encryption usually have Apply Office 365 Message Encryption or Apply RMS Template in the action list. Note the rule name and business owner before making any change.

To disable a rule, toggle the Enabled switch to off. To delete a rule, use the three-dot menu and choose Delete. Test the change on a pilot mailbox first. Send five test messages that would have matched the rule and confirm they arrive without encryption.

Common admin steps:

  • Document the business reason for removing the rule
  • Notify the privacy officer if the rule protected PHI
  • Set a change ticket in the tenant change log
  • Wait 30 minutes after disabling before testing
  • Keep an export of the rule XML for rollback
how to remove encryption from outlook email in article illustration two

Removing encryption from an Office 365 sensitivity label

Sensitivity labels in Microsoft Purview apply encryption at the label level. A message tagged with a Confidential label carries encryption for the life of the message.

To remove encryption from a specific label, sign in to purview.microsoft.com. Open Information Protection, then Labels. Select the label. Click Edit Label.

In the encryption settings step, choose None. Save the change. New messages tagged with the label send without encryption. Existing messages already sent with the label keep their encryption because the metadata was baked in at send time.

Removing encryption from a label affects every user who applies that label. Rename the label to avoid user confusion. A label named Confidential that no longer encrypts creates trust issues with the privacy officer and the audit team.

Removing S/MIME encryption in Outlook desktop

S/MIME encryption relies on a certificate installed on the sender machine. The certificate applies encryption per message through the Trust Center settings.

To turn off S/MIME on a single message, open the composer and go to Options, More Options, Security Settings. Uncheck Encrypt Message Contents and Attachments. Send the message without S/MIME encryption.

To turn off S/MIME across all outbound messages, go to File, Options, Trust Center, Trust Center Settings, Email Security. Uncheck Encrypt Contents and Attachments for Outgoing Messages. Click OK.

Removing the S/MIME certificate entirely happens in the Windows certificate store. Type certmgr.msc in the Run dialog. Open Personal, Certificates. Delete the S/MIME certificate. Deleting the certificate also breaks decryption of past S/MIME messages, so export a backup first.

[mh_protip]

Removing encryption from Outlook messages in bulk

Outlook has no built-in bulk decrypt feature. Third party tools claim to bulk decrypt, but most require the sender private key and produce plaintext exports rather than in-place changes.

The supported path for bulk access uses eDiscovery in the Purview compliance portal. Create a content search that includes the target mailboxes. Export the results as a PST with the Include All Encrypted Messages option checked.

The exported PST contains decrypted copies of every message the running admin has permission to read. Import the PST into the destination mailbox using the Outlook Import feature. The imported copies are unencrypted.

Use this pattern for legal hold, migration, or forensic review only. Bulk decryption for general access defeats the point of the encryption in the first place. Reference guidance from HHS HIPAA Security Rule before running bulk decryption on any mailbox with PHI.

Common Outlook encryption removal errors and fixes

The Encrypt button stays selected even after you click it. Usually a mail flow rule is forcing encryption at the tenant. Check with the admin.

The message arrives at the recipient with the encryption warning banner even though you removed encryption. The recipient mail server flagged the message as suspicious because the sender IP does not match the tenant SPF record. Fix the SPF record.

Attachments still open with a password prompt. Purview Message Encryption applies to attachments through the same policy. Removing encryption from the body does not automatically release the attachments. Re-attach the files after removing encryption to reset the attachment state.

The recipient sees a portal link instead of the message body. The recipient mail client stripped the message body during transport. Check the recipient inbox rules and any downstream security gateways.

When to keep Outlook encryption on and route around it instead

Removing encryption from healthcare, financial, or legal correspondence creates compliance exposure. HIPAA, GLBA, and state privacy laws require encryption of regulated content in transit.

Practices with intermittent encryption needs often benefit from a per-message alternative rather than a permanent policy change. How to send encrypted email guides and services like Mailhippo work alongside Outlook without replacing the native stack.

Mailhippo adds a per-message send option to Outlook. When the sender needs encryption for a specific message, the Mailhippo option applies encryption and a BAA-covered delivery path. When the sender does not need encryption, the message goes out through normal Outlook without any policy conflict. Practices also handling healthcare web hosting and healthcare website maintenance pair the same discipline across their web and email stacks.

For further reference, review CISA cybersecurity advisories on message encryption baselines and the HIPAA Journal on compliant email before making any tenant-level encryption change that affects regulated traffic.

[mh_faqs]

Posted on

HIPAA Rules for Emailing Medical Records to Patients

hipaa emailing medical records guide featured image

[mh_key_takeaways]

Emailing medical records is one of the most common questions in a HIPAA training. Front-desk staff want to know if a patient can request records by email, whether the response counts as a violation, and what to do when a referring physician office asks for a full chart.

The short answer is that HIPAA allows email delivery of medical records under specific conditions. Getting those conditions right is the difference between a compliant workflow and a six-figure Office for Civil Rights finding. Practices that want the mechanics handled at the service layer usually deploy a secure email service that includes a signed business associate agreement.

This guide covers the actual rules, the patient consent step, the encryption requirement, the common violation patterns, and the workflows that keep records email inside the compliance line.

HIPAA allows email delivery when the patient has consented

The Privacy Rule at 45 CFR 164.524 gives patients the right to access their protected health information in the form and format they request, including electronic delivery. Email counts as an electronic format.

The covered entity must confirm the requested delivery method with the patient. A written form, a portal request, or a documented phone call all work as long as the request is recorded in the audit trail.

For records sent to a third party at the patient direction, the covered entity needs a written authorization signed by the patient. That authorization specifies who receives the records and what information is included.

For records sent among covered entities for treatment, payment, or health care operations, patient consent is not required under the Privacy Rule. A referring physician emailing chart notes to a specialist for a shared patient falls in this bucket.

Every state also has its own rules on medical record disclosure that stack on top of HIPAA. State law can require additional consent, additional recordkeeping, or additional restrictions on specific record types like mental health and substance use treatment records.

Encryption is an addressable specification with a defensible default

The Security Rule at 45 CFR 164.312 lists encryption as an addressable specification. That means the covered entity must implement encryption, adopt an equivalent measure, or document why neither is reasonable and appropriate.

In practice, encryption is the only defensible default for records leaving the practice network. The alternatives, such as physical safeguards on paper records, do not apply to email transmission.

Encryption in transit through TLS covers the connection between the sending server and the receiving server. That is the minimum acceptable standard when both sides are known to support TLS 1.2 or higher.

Encryption at rest covers the message once it lands on either side. Portal-based encrypted email services handle this by keeping the message content inside their own encrypted storage rather than delivering it to the recipient mailbox in plain text.

The HHS FAQ on emailing PHI is the definitive reference on when encryption is required.

hipaa emailing medical records in article illustration one

Patient consent must be documented before records go out

The consent step is where most small practices get in trouble. A verbal request over the phone is legally sufficient under HIPAA, but the practice must document that the request was made and how the patient specified the delivery method.

Documentation can be a signed form scanned into the chart, a completed portal request that logged the timestamp, or a note in the EHR that identifies the requesting person, the delivery method, and the records covered.

The patient must also be informed of the risks of email delivery. HHS clarified in 2013 that a patient can request unencrypted email if they explicitly accept the risks, but the practice must document both the risk disclosure and the patient acknowledgment.

For records going to a third party at the patient direction, the authorization must be in writing and must identify the specific third party, the scope of records, and an expiration date or event.

The consent step is documented in more depth in the guide on HIPAA email requirements, which walks through the specific fields the authorization form must contain.

Delivery to the wrong recipient is the most common violation

Misdirected email tops the Office for Civil Rights list of reported HIPAA violations year after year. A typo in the recipient address, an auto-complete pick from the wrong contact, or a reply-all that included an unintended party all count.

Practices reduce the risk with a verification step before send. The staff member reads back the recipient address from the request form, and the EHR or the email client displays the recipient at the top of the message during compose.

Portal-based encrypted email services add a second layer of protection because the recipient must sign in with a passcode to open the message. A misdirected message that arrives at the wrong inbox cannot be opened without the passcode delivered to the intended recipient.

Auto-complete is a specific risk. Disabling auto-complete for the mailbox that sends records, or moving records to a separate mailbox that only sends to verified addresses, removes the most common failure mode.

For a walkthrough of the reporting steps when a misdirected message happens, see the guide on HIPAA email, which covers the breach notification and remediation timeline.

[mh_example]

Business associate agreements cover every vendor that touches the message

Every vendor that touches, stores, or transmits an email containing PHI on behalf of the covered entity must sign a business associate agreement. That includes the mail provider, the encryption service, the archive vendor, and any spam filtering service.

Free consumer Gmail and personal Outlook.com never qualify because Google and Microsoft do not sign BAAs for those accounts. A practice using a personal Gmail account to email records is out of compliance regardless of whether the message was encrypted.

Google Workspace and Microsoft 365 offer a BAA on eligible paid plans. The practice must actively request the BAA through the vendor portal and sign the covered plan sections before sending PHI.

Dedicated encrypted email services typically include the BAA in the base plan without a separate request step. That removes one of the common compliance gaps found in small-practice OCR audits.

The HHS Covered Entities and Business Associates reference lists the specific BAA requirements and the vendors that count as business associates.

hipaa emailing medical records in article illustration two

Attachments and large records need a link-based delivery pattern

Medical records often exceed the 20 to 25 MB attachment cap on Gmail and Outlook. A full chart with imaging can easily reach several hundred megabytes.

The practical pattern hosts the record on a secure storage service and delivers the download link inside the encrypted message. Portal-based encrypted email services do this automatically for attachments above the SMTP limit.

The recipient authentication step matters more for large records because the file itself is worth more on the black market. A signed URL with a short expiration and a passcode delivered separately is the standard pattern.

Imaging DICOM files, EHR export bundles, and CCDA continuity of care documents all follow the same delivery pattern. The message body carries the request context and the download link, and the file lives on encrypted storage until the recipient opens it.

Some practices also archive the delivered record for the retention period required by state law, which for adult records typically runs seven years and for pediatric records runs through the age of majority plus seven.

Records emails need an audit log the practice can produce on demand

The Security Rule requires audit controls on systems that handle PHI. For records emails, the audit log needs to show who sent the message, when it was sent, who the recipient was, and whether the recipient opened it.

Free consumer mail does not produce this log. Even the sent folder cannot prove that the recipient opened the message.

Google Workspace and Microsoft 365 audit logs cover the send event but not the recipient open event when the recipient is outside the tenant. Portal-based encrypted email services log both because the recipient opens the message through the portal.

The log needs to be retained for the same period as the underlying medical record. Six years is the HIPAA minimum for the Privacy Rule documentation, and state law often extends the requirement to match the medical record retention period.

For a review of the audit control requirements across the full HIPAA Security Rule, see the guide on is it a HIPAA violation to email medical records, which walks through the OCR audit protocol.

[mh_protip]

Penalties escalate quickly for willful neglect

HITECH Act penalty tiers apply to every HIPAA violation. The tier depends on the culpability, not the severity of the disclosure.

Tier 1, unknowing violations, carries $100 to $50,000 per record with a cap of $25,000 per calendar year. Tier 2, reasonable cause without willful neglect, carries $1,000 to $50,000 per record with a cap of $100,000.

Tier 3, willful neglect corrected within 30 days, carries $10,000 to $50,000 per record with a cap of $250,000. Tier 4, willful neglect not corrected, carries $50,000 per record with a cap of $1.5 million.

OCR also requires a corrective action plan that typically runs multiple years. The plan covers policy updates, staff retraining, and a monitoring period during which OCR receives quarterly reports.

State attorneys general can also bring civil actions under HITECH, and repeat willful violations can be referred to the Department of Justice for criminal prosecution under 42 USC 1320d-6.

Common workflow that keeps records email compliant

A compliant records email workflow has a consistent shape. The patient submits a request through a portal or a signed form. The staff member logs the request in the EHR with the delivery method and recipient information.

The staff member composes the message from a mailbox that is covered by a BAA and that uses an encrypted delivery service. The recipient address is verified against the request form, and the send button is clicked only after the verification step.

The recipient receives a portal link, signs in with a passcode delivered to the recipient inbox or phone, and downloads the record over an encrypted channel. The service logs the delivery and the open events.

The practice archives the delivered record and the audit log for the retention period required by state law. The archive is stored on infrastructure covered by a BAA and is available for OCR review on request.

Practices building the full patient communication stack often pair the email service with a secure website. Guidance on security features for healthcare websites covers the portal, form handling, and file upload side of the workflow.

Practical answers to the questions staff actually ask

Can we email a chart to a patient? Yes, with documented patient consent, encryption on the transmission, and a BAA-covered mail service.

Can we email a chart to a referring physician? Yes, without patient consent when the disclosure is for treatment, and with the same encryption and BAA requirements as any external delivery.

Can we email a chart to a patient attorney? Yes, only with a written authorization signed by the patient that identifies the attorney and the scope of records.

Can we email a chart to a family member? Yes, only with a written authorization or a documented emergency exception under 45 CFR 164.510, which allows disclosure to a family member involved in the patient care.

Can we use a personal Gmail account to email a chart? No. Personal accounts have no BAA and are automatically out of compliance regardless of encryption. Every records email must go through a mailbox that is covered by a BAA and a documented practice policy.

[mh_faqs]

Posted on

Email Encryption Solutions Compared for HIPAA and Business Use

email encryption solutions guide featured image

[mh_key_takeaways]

Email encryption solutions fall into three architectural buckets, and the right pick depends on team size, HIPAA scope, and recipient mix. Native platform encryption, portal-based services, and gateway suites each solve the same problem with different trade-offs.

This guide compares the three approaches, walks through the leading vendors in each category, and lays out a decision framework for practices choosing an encrypted email service in 2026. The comparison focuses on real recipient experience and admin cost rather than marketing feature lists.

Healthcare teams that need HIPAA scope should also review the broader stack of controls around patient communication, including intake forms, portals, and website security. The healthcare marketing agency team at Redefine Web sees encryption gaps most often on smaller practices without dedicated IT.

Three architectures cover the entire market

Native platform encryption ships inside Microsoft 365 Business Premium, Enterprise plans, and Google Workspace with the S/MIME add-on. It relies on tenant licensing and integrates directly with the mail client.

Portal-based services accept plain mail from the sender, encrypt it in transit, and store it behind a secure viewer. The recipient clicks a link and signs in or enters a passcode to read the content.

Gateway and client-side services sit between the sender mail server and the receiving mail server. They negotiate TLS with the recipient server when possible and fall back to a portal only when TLS fails.

All three architectures use AES-256 for at-rest encryption and TLS 1.2 or higher in transit. The differences show up in recipient experience, admin overhead, and price.

Recipient experience decides adoption more than cryptography

Recipients rarely care about the underlying encryption protocol. They care about how many clicks separate them from the message and how often a portal step interrupts a normal reply thread.

Native platform encryption reads inline when both parties use the same platform. Cross-platform mail, Microsoft to Gmail or the reverse, forces a portal step for the recipient.

Portal services always route through a viewer, even when both parties use compatible platforms. The consistency helps admins but frustrates recipients who exchange many messages per day.

Gateway services deliver inline in most cases and fall back to a portal for the small percentage of recipients whose mail servers reject modern TLS. The best gateway architectures produce the smoothest recipient experience overall.

email encryption solutions in article illustration one

HIPAA scope requires a signed Business Associate Agreement

Every HIPAA-scoped email flow needs a BAA between the covered entity and the encryption vendor. The BAA defines breach notification timelines, subcontractor rules, and audit access rights.

Microsoft and Google sign a BAA at no extra cost on Business and Enterprise plans through the Service Trust Portal or the Google Cloud console. That BAA covers Purview Message Encryption and Workspace S/MIME.

Personal Gmail, Business Standard without the Compliance add-on, and free Outlook.com accounts do not qualify for a BAA. Practices sending PHI through those accounts sit outside HIPAA scope regardless of technical encryption.

Dedicated encrypted email services usually include the BAA in the base plan without an upgrade or per-seat premium. This makes them a simpler compliance path for practices without existing Business Premium licensing.

Comparison table of the leading email encryption solutions

The table below compares the three architectural approaches on the criteria that matter most to healthcare and small business practices. Individual vendor names appear in each category to anchor the trade-offs.

Approach Example vendors Recipient experience BAA in base plan Admin overhead Best for
Native platform Microsoft Purview, Google Workspace S/MIME Inline for same platform, portal for others Yes on Business Premium and above Medium to high Practices already on Business Premium with IT lead
Portal-based service Mailhippo, Barracuda Cloud Email Portal for every recipient Yes on standard plans Low Small practices under 50 seats without dedicated IT
Gateway suite Cisco Secure Email, Proofpoint Inline via TLS, portal fallback Yes on healthcare tier High Hospital systems above 200 seats with compliance officer
S/MIME direct Sectigo, DigiCert Inline for both parties Certificate vendor separate from BAA Very high Regulated industries requiring certificate control

The right pick rarely matches the sticker price. Total cost of ownership includes license fees, IT hours, workforce training time, and helpdesk load for recipient confusion.

[mh_example]

Native Microsoft 365 encryption fits Business Premium tenants

Microsoft Purview Message Encryption ships with Business Premium, E3, E5, and equivalent education, nonprofit, and government plans. The Encrypt button lives in the Outlook Options ribbon.

Setup takes an hour for a basic deployment. Mail flow rules under the Exchange admin center automate encryption based on keywords, sensitivity labels, or recipient domains. Training staff on when to click Encrypt takes longer.

Business Standard tenants face a decision. Upgrading every seat to Business Premium adds meaningful monthly cost, and the E5 Compliance add-on requires an existing Business or Enterprise base license.

The full detail of the Outlook workflow lives in the outlook 365 encrypt email guide, which walks through the Encrypt button, mail flow rule setup, and licensing decisions.

Google Workspace S/MIME fits Enterprise tenants with certificate control

Google Workspace Enterprise plans support hosted S/MIME, which encrypts messages with certificates issued to individual users. The receiving mail server decrypts inline when it holds the matching public certificate.

S/MIME does not fall back to a portal for external recipients without certificates. Messages sent to Gmail personal accounts, Yahoo, or non-S/MIME organizations arrive as plain text unless a separate encryption layer intervenes.

The certificate management overhead scales poorly. Practices with 20 staff and 500 external contacts spend hundreds of hours per year issuing, renewing, and revoking certificates. Most healthcare teams pick a different approach.

The broader network solutions email encryption question spans S/MIME, PGP, and hybrid architectures. Enterprise IT teams sometimes deploy multiple layers to cover different recipient categories.

email encryption solutions in article illustration two

Portal-based services fit small practices without dedicated IT

Portal-based services deploy in an afternoon and require no certificate management, no MX record changes, and no mail flow rules. The service intercepts outbound messages that hit a defined trigger and routes them to a secure viewer.

The BAA typically ships in the base plan. Mailhippo, Virtru business tier, and Barracuda Cloud Email cover the BAA at no extra cost for healthcare customers. Pricing lands around a few dollars per user per month.

Portal fatigue is the main drawback. Recipients who exchange multiple messages per week with the practice eventually complain about the login step. A branded portal with practice logo and disclaimer reduces the friction.

Practices under 50 seats without a dedicated IT lead usually pick this category. The hipaa complaitn email solutions guide compares three portal services in more detail.

Gateway suites fit enterprise environments with archiving needs

Cisco Secure Email, Proofpoint Essentials, and Barracuda Advanced Threat Protection sit at the network edge and inspect every message. They handle inbound spam, outbound encryption, and DLP under a single admin console.

The gateway architecture delivers inline when the receiving mail server supports TLS 1.2 or higher. Modern Gmail, Outlook, and major hosted providers all negotiate TLS, so most recipients read the message without a portal step.

Deployment requires MX record changes, TLS certificate rotation, and DKIM and DMARC alignment. Small teams that lack a dedicated mail admin should budget several weeks for a clean rollout.

Enterprise gateway pricing runs a few hundred dollars per user per year and often includes archiving, DLP, and threat intelligence. The enterprise email encryption solutions guide covers the deployment path in detail.

DLP integration matters more as PHI scope grows

Data loss prevention scans outbound mail for patterns that match sensitive information. Common patterns include Social Security numbers, medical record numbers, credit card numbers, and named entity matches for patient data.

DLP paired with encryption removes the burden on staff who forget to click Encrypt. When DLP finds a match, the mail server applies encryption automatically or blocks the message for admin review.

Enterprise gateway suites include DLP in the base plan. Portal-based services offer it as an add-on. Native Microsoft 365 encryption requires the E5 Compliance license or Business Premium with Purview DLP policies.

Small practices with fewer than 20 seats often skip DLP and rely on staff training. The NIST Cybersecurity Framework recommends DLP for any organization handling regulated data at any scale, but implementation cost stays a real barrier.

[mh_protip]

Total cost of ownership rewards honest math

Sticker price rarely tells the full story. A portal service at five dollars per user per month looks cheaper than Business Premium until the practice adds the cost of the Microsoft license the staff already needed.

Add IT hours for deployment, maintenance, and troubleshooting. Native platform encryption requires certificate rotation and mail flow rule tuning. Portal services need a one-time DNS check. Gateway suites need ongoing tuning of DLP and spam rules.

Add workforce training. Every solution requires training staff on when to encrypt, how to explain the recipient experience, and what to do if a message bounces. Budget an hour per staff member per year.

Add helpdesk load for recipient portal confusion. First-time recipients ask questions. A branded portal, a clear cover message, and a support contact reduce the volume but do not eliminate it.

A decision framework built on team size and mail patterns

Practices under 20 seats without dedicated IT usually pick a portal-based service. The BAA ships in the base plan, deployment takes an afternoon, and the recipient experience stays consistent across every provider.

Practices between 20 and 100 seats with an internal IT lead face the widest set of choices. Native Microsoft 365 fits if the tenant already runs Business Premium. Otherwise a portal service still wins on total cost.

Enterprise systems above 200 seats with a compliance officer usually pick a gateway suite. The DLP, archiving, and threat intelligence integration justify the higher per-seat cost when the alternative is buying three separate tools.

Regulated environments requiring certificate control, such as federal contractors and specialty lab networks, layer S/MIME on top of a portal or gateway service. The email encryption guide covers the layering pattern in detail.

Migration paths keep the switch low risk

Switching encryption vendors rarely requires a mail server migration. Portal services layer on top of the existing account, gateway services swap the MX record, and native platform encryption changes only the internal admin console configuration.

Test the new service with a small internal group for two weeks. Send messages to Gmail, Outlook, Yahoo, and a consumer ISP address. Confirm the recipient experience matches expectations and the audit log captures the events.

Roll out to the full team after the test group signs off. Keep the old service running for a week in case a rule needs adjustment. Cancel the old contract only after the audit log for the new service covers a full month.

Document the change in the HIPAA Security Rule risk analysis and update workforce training records. Practices that skip this step create audit gaps that the Office for Civil Rights investigators note during breach investigations.

  • Confirm the vendor signs a BAA covering the encryption service itself, not just the underlying platform.
  • Test the recipient experience across Gmail, Outlook, Yahoo, and a consumer ISP address before committing.
  • Budget IT hours, training time, and helpdesk load in addition to license fees when comparing solutions.
  • Document the encryption decision in the HIPAA Security Rule risk analysis for audit defensibility.
  • Review the choice annually as licensing changes and vendor pricing shifts often outpace initial expectations.

Choosing the right email encryption solution comes down to matching architecture to team size, HIPAA scope, and recipient mix. Every serious solution meets the technical safeguard for encryption, so the differences that matter show up in daily use rather than in the vendor pitch deck.

[mh_faqs]

Posted on

Encrypted Email Microsoft 365 Setup Guide for 2026

encrypted email microsoft 365 guide featured image

[mh_key_takeaways]

Encrypted email on Microsoft 365 uses Microsoft Purview Message Encryption behind the scenes. The service ships with Business Premium, E3, E5, and F3 plans at no extra cost.

Practices sending PHI to patients or vendors need three things in place. A qualifying license, a signed business associate agreement with Microsoft, and a published sensitivity label that maps to an encryption template. Once those three exist, users see the Encrypt button in Outlook and can send encrypted email from any device.

This guide walks through the setup steps, the license comparison, the sender experience across desktop, web, and mobile, and where the portal-based delivery step creates friction for high-volume patient communication.

Encrypted email Microsoft 365 licensing landscape

Purview Message Encryption ships with Business Premium at $22 per user per month, E3 at $36, E5 at $57, and Frontline F3 at $8. Business Basic at $6 and Business Standard at $12.50 do not include the Encrypt button.

Practices on Basic or Standard have two upgrade paths. Move the tenant to Business Premium for the full compliance stack. Add the Microsoft 365 E3 Compliance add-on at $12 per user per month to gain Purview without paying for Business Premium features the practice does not use.

Nonprofits get 30 to 75 percent off list on every plan through the Microsoft Nonprofits program. Business Premium runs about $5.50 for verified nonprofits. Documentation lives at Microsoft Nonprofits portal.

Confirm the license status in the Microsoft 365 admin center under Billing, Licenses. See Microsoft 365 email encryption setup for the regional configuration walkthrough.

Business associate agreement for encrypted email Microsoft 365

Microsoft signs a business associate agreement with covered entities on qualifying paid plans. The BAA covers Exchange Online, SharePoint Online, OneDrive, Teams, and Purview.

Administrators accept the BAA in the Microsoft 365 admin center. Open Billing, Your Products, then click the Terms link on the eligible plan. Read the BAA in full and click Accept. The tenant is HIPAA-eligible immediately after acceptance.

The BAA does not cover any consumer Outlook.com account or any free Microsoft account. Verify the tenant type in the admin console before treating any mailbox as HIPAA-eligible.

After BAA acceptance, configure the required admin settings. Enable multi-factor authentication for every user. Turn on audit logging in the compliance portal. Set retention that meets the six-year Privacy Rule requirement. Reference the sample BAA at HHS sample BAA provisions.

encrypted email microsoft 365 in article illustration one

Enabling Microsoft 365 email encryption with Microsoft Purview

Sign in to compliance.microsoft.com with a global admin or compliance admin account. Open Information Protection, then Labels.

Click Create Label. Give the label a display name like Confidential, add a description, and pick a color. On the encryption step, choose Assign Permissions Now.

Configure the permission block. Add users or groups, set the permission level, and save the encryption settings. Publish the label to the tenant. Users see the Encrypt button in Outlook after publication.

Test on a pilot user before rolling to production. Send a message from the pilot mailbox to an external Gmail address and confirm the recipient gets the portal notification. Reference Microsoft Purview email encryption for the deep configuration walkthrough.

Sending encrypted email from desktop Outlook

Compose the message. Go to the Options ribbon at the top of the composer window. The Encrypt button lives in the Permission group in the middle of the ribbon.

Click Encrypt. A dropdown appears with the available permission templates. Pick Encrypt for basic encryption or Do Not Forward for stronger controls that block forwarding and printing.

The composer displays a lock icon at the top and a permission banner near the subject line. Send the message. External recipients get a notification email with a portal link.

If the Encrypt button is grayed out, the tenant does not have a published sensitivity label yet. Check with the admin. See encrypt email Microsoft Outlook for the full sender walkthrough.

[mh_example]

Sending encrypted email from Outlook web

Sign in to outlook.office.com. Compose the message as usual. Click the three-dot menu at the top of the composer, next to the Send button.

Choose Encrypt from the dropdown. A submenu opens with the available permission templates. Pick Encrypt or Do Not Forward. The composer shows a lock icon and a permission banner at the top.

Send the message. The recipient experience matches desktop Outlook. External recipients get a notification email with a portal link.

Outlook web sometimes hides advanced permission templates behind the tenant plan tier. Enterprise E5 tenants see every option. Business Premium tenants see the default four. See Microsoft Outlook 365 encrypt email for the tier-by-tier feature matrix.

encrypted email microsoft 365 in article illustration two

Sending encrypted email from Outlook mobile

The Outlook mobile app on iOS and Android places the encryption toggle inside the ellipsis menu of the composer. Tap the ellipsis to open the extended menu.

Tap Encrypt Message. A screen appears with the available permission templates. Pick the template and tap the back arrow to return to the composer.

The lock icon in the composer header confirms encryption is active. Send the message from the mobile composer. The recipient experience matches desktop and web.

Users on personal iPhones sending occasional PHI often struggle with the mobile encryption workflow because the ellipsis menu is not obvious. Train users on the workflow before rollout. Screenshots in the training material help far more than a written procedure.

Recipient experience for Microsoft 365 encrypted email

External recipients get a notification email with a portal link. The notification email includes the sender name, subject line, and a button that opens the portal.

Recipients sign in with Microsoft, Google, or a one-time passcode. The Microsoft option works for anyone with a Microsoft account. The Google option works for anyone with a Google account. The one-time passcode works for anyone else.

Reply from the portal stays encrypted. The reply routes back through Microsoft servers and lands in the original sender inbox as a normal encrypted message.

The friction of the portal step drops adoption. Practices sending 200 patient messages per week often see 30 to 50 first-time recipients need help with the portal. Support ticket volume tracks directly to the portal experience.

[mh_protip]

S/MIME as an alternative encrypted email path on Microsoft 365

S/MIME encryption sits alongside Purview Message Encryption in Microsoft 365. S/MIME uses certificates installed on the sender and recipient devices.

Configuring S/MIME in Microsoft 365 requires the admin to upload the certificate authority chain to the Exchange admin center. Users install their personal certificate in the Windows certificate store or the Outlook mobile app.

S/MIME provides stronger cryptographic guarantees than Purview because the message content decrypts only on the recipient device. Microsoft servers never see the plaintext.

The tradeoff is setup complexity. Most healthcare practices skip S/MIME because patients cannot install certificates. Reference the current S/MIME setup path at Microsoft Learn S/MIME configuration.

Common Microsoft 365 encrypted email problems and fixes

The Encrypt button is grayed out. The tenant does not have a published sensitivity label with encryption enabled, or the user account does not have a Purview-eligible license.

The recipient gets a portal link but cannot log in. The one-time passcode option ships to the same email address the notification came to. Ask the recipient to check the inbox for the passcode message and to check spam if the passcode does not appear.

Attachments open with a permissions error. The permission template applied to the message restricts attachments. Change the template to Encrypt without additional restrictions.

Common troubleshooting checklist:

  • Confirm the license includes Purview Message Encryption
  • Confirm the BAA is accepted in the admin center
  • Confirm at least one sensitivity label is published with encryption
  • Confirm the Outlook client version is current
  • Confirm the recipient inbox is not blocking the portal notification domain

When to layer a zero-step alternative on top of Microsoft 365

Practices with heavy external patient mail volume often outgrow the Purview portal experience. Support ticket volume from patients who cannot log in to the portal starts to eat into clinical time.

A zero-step encryption service like Mailhippo works alongside Microsoft 365. Purview handles internal traffic between mailboxes on the tenant. Mailhippo handles external mail to patients and vendors without a portal step. The two services coexist without a routing conflict.

Practices running HIPAA compliant website design already understand the reasonable and appropriate standard. Applying the same standard to email means picking the tool that keeps compliance tight while dropping recipient friction. See also security features for healthcare websites for the parallel web guidance.

For further reference, review Microsoft Learn Purview Message Encryption, the HHS HIPAA Security Rule, and the HIPAA Journal guide to compliant email before finalizing the Microsoft 365 encrypted email stack. See also Microsoft email encryption and Microsoft Office 365 email encryption for related walkthroughs. See the Mailhippo secure email service overview for the zero-step alternative details.

[mh_faqs]

Posted on

How Is Email Encrypted A Practical Guide for Healthcare and Business

how is email encrypted guide featured image

[mh_key_takeaways]

Most senders assume email encryption is a single technology. It is actually a stack of independent controls that operate at different points in the message journey. Transport encryption protects the connection between servers. Content encryption protects the message body itself.

Understanding how is email encrypted at each layer matters for anyone handling regulated data. A practice that assumes Gmail encrypts everything end to end may be storing PHI in a way that fails HIPAA audit. A HIPAA-focused encrypted email service handles both layers automatically.

This guide walks through the exact cryptography behind TLS, S/MIME, PGP, and portal-based encryption. It covers Gmail, Outlook, Apple Mail, iCloud, and the interoperability rules that govern messages between platforms.

Transport encryption protects the connection, not the message

Transport Layer Security, usually TLS 1.2 or 1.3, wraps the SMTP connection between mail servers in a cryptographic tunnel. Every packet that travels between the sending and receiving server is encrypted for the duration of the connection.

TLS negotiates through STARTTLS, an SMTP extension that upgrades a plaintext connection to an encrypted one. When both servers support it, the message travels encrypted. When one server does not, most systems fall back to plaintext SMTP by default.

The SMTP TLS Reporting standard from the IETF documents both the negotiation flow and the reporting mechanism. Modern platforms like Google Workspace and Microsoft 365 enforce TLS for connections to major providers.

Transport encryption ends when the message arrives at the receiving server. From that point, the message body sits decrypted on the receiving server storage unless content encryption was applied at the sender end.

how is email encrypted in article illustration one

Content encryption protects the message body itself

Content encryption wraps the message body, headers, and attachments in cryptography that only the intended recipient can unlock. The encrypted payload travels through the standard mail flow but stays unreadable to intermediate servers.

Three approaches dominate. S/MIME uses X.509 certificates issued to individual users. PGP uses per-user key pairs exchanged through key servers or manual transfer. Portal-based systems encrypt the content on the sender server and deliver a link that the recipient opens in a browser.

Each approach solves the same problem differently. S/MIME fits enterprise environments with a PKI. PGP fits technical users who exchange keys. Portal systems fit patient-facing healthcare workflows where recipient key management is impractical.

Content encryption survives any downstream server behavior. Even if the receiving mail server logs the message, indexes it for search, or backs it up to cold storage, the message body remains encrypted until the recipient decrypts it with their key.

Is Gmail email encrypted end to end

Gmail encrypts every message in transit with TLS 1.3 for outbound connections to servers that support it. Gmail also encrypts message storage at rest on Google infrastructure using AES with keys managed by Google.

Neither of those provides end-to-end encryption. Google can access message content for spam filtering, indexing, search, and legal disclosure. The user does not hold a key that keeps Google out of the message body.

Gmail S/MIME on Workspace Enterprise Plus adds certificate-based end-to-end encryption. Confidential Mode adds link expiration and SMS passcode delivery but does not encrypt the message body itself on Google servers.

For HIPAA use, Google Workspace signs a business associate agreement and provides the controls needed for compliance when properly configured. Practices should still verify TLS enforcement and layer content encryption for outbound PHI to non-Workspace recipients.

[mh_example]

Is Apple and iCloud email encrypted

Apple Mail and iCloud Mail encrypt messages in transit using TLS 1.2 or 1.3. Apple encrypts message storage at rest on iCloud servers, but the encryption keys sit with Apple, so Apple can decrypt content when legally required.

Advanced Data Protection, Apple end-to-end encryption feature for iCloud data, explicitly excludes iCloud Mail. Apple documents this exclusion in the Advanced Data Protection support article. The reason is IMAP compatibility.

Apple Mail supports S/MIME on macOS and iOS when a certificate is installed in Keychain Access. Users generate or import a certificate, and outbound messages sign and encrypt automatically to recipients with matching certificates.

For HIPAA use, iCloud Mail is not appropriate for PHI in its default configuration. Practices using Apple devices should route email through Google Workspace, Microsoft 365, or a dedicated HIPAA-compliant service that signs a BAA.

how is email encrypted in article illustration two

Is email encrypted between Gmail and Office 365

Messages between Gmail and Office 365 travel over TLS in nearly every modern deployment. Both platforms enforce STARTTLS for outbound connections to major providers, so the message travels encrypted in transit.

Neither platform provides end-to-end encryption for the message body between them by default. Google decrypts the message on receipt for spam scanning and storage. Microsoft does the same. Both providers can access content unless additional encryption was applied at the sender end.

For sender-controlled encryption between the two platforms, Google Workspace administrators enable S/MIME on Enterprise Plus, and Microsoft 365 administrators enable Purview Message Encryption or S/MIME. Both approaches require certificate exchange or portal delivery to non-encrypted recipients.

A simpler path for smaller practices is a shared HIPAA-compliant service that handles encryption on top of Gmail or Outlook without requiring PKI. That approach removes the certificate management burden entirely.

How to email encrypted files as attachments

Two paths deliver encrypted attachments. The first attaches a password-protected archive. The second wraps the whole message in content encryption that covers the attachment automatically.

Password-protected archives are the traditional fallback. Create a ZIP or 7z archive with a strong password, attach it to a normal email, and share the password through SMS, phone, or a separate secure channel.

The archive approach works with any recipient and any mail server. Its security depends entirely on password strength and out-of-band password delivery. Practices sending regulated files this way should use passwords of at least 16 characters generated from a password manager.

The content encryption approach uses S/MIME, PGP, or a portal-based service to encrypt the whole message including attachments. Recipients open the message with a key or a portal link. For PHI and other regulated content, this approach gives better auditability than password-protected archives.

[mh_protip]

Understand encrypted email file formats

Content-encrypted emails travel as MIME messages with cryptographic wrapping. The specific format depends on the encryption approach the sender used.

S/MIME messages carry a Content-Type of application/pkcs7-mime. The message body is a signed and encrypted PKCS#7 envelope. Recipients open the message in an S/MIME-capable client that decrypts the envelope with the recipient certificate.

PGP messages carry a Content-Type of multipart/encrypted with an OpenPGP application type. The message body is an OpenPGP-encrypted payload. Recipients decrypt with a PGP client that holds their private key.

Portal-based encryption delivers a wrapper message with a link to the encrypted content on the sender server. HPP files, an older legacy format, work similarly through a downloadable archive that opens in a proprietary reader. Modern portal services skip the HPP step by delivering the message directly to the recipient inbox.

Verify encryption end to end before sending PHI

Verification catches configuration gaps before they turn into HIPAA violations. Two checks matter for every regulated workflow.

First, verify TLS enforcement on both mail servers. NIST Special Publication 800-177 documents the recommended TLS configuration for email in the Trustworthy Email guide. Both sender and receiving servers should enforce TLS 1.2 or higher with strong cipher suites.

Second, verify content encryption reaches the recipient in a usable form. Send a test message with the exact encryption configuration used for real PHI, then confirm the recipient can open and reply to the message without error.

Practices building a compliant email stack also need healthcare website security features for the public-facing side. Encryption on email alone does not protect PHI on intake forms, patient portals, and appointment scheduling pages.

Choose an encryption stack that matches operational reality

Every encryption approach has an operational cost. S/MIME and PGP push key management onto the user or the IT team. Portal-based systems shift the friction to the recipient who has to click a link and sometimes create an account.

Practices with dedicated IT staff often run S/MIME with an internal PKI. Practices without dedicated IT often pick a HIPAA-focused service that handles the encryption behind the scenes. Both approaches meet compliance when configured correctly.

Mailhippo works alongside existing Gmail or Outlook accounts as a HIPAA-compliant secure email service. The base plan includes a business associate agreement and applies TLS with client-side encryption without requiring PGP keys or separate client software. Recipients open messages with one click.

Compare the options side by side. Look at email encrypted workflows, revisit whether is email encrypted for your specific stack, or review how to send email encrypted for one-off transfers. Pick based on how many messages you send per week and how much recipient friction the practice can absorb.

  • Transport encryption protects the connection, not the stored message.
  • Content encryption protects the message body across every server it touches.
  • iCloud Mail is not covered by Apple end-to-end encryption program.
  • Gmail and Office 365 encrypt in transit between each other by default.
  • PHI needs verified TLS and content encryption together.

[mh_faqs]

Posted on

What Does Encrypted Email Mean and How Encryption Protects Messages

what does encrypted email mean guide featured image

[mh_key_takeaways]

Encrypted email means the message content is scrambled into unreadable ciphertext during transit, storage, or both. Only a recipient holding the correct decryption key can convert it back to plain text.

That definition sounds straightforward. The complication is that encryption happens at different points in the message lifecycle, and each point protects against a different threat. Understanding the layers is the difference between a real safeguard and a marketing label.

This guide walks through what encryption means at each layer, what it protects, and where it stops. For practices sending patient information, the layer question feeds directly into whether a service qualifies as one of the compliant encrypted email services under HIPAA.

The mechanics of email encryption in plain language

Encryption uses a mathematical function to convert readable text into a scrambled string. The function requires a key, which is a piece of secret data. The same key or a paired key reverses the function on the receiving end.

Symmetric encryption uses the same key on both ends. It is fast but requires the sender and recipient to share the key over a secure channel first.

Asymmetric encryption uses a public key to encrypt and a private key to decrypt. The sender uses the recipient’s public key, which can be shared openly. Only the recipient’s private key can decrypt the message.

Email systems combine both. The message body is encrypted with a symmetric key for speed. The symmetric key is then encrypted with the recipient’s public key. The recipient decrypts the symmetric key with their private key, then decrypts the message.

Understanding the mechanics helps interpret what a service is actually doing when it claims to encrypt messages. Sibling coverage on the practical outcome is in what does encrypting email do.

The three points where email encryption happens

An email passes through several stages between the sender’s compose window and the recipient’s inbox. Encryption can apply at each stage.

  • Transit between mail servers, protected by TLS.
  • Storage on the sender’s mail server, protected by at-rest encryption.
  • Storage on the recipient’s mail server, protected by at-rest encryption.
  • The recipient’s local device, protected by disk encryption.

A message can be encrypted at one point and exposed at another. TLS protects the wire but not the stored copy. End-to-end encryption protects both the wire and every stored copy, but not the recipient’s decrypted local version.

Compliance auditors ask about each layer individually. A general claim of “encrypted email” without specifying which layer is not a defensible answer.

what does encrypted email mean in article illustration one

TLS between mail servers is the baseline layer

Transport Layer Security encrypts the connection between two mail servers during message delivery. Gmail, Outlook.com, and Microsoft 365 all attempt TLS 1.2 or 1.3 by default.

TLS protects against network-level eavesdropping. An attacker sitting on a coffee shop Wi-Fi or an ISP link cannot read the message body while it moves between servers.

The limitation is that TLS applies only during transit. Once the message reaches the recipient’s server, it is decrypted, stored, and re-encrypted with a different key that the server controls. Both the sending and receiving providers can read the stored copy.

TLS also fails silently when the receiving server does not support a compatible version. The message falls back to plain text, and the sender is not warned. The NIST SP 800-52 Rev. 2 guidance documents the accepted TLS versions and cipher suites.

For HIPAA scenarios, TLS alone is usually not enough because the sender cannot prove the message stayed encrypted through the full delivery path.

End-to-end encryption keeps the mail provider out of the loop

End-to-end encryption uses the recipient’s public key to encrypt the message on the sender’s device. The message stays encrypted through every server it passes through, including both mail providers.

Only the recipient’s private key, held on the recipient’s device, can decrypt the message. Neither mail provider ever sees plain text, which is a stricter model than TLS or gateway-based encryption.

S/MIME and PGP both operate at this layer. S/MIME uses certificates issued by a trusted authority. PGP uses keys the user generates and controls directly.

The tradeoff is that both sides need to hold matching keys or certificates. For practices sending to patients who do not have PGP or S/MIME, end-to-end is impractical. Gateway encryption with portal fallback is usually the better fit.

The sibling article does email encryption really work covers this reliability question in more depth.

[mh_example]

Gateway encryption sits in the middle of the spectrum

Gateway-based services intercept outbound mail at the sender’s mail server, encrypt the message body on that server, and deliver it to the recipient through a secure channel.

Microsoft Purview Message Encryption is the built-in gateway for Microsoft 365 Business Premium and Enterprise. Google Workspace hosted S/MIME serves a similar role on Enterprise Plus. Dedicated services like Mailhippo operate at the same layer for accounts on any plan.

The recipient experience varies. Some services deliver directly to the recipient’s inbox with TLS enforcement. Others deliver a link to a secure portal where the recipient signs in with Microsoft, Google, or a one-time passcode.

Gateway encryption is the pragmatic middle ground for most compliance workflows. It removes the per-contact certificate exchange required by S/MIME while still producing audit logs and enforcing encryption at the message level.

What encrypted email actually protects against

Encryption addresses specific threats. Knowing what those threats are helps calibrate expectations about what a specific service delivers.

  • Network-level eavesdropping on the wire between mail servers.
  • Unauthorized access to stored messages on the sending or receiving mail server.
  • Interception at intermediate mail relays operated by third parties.
  • Bulk data harvesting during a mail provider breach.
  • Legal discovery requests directed at the mail provider, for end-to-end scenarios.

Encryption does not protect against a compromised endpoint, a phishing attack that captures the user’s password, or a device left unlocked. Those threats live outside the encryption boundary.

The CISA guidance on protecting against cyber attacks covers the layers that encryption cannot address on its own.

what does encrypted email mean in article illustration two

What encrypted email does not protect against

The most common source of an email breach is not intercepted encryption. It is a legitimate account accessed by an attacker after a phishing or credential-stuffing attack.

Encryption does not stop an attacker who logs into the recipient’s mailbox with the correct password. Once inside, the attacker reads decrypted messages in the normal client just like the real user would.

Encryption also does not stop a compromised device from exfiltrating messages. Malware that has taken control of the endpoint reads mail after the client has decrypted it.

Multi-factor authentication, workforce training, and endpoint protection sit alongside encryption in a real security stack. The sibling article what is an encrypted email mean covers the definitional side.

For practices whose email decision is part of a broader security posture, a review of healthcare website security features covers the parallel considerations on the web side.

How the recipient experiences an encrypted email

The recipient experience varies by encryption model. A TLS-encrypted message looks identical to any other email because the encryption is invisible between servers.

An S/MIME message in Outlook shows a small ribbon icon in the message header. Apple Mail on macOS and iOS shows a lock icon. Clients without S/MIME support display the encrypted payload as an attachment they cannot open.

A gateway-encrypted message delivered through a portal arrives as a normal-looking notification email with a link. The recipient clicks the link and signs in with Microsoft, Google, or a one-time passcode to read the message.

The sibling article what does encrypted email look like covers the visual side in more detail. The recipient-side handling question is covered in what happens when I encrypt an email.

[mh_protip]

Compliance frameworks and what they expect encryption to mean

HIPAA requires reasonable safeguards for electronic protected health information. The Security Rule does not mandate a specific encryption algorithm but requires TLS 1.2 or higher for transmission and encryption at rest for stored PHI.

CMMC requires FIPS 140-2 validated cryptographic modules for Controlled Unclassified Information. That is a stricter standard than HIPAA and rules out some consumer-grade encryption implementations.

GDPR requires appropriate technical measures to protect personal data of EU residents. Encryption of email carrying personal data is one of the measures the regulation explicitly names.

Each framework asks a variant of the same question. Is the encryption strong enough, applied consistently, and documented well enough to defend during an audit? The HIPAA Journal breakdown of encryption requirements is a useful reference for the healthcare side.

Practices coordinating email compliance with broader digital operations can align with a healthcare marketing agency so patient-facing channels share the same posture.

Where dedicated compliant services fit

A dedicated compliant email service applies the encryption automatically at the mail gateway, keeps the audit trail, and provides the Business Associate Agreement or equivalent contract in the base plan.

Mailhippo is one example of that model. It works with existing Gmail or Microsoft 365 mailboxes, encrypts every outbound message without requiring the user to click an Encrypt button, and includes the BAA at signup.

That removes the two most common failure modes on user-driven encryption. Staff cannot forget to encrypt a specific message, and the vendor cannot claim it never handled PHI.

The sibling articles what does it mean encrypted email and HIPAA compliant secure email service cover the same territory from adjacent angles.

The short answer for a practice or business owner

Encrypted email means the message content is protected against interception and unauthorized access at one or more points during its lifecycle. The specific meaning depends on the encryption model in use.

TLS between mail servers is the baseline that Gmail and Microsoft 365 already provide. Gateway encryption is the pragmatic layer that adds message-level protection and audit trails. End-to-end encryption is the strictest layer, reserved for the highest-sensitivity content.

A practice deciding which layer it needs starts with the compliance framework, then works backward to the technical setup. Framework first, technology second.

Practices aligning email decisions with the broader digital footprint can review their healthcare digital marketing services so patient outreach, forms, and encrypted communication share a common standard.

[mh_faqs]

Posted on

How to Encrypt Email Across Every Major Provider

how to encrypt email guide featured image

[mh_key_takeaways]

Email encryption looks different in every mail client. The button lives in different menus. The recipient sees a different sign-in flow. The license required to unlock it changes by provider tier.

This guide covers how to encrypt email in Outlook, Gmail, Apple Mail, and Yahoo, plus S/MIME certificate setup and hosted alternatives. Where a healthcare team needs a simpler flow, a dedicated secure email service with a BAA in the base plan removes the license tier and portal steps entirely.

Read the sections in order. Each includes the exact click path, the recipient experience, and the license or certificate required to make it work.

The Three Practical Types of Email Encryption

Every encryption option in a mail client falls into one of three buckets. Knowing the bucket helps predict how the recipient will open the message.

TLS handles server-to-server transit. It runs automatically between providers that support it. The sender takes no action. The recipient sees a normal email in their inbox.

S/MIME and PGP encrypt the message body end to end using certificates or keys installed on each side. Setup is per user. Once configured, the flow is one click.

Portal-based encryption from Microsoft or Google routes the message through a hosted page. The recipient clicks a link and signs in or enters a one-time passcode. This adds friction but works with any recipient regardless of their client.

The right choice depends on who the recipient is and whether both parties can maintain certificates.

Encrypting Email in Outlook Step by Step

Outlook 365 and the New Outlook client both use Microsoft Purview Message Encryption behind the Encrypt button.

Compose a new message. On the ribbon, click the Options tab. Click Encrypt. Choose Encrypt-Only for standard protection or Do Not Forward to block forwarding, copying, and printing.

Add the recipient, subject, and body. Attachments inherit the same protection as the message. Click Send.

The Encrypt button requires Microsoft 365 Business Premium, E3, E5, A3, A5, or G3/G5. Business Basic and Business Standard do not include it. The Purview Message Encryption documentation lists every eligible plan.

External recipients receive a notification email with a portal link. They sign in with Microsoft, Google, or a one-time passcode. Related guide: how to encrypt email in Outlook.

how to encrypt email in article illustration one

Encrypting Email in Gmail and Google Workspace

Gmail offers two encryption paths, each tied to a different plan level.

Confidential Mode is available on all Google accounts, including personal Gmail. In the compose window, click the lock and clock icon at the bottom. Set an expiration date and optional SMS passcode.

Confidential Mode restricts forwarding, copying, and downloading. It does not encrypt the message end to end. Google can still read the content, so it does not meet HIPAA end-to-end requirements on its own.

Hosted S/MIME is available only on Google Workspace Enterprise Plus, Enterprise Standard with add-on, and Education Plus. Admins enable it in the Google Admin console under Apps, Google Workspace, Gmail, User settings.

With hosted S/MIME on, users see a padlock icon in the compose window. Green padlock means encryption is available for the recipient.

Encrypting Email in Apple Mail on macOS and iOS

Apple Mail supports S/MIME natively. Setup happens through Keychain Access.

On macOS, obtain an S/MIME certificate from a public CA or internal PKI. Double-click the .p12 file to import into Keychain. Restart Mail.

When composing a message to a recipient whose public key is in your contacts, a lock icon appears next to the subject line. Click it to toggle encryption on.

On iOS and iPadOS, install the certificate through a configuration profile pushed from an MDM provider or emailed as an attachment. Go to Settings, Mail, Accounts, select the account, then Advanced. Toggle S/MIME on.

Apple Mail S/MIME works only when the recipient also has a certificate installed and their public key is in the sender contact record. Cross-provider encryption to Gmail requires the Gmail recipient to have hosted S/MIME.

[mh_example]

S/MIME Certificate Setup and Exchange

S/MIME needs an X.509 certificate for each user. Certificates come from public CAs like DigiCert, GlobalSign, and Sectigo, or from an internal PKI.

Purchase a personal email certificate matching the user email address. Follow the CA verification steps, which typically involve a validation email and identity check. Download the .p12 or .pfx file.

Install the certificate to the local certificate store on Windows, Keychain on macOS, or the mail client store on mobile. Restart the mail client.

Before the first encrypted send, exchange signed messages with each recipient. Each signed message carries the sender public key, which the recipient client stores in the contact record.

Certificates typically expire after one year. Renewal happens through the CA portal. Expired certificates block new encrypted sends until reissued. Track expirations in a shared calendar.

how to encrypt email in article illustration two

PGP Encryption for Technical Users

PGP is the alternative to S/MIME. It uses key pairs generated locally instead of certificates issued by a CA. Journalists, security researchers, and open-source maintainers use it heavily.

Install GPG Suite on macOS, Gpg4win on Windows, or OpenKeychain on Android. Generate a key pair with a passphrase. Upload the public key to a keyserver like keys.openpgp.org or share it directly with recipients.

Configure the mail client extension. Enigmail for Thunderbird, GPG Mail for Apple Mail, and Mailvelope for browser-based Gmail all handle PGP encryption per message.

PGP has no central authority. Trust builds through key signing and web of trust models. The learning curve is steeper than S/MIME, which is why most business users skip it.

Healthcare senders rarely use PGP because recipients cannot install extensions on hospital systems. S/MIME or hosted encryption fits the workflow better.

What the Recipient Sees on Each Method

Recipient experience predicts adoption. If opening the message is hard, the sender gets a phone call instead of an acknowledgment.

  • TLS encrypted messages appear as normal emails in the inbox. No sign-in step. No portal.
  • S/MIME encrypted messages open directly in the recipient mail client provided their certificate is installed. Otherwise the client shows an encrypted attachment icon and refuses to display the body.
  • Microsoft Purview Message Encryption sends the recipient a notification email with a link. They sign in with Microsoft, Google, or a one-time passcode.
  • Gmail Confidential Mode sends a notification with a Google-hosted link. Non-Gmail recipients enter an SMS passcode if the sender enabled it.
  • A dedicated encrypted email service like Mailhippo delivers messages that open with one click, without portals or passcodes on the recipient side.

Practices whose recipients are older patients or busy referring physicians measure the friction cost carefully. One extra step per message compounds across a caseload.

[mh_protip]

Automatic Encryption Rules for Consistent Compliance

Manual clicking depends on staff remembering to encrypt. Rules take that decision out of the sender workflow.

Exchange Online admins create mail flow rules that trigger on subject keywords, sender group, recipient domain, or content matching a sensitive information type. The rule action applies Office 365 Message Encryption automatically.

Google Workspace admins configure content compliance rules under Apps, Google Workspace, Gmail, Compliance. Conditions include predefined data types for medical record numbers, Social Security numbers, and credit card numbers.

Rules cover the gap when workforce members forget to click Encrypt. They also apply to messages sent from mobile devices that lack a ribbon.

Test each rule against a monitored test mailbox before pushing to production. False positives on internal messages create friction that pushes users to send from personal accounts.

HIPAA Requirements Beyond the Encryption Click

Encryption satisfies one HIPAA Security Rule safeguard. Full compliance requires several more.

The practice signs a business associate agreement with the email provider. Microsoft and Google both offer BAAs on eligible plans. Sign it before sending PHI. The HHS Security Rule guidance covers each safeguard.

Additional obligations include workforce training on PHI handling, audit logging on message access, access controls with unique user IDs, sanction policies for violations, and incident response procedures.

A healthcare practice that clicks Encrypt but leaves the BAA unsigned is not compliant. OCR breach investigations routinely surface this gap.

Practices that also run patient-facing websites face parallel obligations. See HIPAA-compliant healthcare website design for the site-side controls that pair with encrypted email.

When a Dedicated Encrypted Email Service Makes Sense

Native encryption in Outlook and Gmail works well for organizations already on the qualifying license tier with dedicated IT staff. Elsewhere, cost and complexity push practices toward a dedicated service.

Small practices on Business Basic or a starter Workspace plan avoid the per-seat cost jump to unlock encryption. Multi-provider teams running Gmail and Outlook side by side avoid maintaining certificates in two ecosystems.

Mailhippo is a HIPAA-compliant email service that works with existing Gmail and Outlook accounts, includes a business associate agreement in the base plan, and delivers encrypted email to recipients without a portal sign-in. TLS plus client-side encryption cover the transmission safeguard without per-recipient S/MIME certificates.

Related guides: how to encrypt an email across clients, how to send encrypted email, and encrypt email for the terminology overview.

Match the method to the workflow. Native buttons for standardized enterprise tenants. S/MIME for internal certificate-managed teams. A dedicated service for practices that want one-click send and one-click open across every recipient.

[mh_faqs]

Posted on

HIPAA Compliant Email Platforms Compared for Healthcare Practices

hipaa compliant email platforms guide featured image

[mh_key_takeaways]

HIPAA compliant email platforms are mail services that support the required technical safeguards under the Security Rule and where the vendor signs a Business Associate Agreement with the covered entity. That combination is what makes an email service usable for protected health information.

The market includes major cloud providers, dedicated healthcare mail services, and gateway products that layer on top of Gmail or Outlook. This guide compares the practical options against the criteria a healthcare practice actually uses when choosing.

For a portal-based service that works on top of any existing mail provider and includes a BAA in the base plan, Mailhippo offers a HIPAA-focused secure email service designed for this use case.

What Makes an Email Platform HIPAA Compliant

Three components are required. A signed BAA with the vendor. Technical safeguards under the Security Rule. Administrative policies and workforce training.

Technical safeguards include encryption in transit and at rest, access controls, unique user identification, session timeouts, and audit logging. The HHS Security Rule lays out the full list.

Administrative safeguards include a security officer, workforce training, sanctions policy, incident response, and periodic risk assessment. These are practice-level responsibilities that no vendor covers.

Physical safeguards apply to on-premise components. Cloud-first practices with no on-premise servers meet most of these through the vendor data center. Practices with local backup drives or paper printouts still need physical safeguards for those items.

hipaa compliant email platforms in article illustration one

Google Workspace as a HIPAA Compliant Email Platform

Google Workspace supports HIPAA on Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, Education Standard, Education Plus, and Nonprofits.

The admin signs the BAA through the Admin console under Account Settings, Legal and Compliance. Core services covered by the BAA include Gmail, Drive, Calendar, Meet, and Chat. Marketplace add-ons are outside the BAA unless individually BAA-covered.

Confidential mode is not end-to-end encryption. Google holds the keys. For a HIPAA workflow, confidential mode alone is not sufficient. Practices need either hosted S/MIME on Enterprise or a portal gateway.

Hosted S/MIME is available on Enterprise Standard and above. See Google Workspace admin help for the current setup steps. Related linked topic: HIPAA compliant email Gmail.

Microsoft 365 as a HIPAA Compliant Email Platform

Microsoft 365 supports HIPAA on Business Standard, Business Premium, and every Enterprise tier. Business Basic also includes the BAA for covered services but does not include the Encrypt button.

The BAA is signed through the Volume Licensing or Products and Services agreement. Microsoft publishes the covered service list in the HIPAA Implementation Guidance document available in the Microsoft Trust Center.

Microsoft Purview Message Encryption provides the Encrypt button in Outlook. Business Standard and above include the base Purview features. Business Premium adds automatic DLP rules that trigger encryption on sensitive data patterns.

Enterprise E5 adds advanced audit, eDiscovery, and Customer Lockbox. These support the administrative safeguards for larger practices with more complex compliance requirements. Related linked: HIPAA compliant email for a general overview.

[mh_example]

Dedicated HIPAA Email Services

Dedicated HIPAA email services fall into two categories. Standalone mail providers that host the mailbox and deliver a full mail platform. Gateway services that layer on top of Gmail or Outlook.

Standalone providers include some healthcare-focused vendors that offer a hosted mailbox with a BAA. These require MX migration and usually cost more per user than Google Workspace or Microsoft 365.

Gateway services keep the existing mail provider. They add portal-based encrypted delivery for external recipients. Mailhippo is one example. The sender writes in Gmail or Outlook, and the service handles portal encryption when triggered.

Gateway services are the lower-friction choice when the practice does not want to migrate mailboxes. Related linked topic: HIPAA compliant email for therapists for a specialty-specific angle.

hipaa compliant email platforms in article illustration two

Providers That Are Not HIPAA Compliant

Several common providers do not sign BAAs and are not HIPAA-appropriate for PHI. This includes some that many practices assume are safe.

GoDaddy Professional Email does not sign a BAA. Yahoo Mail, personal Gmail, personal Outlook.com, personal iCloud, AOL, and most consumer-focused providers also do not.

Some hosting providers include email as a bundled service. Cheap shared hosting rarely includes a BAA. Practices should confirm the BAA in writing before storing or transmitting PHI on any bundled hosting mailbox.

Common non-compliant providers to watch for:

  • GoDaddy Professional Email
  • Yahoo Mail and Yahoo Mail Plus
  • Personal Gmail, Outlook.com, iCloud Mail
  • AOL Mail
  • Bundled email from shared web hosts
  • Free ProtonMail (paid Business tier does sign a BAA)

Cost of HIPAA Compliant Email Platforms

The cheapest paths start around $12 per user per month. Google Workspace Business Standard runs $12 per user per month with the BAA included. Microsoft 365 Business Standard runs $12.50 per user per month with the BAA included.

Business Premium tiers add automatic DLP encryption and more advanced audit. Google Workspace Business Plus runs about $18 per user per month. Microsoft 365 Business Premium runs about $22 per user per month.

Enterprise tiers add hosted S/MIME, advanced audit, and Customer Lockbox. Google Workspace Enterprise Standard runs about $23 per user per month. Microsoft 365 E5 runs about $57 per user per month.

Gateway services add roughly $5 to $10 per user per month on top of the base provider. For a five-user practice on Business Standard plus a gateway, the total is roughly $85 to $110 per month. Related linked: free HIPAA compliant email for a look at the limits of free options.

[mh_protip]

Feature Comparison Across the Main Platforms

The table below compares the platforms most practices consider.

Platform BAA Included Native Encryption S/MIME Automatic DLP Base Price
Google Workspace Business Standard Yes Confidential mode No No $12 per user per month
Google Workspace Enterprise Standard Yes Confidential mode plus S/MIME Yes Yes $23 per user per month
Microsoft 365 Business Standard Yes Purview Encrypt button Yes with certificate No $12.50 per user per month
Microsoft 365 Business Premium Yes Purview plus DLP Yes Yes $22 per user per month
Mailhippo gateway Yes in base plan Portal encryption Not required Trigger word or plugin Sits on top of existing mail
GoDaddy Professional Email No None No No Not for PHI

Migration Steps When Moving to a HIPAA Compliant Platform

Migration follows a standard sequence. Sign the BAA with the new provider first. This creates the legal cover before any PHI moves.

Configure the tenant. Add users. Set retention. Enable audit logging. Configure encryption defaults. Enable MFA on all accounts.

Migrate mail. Google Workspace has a Data Migration Service that pulls IMAP mail from the old provider. Microsoft 365 has a similar migration wizard in the Exchange admin center. Both take hours to days depending on volume.

Cut over MX records after the migration completes. Update transactional mail sources like the practice management system, EHR, and appointment reminder services. Train staff on the new client and the encryption workflow. Related: HIPAA-conscious website design for practices also refreshing their public site.

Choosing the Right Platform for Your Practice

The right platform depends on three inputs. Where the practice already runs. How technical the recipient set is. Whether hosted S/MIME is a real requirement.

Practices on Windows with Active Directory usually stay with Microsoft 365. Business Standard covers the base HIPAA use. Business Premium adds automatic DLP for the extra assurance that PHI never sends unencrypted.

Practices on Mac or with Chrome-heavy workflows usually stay with Google Workspace. Business Standard covers the base HIPAA use. Adding a gateway service is usually cheaper than upgrading to Enterprise Standard for hosted S/MIME.

Mailhippo operates as the gateway option across both Google Workspace and Microsoft 365. It includes a BAA in the base plan, requires no per-user certificate management, and works uniformly on desktop and mobile. Practices building a public site alongside their email program can pair this with healthcare web design so the whole intake, contact, and email chain stays inside the same compliance boundary. Related linked topics: best HIPAA compliant email and HIPAA compliant emails for further reading.

[mh_faqs]

2637 E. Atlantic Blvd.
#1063 Pompano Beach, FL 33062

© 2026 MailHippo, Inc.

View our Privacy Policy or contact our Customer Service team.

Optometrist Marketing Agency – Web Design, SEO, PPC & Maintenance