HorizLogoSm.fw_.png
Start Trial

Tag: microsoft 365

Posted on

How to Remove Encryption From Outlook Email in 2026

how to remove encryption from outlook email guide featured image

[mh_key_takeaways]

Removing encryption from an Outlook email sounds like a one-click task. In practice the steps depend on which layer of the Microsoft encryption stack applied the encryption in the first place.

Outlook uses three separate encryption layers. Microsoft Purview Message Encryption at the tenant policy layer, S/MIME at the per-message certificate layer, and Information Rights Management at the sensitivity label layer. Each layer has its own removal path. Users trying to manage encrypted email across a mixed environment need to know all three.

This guide walks through removing encryption from an outbound message before you send it, from a received message so you can reuse the content, and from tenant policy when an admin needs to shut off automatic encryption on a specific rule.

Identifying which Outlook encryption layer applied to a message

Open the message. Click the ellipsis or three-dot menu. Choose Message Options or Properties, depending on the Outlook version.

The Properties dialog shows the message class. rpmsg indicates Purview Message Encryption. IPM.Note.SMIME indicates S/MIME. The Sensitivity field shows any active IRM label. This one dialog answers most encryption-source questions in under a minute.

Once you know the layer, you know the removal path. Purview Message Encryption removes at the Encrypt button on the Options ribbon or through a tenant mail flow rule change. S/MIME removes through the Encryption toggle in the Options ribbon. IRM labels remove through the Sensitivity dropdown near the message subject line.

Users who skip the identification step end up clicking every toggle they can find. The wrong toggle often does nothing because it addresses a different layer than the one applying encryption.

Removing encryption from an outbound Outlook message on desktop

Compose the message as usual. Go to the Options ribbon at the top of the composer window. The Encrypt button lives in the Permission group near the middle of the ribbon.

Click the Encrypt button. If encryption was on, the button toggles off and the shield icon disappears from the composer. If the button opens a dropdown, choose No Encryption at the top of the list.

Send the message. The recipient receives the message without any portal link or password step. Verify by checking the sent copy in the Sent Items folder and reviewing the message class in Properties.

If the Encrypt button is grayed out, a tenant mail flow rule is enforcing encryption based on recipient domain, subject line keyword, or content pattern. The user cannot override the rule. Contact the tenant admin or route the message through how to encrypt email from outlook alternative flows if a genuine business need exists.

how to remove encryption from outlook email in article illustration one

Removing encryption from an outbound Outlook message on web

Outlook web uses a slightly different navigation. Compose the message. Click the three-dot menu at the top of the composer, next to the Send button.

Choose Encrypt from the dropdown. A submenu opens with encryption options. Select No Encryption or click the current option again to toggle it off.

Outlook web shows a lock icon at the top of the composer when encryption is active. The icon disappears after you toggle encryption off. Send the message when the icon is gone.

Outlook web hides some encryption options behind the plan tier. Business Basic users see fewer options than Business Premium users. Enterprise E5 users see the most options because Purview features are all included. Reference the current option matrix at Microsoft Learn Purview Message Encryption.

Removing encryption from an outbound Outlook message on mobile

The Outlook mobile app on iOS and Android places the encryption toggle inside the ellipsis menu of the composer. Tap the ellipsis to open the extended menu.

Tap Encrypt Message. A screen appears with the current encryption setting. Choose No Encryption and tap the back arrow to return to the composer.

The lock icon in the composer header disappears when encryption is off. Send the message from the mobile composer. The recipient receives an unencrypted message that opens in any mail client.

Users on personal iPhones sending occasional PHI often struggle with the mobile encryption workflow. A dedicated app like how to encrypt email from iphone guide setups or a service like Mailhippo simplifies the mobile case without requiring native Outlook encryption at all.

[mh_example]

Removing encryption from a received Outlook message

You cannot un-encrypt a message the sender encrypted. Outlook decrypts the message for display, but the encrypted copy stays in the mailbox database.

The workaround is to reply or forward without encryption when the sender policy allows. Open the message. Click Reply or Forward. Check the composer for the encryption toggle and turn it off if it appears.

Some sender policies apply Do Not Forward or block copy and paste at the label level. In that case the received message cannot be extracted at all. Reach out to the sender and ask them to resend without the restrictive label.

For content you need to move to another system, select all text in the decrypted view, copy, and paste into a fresh unencrypted message. Attachments require a separate step because Outlook often keeps attachments encrypted even when the body decrypts.

Removing encryption from Office 365 mail flow rules as an admin

Sign in to the Exchange admin center at admin.exchange.microsoft.com. Open Mail Flow, then Rules.

Review each rule in the list. Rules that apply encryption usually have Apply Office 365 Message Encryption or Apply RMS Template in the action list. Note the rule name and business owner before making any change.

To disable a rule, toggle the Enabled switch to off. To delete a rule, use the three-dot menu and choose Delete. Test the change on a pilot mailbox first. Send five test messages that would have matched the rule and confirm they arrive without encryption.

Common admin steps:

  • Document the business reason for removing the rule
  • Notify the privacy officer if the rule protected PHI
  • Set a change ticket in the tenant change log
  • Wait 30 minutes after disabling before testing
  • Keep an export of the rule XML for rollback
how to remove encryption from outlook email in article illustration two

Removing encryption from an Office 365 sensitivity label

Sensitivity labels in Microsoft Purview apply encryption at the label level. A message tagged with a Confidential label carries encryption for the life of the message.

To remove encryption from a specific label, sign in to purview.microsoft.com. Open Information Protection, then Labels. Select the label. Click Edit Label.

In the encryption settings step, choose None. Save the change. New messages tagged with the label send without encryption. Existing messages already sent with the label keep their encryption because the metadata was baked in at send time.

Removing encryption from a label affects every user who applies that label. Rename the label to avoid user confusion. A label named Confidential that no longer encrypts creates trust issues with the privacy officer and the audit team.

Removing S/MIME encryption in Outlook desktop

S/MIME encryption relies on a certificate installed on the sender machine. The certificate applies encryption per message through the Trust Center settings.

To turn off S/MIME on a single message, open the composer and go to Options, More Options, Security Settings. Uncheck Encrypt Message Contents and Attachments. Send the message without S/MIME encryption.

To turn off S/MIME across all outbound messages, go to File, Options, Trust Center, Trust Center Settings, Email Security. Uncheck Encrypt Contents and Attachments for Outgoing Messages. Click OK.

Removing the S/MIME certificate entirely happens in the Windows certificate store. Type certmgr.msc in the Run dialog. Open Personal, Certificates. Delete the S/MIME certificate. Deleting the certificate also breaks decryption of past S/MIME messages, so export a backup first.

[mh_protip]

Removing encryption from Outlook messages in bulk

Outlook has no built-in bulk decrypt feature. Third party tools claim to bulk decrypt, but most require the sender private key and produce plaintext exports rather than in-place changes.

The supported path for bulk access uses eDiscovery in the Purview compliance portal. Create a content search that includes the target mailboxes. Export the results as a PST with the Include All Encrypted Messages option checked.

The exported PST contains decrypted copies of every message the running admin has permission to read. Import the PST into the destination mailbox using the Outlook Import feature. The imported copies are unencrypted.

Use this pattern for legal hold, migration, or forensic review only. Bulk decryption for general access defeats the point of the encryption in the first place. Reference guidance from HHS HIPAA Security Rule before running bulk decryption on any mailbox with PHI.

Common Outlook encryption removal errors and fixes

The Encrypt button stays selected even after you click it. Usually a mail flow rule is forcing encryption at the tenant. Check with the admin.

The message arrives at the recipient with the encryption warning banner even though you removed encryption. The recipient mail server flagged the message as suspicious because the sender IP does not match the tenant SPF record. Fix the SPF record.

Attachments still open with a password prompt. Purview Message Encryption applies to attachments through the same policy. Removing encryption from the body does not automatically release the attachments. Re-attach the files after removing encryption to reset the attachment state.

The recipient sees a portal link instead of the message body. The recipient mail client stripped the message body during transport. Check the recipient inbox rules and any downstream security gateways.

When to keep Outlook encryption on and route around it instead

Removing encryption from healthcare, financial, or legal correspondence creates compliance exposure. HIPAA, GLBA, and state privacy laws require encryption of regulated content in transit.

Practices with intermittent encryption needs often benefit from a per-message alternative rather than a permanent policy change. How to send encrypted email guides and services like Mailhippo work alongside Outlook without replacing the native stack.

Mailhippo adds a per-message send option to Outlook. When the sender needs encryption for a specific message, the Mailhippo option applies encryption and a BAA-covered delivery path. When the sender does not need encryption, the message goes out through normal Outlook without any policy conflict. Practices also handling healthcare web hosting and healthcare website maintenance pair the same discipline across their web and email stacks.

For further reference, review CISA cybersecurity advisories on message encryption baselines and the HIPAA Journal on compliant email before making any tenant-level encryption change that affects regulated traffic.

[mh_faqs]

Posted on

Encrypted Email Microsoft 365 Setup Guide for 2026

encrypted email microsoft 365 guide featured image

[mh_key_takeaways]

Encrypted email on Microsoft 365 uses Microsoft Purview Message Encryption behind the scenes. The service ships with Business Premium, E3, E5, and F3 plans at no extra cost.

Practices sending PHI to patients or vendors need three things in place. A qualifying license, a signed business associate agreement with Microsoft, and a published sensitivity label that maps to an encryption template. Once those three exist, users see the Encrypt button in Outlook and can send encrypted email from any device.

This guide walks through the setup steps, the license comparison, the sender experience across desktop, web, and mobile, and where the portal-based delivery step creates friction for high-volume patient communication.

Encrypted email Microsoft 365 licensing landscape

Purview Message Encryption ships with Business Premium at $22 per user per month, E3 at $36, E5 at $57, and Frontline F3 at $8. Business Basic at $6 and Business Standard at $12.50 do not include the Encrypt button.

Practices on Basic or Standard have two upgrade paths. Move the tenant to Business Premium for the full compliance stack. Add the Microsoft 365 E3 Compliance add-on at $12 per user per month to gain Purview without paying for Business Premium features the practice does not use.

Nonprofits get 30 to 75 percent off list on every plan through the Microsoft Nonprofits program. Business Premium runs about $5.50 for verified nonprofits. Documentation lives at Microsoft Nonprofits portal.

Confirm the license status in the Microsoft 365 admin center under Billing, Licenses. See Microsoft 365 email encryption setup for the regional configuration walkthrough.

Business associate agreement for encrypted email Microsoft 365

Microsoft signs a business associate agreement with covered entities on qualifying paid plans. The BAA covers Exchange Online, SharePoint Online, OneDrive, Teams, and Purview.

Administrators accept the BAA in the Microsoft 365 admin center. Open Billing, Your Products, then click the Terms link on the eligible plan. Read the BAA in full and click Accept. The tenant is HIPAA-eligible immediately after acceptance.

The BAA does not cover any consumer Outlook.com account or any free Microsoft account. Verify the tenant type in the admin console before treating any mailbox as HIPAA-eligible.

After BAA acceptance, configure the required admin settings. Enable multi-factor authentication for every user. Turn on audit logging in the compliance portal. Set retention that meets the six-year Privacy Rule requirement. Reference the sample BAA at HHS sample BAA provisions.

encrypted email microsoft 365 in article illustration one

Enabling Microsoft 365 email encryption with Microsoft Purview

Sign in to compliance.microsoft.com with a global admin or compliance admin account. Open Information Protection, then Labels.

Click Create Label. Give the label a display name like Confidential, add a description, and pick a color. On the encryption step, choose Assign Permissions Now.

Configure the permission block. Add users or groups, set the permission level, and save the encryption settings. Publish the label to the tenant. Users see the Encrypt button in Outlook after publication.

Test on a pilot user before rolling to production. Send a message from the pilot mailbox to an external Gmail address and confirm the recipient gets the portal notification. Reference Microsoft Purview email encryption for the deep configuration walkthrough.

Sending encrypted email from desktop Outlook

Compose the message. Go to the Options ribbon at the top of the composer window. The Encrypt button lives in the Permission group in the middle of the ribbon.

Click Encrypt. A dropdown appears with the available permission templates. Pick Encrypt for basic encryption or Do Not Forward for stronger controls that block forwarding and printing.

The composer displays a lock icon at the top and a permission banner near the subject line. Send the message. External recipients get a notification email with a portal link.

If the Encrypt button is grayed out, the tenant does not have a published sensitivity label yet. Check with the admin. See encrypt email Microsoft Outlook for the full sender walkthrough.

[mh_example]

Sending encrypted email from Outlook web

Sign in to outlook.office.com. Compose the message as usual. Click the three-dot menu at the top of the composer, next to the Send button.

Choose Encrypt from the dropdown. A submenu opens with the available permission templates. Pick Encrypt or Do Not Forward. The composer shows a lock icon and a permission banner at the top.

Send the message. The recipient experience matches desktop Outlook. External recipients get a notification email with a portal link.

Outlook web sometimes hides advanced permission templates behind the tenant plan tier. Enterprise E5 tenants see every option. Business Premium tenants see the default four. See Microsoft Outlook 365 encrypt email for the tier-by-tier feature matrix.

encrypted email microsoft 365 in article illustration two

Sending encrypted email from Outlook mobile

The Outlook mobile app on iOS and Android places the encryption toggle inside the ellipsis menu of the composer. Tap the ellipsis to open the extended menu.

Tap Encrypt Message. A screen appears with the available permission templates. Pick the template and tap the back arrow to return to the composer.

The lock icon in the composer header confirms encryption is active. Send the message from the mobile composer. The recipient experience matches desktop and web.

Users on personal iPhones sending occasional PHI often struggle with the mobile encryption workflow because the ellipsis menu is not obvious. Train users on the workflow before rollout. Screenshots in the training material help far more than a written procedure.

Recipient experience for Microsoft 365 encrypted email

External recipients get a notification email with a portal link. The notification email includes the sender name, subject line, and a button that opens the portal.

Recipients sign in with Microsoft, Google, or a one-time passcode. The Microsoft option works for anyone with a Microsoft account. The Google option works for anyone with a Google account. The one-time passcode works for anyone else.

Reply from the portal stays encrypted. The reply routes back through Microsoft servers and lands in the original sender inbox as a normal encrypted message.

The friction of the portal step drops adoption. Practices sending 200 patient messages per week often see 30 to 50 first-time recipients need help with the portal. Support ticket volume tracks directly to the portal experience.

[mh_protip]

S/MIME as an alternative encrypted email path on Microsoft 365

S/MIME encryption sits alongside Purview Message Encryption in Microsoft 365. S/MIME uses certificates installed on the sender and recipient devices.

Configuring S/MIME in Microsoft 365 requires the admin to upload the certificate authority chain to the Exchange admin center. Users install their personal certificate in the Windows certificate store or the Outlook mobile app.

S/MIME provides stronger cryptographic guarantees than Purview because the message content decrypts only on the recipient device. Microsoft servers never see the plaintext.

The tradeoff is setup complexity. Most healthcare practices skip S/MIME because patients cannot install certificates. Reference the current S/MIME setup path at Microsoft Learn S/MIME configuration.

Common Microsoft 365 encrypted email problems and fixes

The Encrypt button is grayed out. The tenant does not have a published sensitivity label with encryption enabled, or the user account does not have a Purview-eligible license.

The recipient gets a portal link but cannot log in. The one-time passcode option ships to the same email address the notification came to. Ask the recipient to check the inbox for the passcode message and to check spam if the passcode does not appear.

Attachments open with a permissions error. The permission template applied to the message restricts attachments. Change the template to Encrypt without additional restrictions.

Common troubleshooting checklist:

  • Confirm the license includes Purview Message Encryption
  • Confirm the BAA is accepted in the admin center
  • Confirm at least one sensitivity label is published with encryption
  • Confirm the Outlook client version is current
  • Confirm the recipient inbox is not blocking the portal notification domain

When to layer a zero-step alternative on top of Microsoft 365

Practices with heavy external patient mail volume often outgrow the Purview portal experience. Support ticket volume from patients who cannot log in to the portal starts to eat into clinical time.

A zero-step encryption service like Mailhippo works alongside Microsoft 365. Purview handles internal traffic between mailboxes on the tenant. Mailhippo handles external mail to patients and vendors without a portal step. The two services coexist without a routing conflict.

Practices running HIPAA compliant website design already understand the reasonable and appropriate standard. Applying the same standard to email means picking the tool that keeps compliance tight while dropping recipient friction. See also security features for healthcare websites for the parallel web guidance.

For further reference, review Microsoft Learn Purview Message Encryption, the HHS HIPAA Security Rule, and the HIPAA Journal guide to compliant email before finalizing the Microsoft 365 encrypted email stack. See also Microsoft email encryption and Microsoft Office 365 email encryption for related walkthroughs. See the Mailhippo secure email service overview for the zero-step alternative details.

[mh_faqs]

Posted on

HIPAA Compliant Email Platforms Compared for Healthcare Practices

hipaa compliant email platforms guide featured image

[mh_key_takeaways]

HIPAA compliant email platforms are mail services that support the required technical safeguards under the Security Rule and where the vendor signs a Business Associate Agreement with the covered entity. That combination is what makes an email service usable for protected health information.

The market includes major cloud providers, dedicated healthcare mail services, and gateway products that layer on top of Gmail or Outlook. This guide compares the practical options against the criteria a healthcare practice actually uses when choosing.

For a portal-based service that works on top of any existing mail provider and includes a BAA in the base plan, Mailhippo offers a HIPAA-focused secure email service designed for this use case.

What Makes an Email Platform HIPAA Compliant

Three components are required. A signed BAA with the vendor. Technical safeguards under the Security Rule. Administrative policies and workforce training.

Technical safeguards include encryption in transit and at rest, access controls, unique user identification, session timeouts, and audit logging. The HHS Security Rule lays out the full list.

Administrative safeguards include a security officer, workforce training, sanctions policy, incident response, and periodic risk assessment. These are practice-level responsibilities that no vendor covers.

Physical safeguards apply to on-premise components. Cloud-first practices with no on-premise servers meet most of these through the vendor data center. Practices with local backup drives or paper printouts still need physical safeguards for those items.

hipaa compliant email platforms in article illustration one

Google Workspace as a HIPAA Compliant Email Platform

Google Workspace supports HIPAA on Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, Education Standard, Education Plus, and Nonprofits.

The admin signs the BAA through the Admin console under Account Settings, Legal and Compliance. Core services covered by the BAA include Gmail, Drive, Calendar, Meet, and Chat. Marketplace add-ons are outside the BAA unless individually BAA-covered.

Confidential mode is not end-to-end encryption. Google holds the keys. For a HIPAA workflow, confidential mode alone is not sufficient. Practices need either hosted S/MIME on Enterprise or a portal gateway.

Hosted S/MIME is available on Enterprise Standard and above. See Google Workspace admin help for the current setup steps. Related linked topic: HIPAA compliant email Gmail.

Microsoft 365 as a HIPAA Compliant Email Platform

Microsoft 365 supports HIPAA on Business Standard, Business Premium, and every Enterprise tier. Business Basic also includes the BAA for covered services but does not include the Encrypt button.

The BAA is signed through the Volume Licensing or Products and Services agreement. Microsoft publishes the covered service list in the HIPAA Implementation Guidance document available in the Microsoft Trust Center.

Microsoft Purview Message Encryption provides the Encrypt button in Outlook. Business Standard and above include the base Purview features. Business Premium adds automatic DLP rules that trigger encryption on sensitive data patterns.

Enterprise E5 adds advanced audit, eDiscovery, and Customer Lockbox. These support the administrative safeguards for larger practices with more complex compliance requirements. Related linked: HIPAA compliant email for a general overview.

[mh_example]

Dedicated HIPAA Email Services

Dedicated HIPAA email services fall into two categories. Standalone mail providers that host the mailbox and deliver a full mail platform. Gateway services that layer on top of Gmail or Outlook.

Standalone providers include some healthcare-focused vendors that offer a hosted mailbox with a BAA. These require MX migration and usually cost more per user than Google Workspace or Microsoft 365.

Gateway services keep the existing mail provider. They add portal-based encrypted delivery for external recipients. Mailhippo is one example. The sender writes in Gmail or Outlook, and the service handles portal encryption when triggered.

Gateway services are the lower-friction choice when the practice does not want to migrate mailboxes. Related linked topic: HIPAA compliant email for therapists for a specialty-specific angle.

hipaa compliant email platforms in article illustration two

Providers That Are Not HIPAA Compliant

Several common providers do not sign BAAs and are not HIPAA-appropriate for PHI. This includes some that many practices assume are safe.

GoDaddy Professional Email does not sign a BAA. Yahoo Mail, personal Gmail, personal Outlook.com, personal iCloud, AOL, and most consumer-focused providers also do not.

Some hosting providers include email as a bundled service. Cheap shared hosting rarely includes a BAA. Practices should confirm the BAA in writing before storing or transmitting PHI on any bundled hosting mailbox.

Common non-compliant providers to watch for:

  • GoDaddy Professional Email
  • Yahoo Mail and Yahoo Mail Plus
  • Personal Gmail, Outlook.com, iCloud Mail
  • AOL Mail
  • Bundled email from shared web hosts
  • Free ProtonMail (paid Business tier does sign a BAA)

Cost of HIPAA Compliant Email Platforms

The cheapest paths start around $12 per user per month. Google Workspace Business Standard runs $12 per user per month with the BAA included. Microsoft 365 Business Standard runs $12.50 per user per month with the BAA included.

Business Premium tiers add automatic DLP encryption and more advanced audit. Google Workspace Business Plus runs about $18 per user per month. Microsoft 365 Business Premium runs about $22 per user per month.

Enterprise tiers add hosted S/MIME, advanced audit, and Customer Lockbox. Google Workspace Enterprise Standard runs about $23 per user per month. Microsoft 365 E5 runs about $57 per user per month.

Gateway services add roughly $5 to $10 per user per month on top of the base provider. For a five-user practice on Business Standard plus a gateway, the total is roughly $85 to $110 per month. Related linked: free HIPAA compliant email for a look at the limits of free options.

[mh_protip]

Feature Comparison Across the Main Platforms

The table below compares the platforms most practices consider.

Platform BAA Included Native Encryption S/MIME Automatic DLP Base Price
Google Workspace Business Standard Yes Confidential mode No No $12 per user per month
Google Workspace Enterprise Standard Yes Confidential mode plus S/MIME Yes Yes $23 per user per month
Microsoft 365 Business Standard Yes Purview Encrypt button Yes with certificate No $12.50 per user per month
Microsoft 365 Business Premium Yes Purview plus DLP Yes Yes $22 per user per month
Mailhippo gateway Yes in base plan Portal encryption Not required Trigger word or plugin Sits on top of existing mail
GoDaddy Professional Email No None No No Not for PHI

Migration Steps When Moving to a HIPAA Compliant Platform

Migration follows a standard sequence. Sign the BAA with the new provider first. This creates the legal cover before any PHI moves.

Configure the tenant. Add users. Set retention. Enable audit logging. Configure encryption defaults. Enable MFA on all accounts.

Migrate mail. Google Workspace has a Data Migration Service that pulls IMAP mail from the old provider. Microsoft 365 has a similar migration wizard in the Exchange admin center. Both take hours to days depending on volume.

Cut over MX records after the migration completes. Update transactional mail sources like the practice management system, EHR, and appointment reminder services. Train staff on the new client and the encryption workflow. Related: HIPAA-conscious website design for practices also refreshing their public site.

Choosing the Right Platform for Your Practice

The right platform depends on three inputs. Where the practice already runs. How technical the recipient set is. Whether hosted S/MIME is a real requirement.

Practices on Windows with Active Directory usually stay with Microsoft 365. Business Standard covers the base HIPAA use. Business Premium adds automatic DLP for the extra assurance that PHI never sends unencrypted.

Practices on Mac or with Chrome-heavy workflows usually stay with Google Workspace. Business Standard covers the base HIPAA use. Adding a gateway service is usually cheaper than upgrading to Enterprise Standard for hosted S/MIME.

Mailhippo operates as the gateway option across both Google Workspace and Microsoft 365. It includes a BAA in the base plan, requires no per-user certificate management, and works uniformly on desktop and mobile. Practices building a public site alongside their email program can pair this with healthcare web design so the whole intake, contact, and email chain stays inside the same compliance boundary. Related linked topics: best HIPAA compliant email and HIPAA compliant emails for further reading.

[mh_faqs]

Posted on

Encrypting Emails in Outlook

encrypting emails in outlook guide featured image

[mh_key_takeaways]

Outlook supports three encryption paths. The Encrypt button, S/MIME certificates, and layered third-party services. Each has a specific plan requirement and a specific recipient experience.

For healthcare organizations and any team handling regulated data, encrypting emails in Outlook means matching the method to the license, the recipient, and the compliance requirement.

This guide covers the setup for Outlook desktop and Outlook on the web across the main Microsoft 365 tiers.

The Encrypt Button Uses Microsoft Purview Message Encryption

The Encrypt button in the Outlook Options ribbon triggers Microsoft Purview Message Encryption. This is the native Microsoft option for sending encrypted mail to recipients outside the sender tenant.

The button appears on Microsoft 365 Business Premium, Enterprise E3, Enterprise E5, and comparable Education plans. It does not appear on Business Basic or Business Standard because those tiers do not include Purview Message Encryption.

If the tenant is on a qualifying plan and the button is missing, an administrator needs to enable Azure Rights Management under the Microsoft 365 Admin Center. Once activated, the Encrypt button appears in Outlook within a few minutes.

According to Microsoft documentation, Purview Message Encryption meets HIPAA transmission requirements when combined with a signed BAA available on qualifying Microsoft 365 tiers.

Encrypt-Only and Do Not Forward Provide Different Levels of Control

Clicking the Encrypt button opens a dropdown with two main options. Encrypt-Only sends the message with encryption in transit and at rest. Do Not Forward adds rights-management controls that block the recipient from forwarding, copying, or printing.

Encrypt-Only is appropriate when the sender trusts the recipient to handle the message responsibly but wants to protect it from network interception and mailbox compromise. The recipient can forward it to others once they read it, in encrypted form.

Do Not Forward is stronger when the sender wants to limit downstream distribution. The rights-management layer prevents the recipient from forwarding or exporting the content. Screenshots still work, but the automated actions are blocked.

For HIPAA and regulated content, Encrypt-Only meets the transmission standard. Do Not Forward adds a layer of downstream control that is optional under HIPAA but often used as a matter of practice policy.

encrypting emails in outlook in article illustration one

Encrypt Button Step-by-Step in Outlook Desktop

Open Outlook desktop and click New Email. Fill in the recipient, subject, and body as usual. Click the Options tab in the ribbon.

Click Encrypt in the ribbon. A dropdown appears with Encrypt-Only and Do Not Forward. Select the option that matches the message. A banner appears at the top of the message confirming the selected encryption.

Click Send. Outlook encrypts the message through Microsoft Purview and delivers it to the recipient. Internal recipients on the same tenant see it inline in Outlook. External recipients receive a portal link.

  • The banner in the compose window confirms which encryption level is applied.
  • To remove encryption before sending, click Encrypt again and select the same option to toggle off.
  • The Sent folder shows a lock icon on the encrypted message.

Encrypt Button Step-by-Step in Outlook on the Web

Open Outlook on the web and click New Message. Fill in the recipient, subject, and body. Click the three-dot overflow menu at the top of the compose window.

Select Encrypt from the menu. A banner appears at the top of the message with the selected encryption level. The default is Encrypt-Only. To switch to Do Not Forward, click Change Permissions in the banner.

Click Send. The message is encrypted through Microsoft Purview and delivered. Internal recipients on the same tenant read it inline. External recipients on Gmail, Yahoo, iCloud, or other providers receive a link to the Microsoft portal.

If the Encrypt option does not appear in the overflow menu, the tenant has not enabled Purview Message Encryption. An administrator needs to activate it in the Microsoft 365 Admin Center before the option becomes visible.

[mh_example]

S/MIME Setup for Outlook Desktop

S/MIME is the certificate-based encryption standard built into Outlook. It provides end-to-end encryption between sender and recipient without a portal step. Both parties need certificates from a trusted authority.

Get a certificate from DigiCert, Sectigo, IdenTrust, or another trusted authority. The authority delivers a .pfx file containing the public certificate and private key. Import the file into the Windows certificate store on Windows or the macOS keychain on Mac.

Open Outlook and navigate to File, Options, Trust Center, Trust Center Settings, Email Security. Click Settings under Encrypted email. In the dialog, select the certificate for signing and encryption from the dropdown. Click OK and restart Outlook.

When composing a message, click Options, then click Sign and Encrypt icons in the More Options section. If the recipient has a valid S/MIME certificate that Outlook can verify, the encrypted send works. If not, Outlook prompts to send unencrypted.

encrypting emails in outlook in article illustration two

HIPAA Coverage in Microsoft 365 Has Boundaries

Microsoft signs a business associate agreement covering Microsoft 365 core services, including Exchange Online, when the tenant has accepted the BAA under the Microsoft Trust Center. The BAA covers the transmission and storage of PHI in Outlook.

The sender remains responsible for enabling encryption on every PHI transmission. The BAA does not automatically encrypt every message. Sending a PHI message without clicking Encrypt still results in transmission over TLS or plaintext, which does not meet the HIPAA transmission standard for regulated data.

For consistent enforcement, administrators can configure a data loss prevention rule under the Microsoft 365 Purview compliance portal that scans outbound messages for regulated patterns and applies encryption automatically. This is not enabled out of the box.

For practices on Business Basic or Business Standard without Purview Message Encryption, the practical path is a layered encrypted email service. This pairs with broader work covered in healthcare website security features.

Recipient Experience Depends on Their Mail Provider

Recipients on the same Microsoft 365 tenant see the message inline in Outlook or Outlook on the web. They do not click a portal link. The message opens like any other, with a lock icon indicating encryption.

Gmail users get a notification email with a link. They click the link and either sign in with their Google account or request a one-time passcode by email. They read the message in a Microsoft portal in their browser.

Yahoo, iCloud, AOL, and other recipients receive a one-time passcode by email and view the message in the Microsoft portal. They cannot sign in with their mail provider because those providers do not federate with Microsoft identity services.

Test the workflow with a known recipient before relying on it for time-sensitive delivery. Some corporate mail gateways strip the notification link or block the Microsoft portal domain. Testing surfaces those issues before the first real send.

[mh_protip]

Third-Party Services Close the Gap on Lower Microsoft 365 Tiers

Microsoft 365 Business Basic and Business Standard tenants do not have the Encrypt button. Upgrading every seat to Business Premium for the encryption feature is often more expensive than adding a purpose-built encrypted email service.

Mailhippo integrates with any Outlook or Microsoft 365 account through SMTP relay or a plug-in. The sender continues to write and send from Outlook. The service intercepts the message, encrypts it, and delivers over TLS or through a portal fallback.

The service includes a signed BAA in the base plan and logs every message access. The recipient experience is a single click and passcode. No key management, no software install for the recipient.

For healthcare organizations coordinating email with website work, this pairs with services covered in healthcare marketing.

Verify Encryption on Every Sensitive Send

Before hitting Send on a regulated message, verify the encryption is active. In Outlook desktop, the banner at the top of the compose window shows Encrypt-Only or Do Not Forward. In Outlook on the web, the same banner appears.

For S/MIME, the Sign and Encrypt buttons in the Options ribbon show as active. The message icon in the Sent folder shows a lock. If the message went out without those indicators, encryption did not apply.

Microsoft 365 administrators can audit encryption status in the Purview compliance portal under Message Trace. This shows every outbound message with its encryption status, useful for HIPAA risk assessments and periodic compliance reviews.

According to HIPAA Journal, the most common documented compliance failure is a sender forgetting to enable encryption on a PHI message. Verification per send is the single most effective preventive control.

Choose the Outlook Path Based on Plan and Recipient

Match the encryption approach to the Microsoft 365 tier and the target recipient. Business Premium and above have the Encrypt button for a Microsoft-native experience. Business Basic and Business Standard need either an upgrade or a layered service.

  • Business Premium or higher, external recipients: Encrypt button with Purview Message Encryption.
  • Any tier, internal certified users: S/MIME with corporate certificates.
  • Business Basic or Business Standard, external recipients: layered HIPAA-compliant service.
  • Any tier, mixed compliance needs, patients as recipients: layered service with portal fallback.

For deeper coverage on related methods, see the sibling guides encrypting email in Outlook, encrypting an email, and how to open encrypted emails in Outlook.

The final point is that Outlook makes encryption easy on the right plan and unavailable on the wrong plan. Match the tool to the tier, and verify every sensitive send.

[mh_faqs]

Posted on

Office 365 Email Encryption Setup and HIPAA Configuration

office 365 email encryption guide featured image

[mh_key_takeaways]

Office 365 email encryption runs on Microsoft Purview Message Encryption. The service ships with Business Premium and higher plans. It powers the Encrypt button in the Outlook ribbon and handles external recipient delivery through a browser portal.

This guide covers the Office 365 email encryption setup, the license structure, the recipient experience, and the HIPAA configuration. It also covers the fit for a separate encrypted email service when the Office 365 plan does not include the Encrypt button.

The choice depends on plan level, seat count, and how many staff need to send PHI. Read each section and match the approach to the actual practice flow.

Purview Message Encryption Powers the Encrypt Button

Microsoft Purview Message Encryption is the underlying service for the Encrypt button in Outlook. The button appears in the Options ribbon on new messages. Users click Encrypt and pick Encrypt-Only or Do Not Forward.

Encrypt-Only encrypts the message content in transit and at rest. Recipients can reply, forward, and print. Do Not Forward applies rights management and blocks forward, print, and download. The sender picks based on the sensitivity of the content.

Both options deliver to internal Microsoft 365 recipients inline. Both options deliver to external recipients through a notification email with a browser tab open on outlook.office365.com. The recipient experience is consistent across the two options.

Detailed sender steps are in the Microsoft support guide for encrypted messages in Outlook.

License Tiers Determine Access to Encryption

The Encrypt button in Office 365 is not available on every plan. The license tier determines whether the feature appears in Outlook. Practices should confirm the plan level before assuming encryption is available.

The plans that include Purview Message Encryption are:

  • Microsoft 365 Business Premium
  • Microsoft 365 E3 and E5
  • Office 365 E3 and E5
  • Microsoft 365 Apps for Enterprise with Azure Information Protection Premium
  • Standalone Azure Information Protection Premium P1 or P2

Plans that do not include the Encrypt button are Microsoft 365 Business Basic, Microsoft 365 Business Standard, Microsoft 365 Apps for Business, and Office 365 E1. Users on these plans do not see the Encrypt button in Outlook.

Adding the button requires either a plan upgrade or a per-seat Azure Information Protection Premium license add-on. The choice depends on how many features of Business Premium the practice needs beyond encryption.

office 365 email encryption in article illustration one

Tenant Setup Takes Thirty Minutes on a Fresh Deployment

Enabling encryption on a fresh tenant takes about thirty minutes. The setup happens entirely in the Microsoft 365 admin center. No changes to individual mailboxes or client software are required.

The steps are: sign in as global administrator, activate Azure Rights Management under Settings and Org settings, verify Message Encryption availability under the compliance section, configure the default template that recipients see, and confirm license assignment for the users who will send encrypted mail.

Existing tenants with Azure Information Protection already licensed do not need additional activation. The Encrypt button appears in Outlook after the client restart. Administrators can push the setting through Group Policy or MDM to ensure consistent behavior across the fleet.

Test the setup with a small pilot group before rolling out to all users. Send an encrypted message to an external recipient. Confirm the notification, the browser tab, and the decrypted message. Fix any policy or template issues before wide rollout.

Comparing Office 365 Encryption Options at a Glance

Office 365 supports several encryption methods with different fit profiles. The right choice depends on recipient mix, plan level, and administrative overhead.

Method Recipient Setup Plan Required Best Fit
Purview Message Encryption Browser tab, sign-in or passcode Business Premium or higher External patient and vendor mail
S/MIME Certificate pre-installed Any plan with desktop Outlook Internal mail with managed PKI
Sensitivity Labels Depends on label configuration E3 or E5 Enterprise policy-based encryption
Mail flow rule Encrypt-Only Same as Purview portal Business Premium or higher Automated encryption on patterns
Third-party HIPAA service One-click portal link Any Office 365 plan Small practices on Business Basic or Standard

Practices with mostly external recipients on personal accounts choose Purview or a third-party HIPAA service. Practices with mostly internal or partner mail choose S/MIME. Enterprise deployments use Sensitivity Labels for policy-driven automation.

Map the send flow before committing. How many external recipients per week. How often the recipient list changes. How many staff need to send encrypted mail. The answers point to the right method.

[mh_example]

The BAA Is Included in Every Microsoft 365 Tenant

Microsoft signs a business associate agreement covering the Microsoft 365 services under the standard BAA terms. The BAA is available at no extra cost. Administrators accept it in the Microsoft 365 admin center.

The BAA covers Exchange Online, SharePoint Online, OneDrive for Business, Teams, and the Purview compliance services. It applies to the tenant from the acceptance date forward. New services added to the tenant fall under the BAA automatically if Microsoft lists them as covered.

The BAA does not cover consumer services like Outlook.com or Hotmail. Practices using consumer accounts for patient mail need to move to a business tenant to fall under the BAA. This is a common misconfiguration that HIPAA auditors flag.

The HHS guidance on business associate agreements lists the terms required. Confirm the Microsoft BAA against the HHS requirements at the time of tenant setup.

office 365 email encryption in article illustration two

Sensitivity Labels Automate the Encryption Decision

Sensitivity Labels are the automated version of the Encrypt button. Administrators define labels in the Microsoft Purview compliance portal and configure rules that flag messages containing PHI or other regulated fields.

Applied labels can require encryption automatically, restrict forwarding, block download of attachments, and apply retention rules. The sender does not have to decide. The label is applied by policy based on the message content.

Deployment requires Microsoft 365 E3 or E5 licensing and Purview Information Protection configuration. Content patterns, sensitive information types, and label rules all need to be defined. This is a significant setup effort.

Sensitivity Labels pay back at enterprise scale where hundreds of users benefit from centralized policy. Small practices usually do not see the same payback and use the manual Encrypt button or a third-party service instead.

Mail Flow Rules Enforce Encryption on Patterns

Mail flow rules in Exchange Online provide a middle ground between manual Encrypt and full Sensitivity Labels. Administrators create rules in the Exchange admin center under Mail flow, Rules.

Rules match on conditions such as message subject containing a keyword, recipient domain matching a known partner, sender belonging to a specific group, or content matching a sensitive information type. Matched messages apply the Encrypt-Only or Do Not Forward template automatically.

This automation removes the sender decision on the most common regulated flows. A rule that encrypts every message with subject line containing [PHI] covers a large fraction of patient-record sends without training staff on the Encrypt button.

Mail flow rules also work as a safety net alongside manual Encrypt. If a sender forgets to click Encrypt but includes a PHI pattern in the body, the rule catches the message and applies encryption automatically.

[mh_protip]

GoDaddy-Provisioned Office 365 Follows the Same Structure

Office 365 licenses provisioned through GoDaddy follow the same plan and feature structure as direct Microsoft licenses. The Encrypt button appears on the same Business Premium and higher plans. The BAA is available in the same admin center.

Practices that provisioned Office 365 through GoDaddy sometimes cannot find the compliance settings because the admin panel is a subset of the full Microsoft 365 admin center. In that case, administrators can access the full center at admin.microsoft.com using the same credentials.

The BAA and the Purview settings are available in the full admin center. GoDaddy does not restrict access to compliance features. The initial setup routes through the GoDaddy dashboard, but administrators can move to the Microsoft admin center for full configuration.

Practices that need the Encrypt button and are on a GoDaddy Business Basic subscription should upgrade to Business Premium in the GoDaddy dashboard, or add per-seat Azure Information Protection through the Microsoft admin center.

Practices on Lower Plans Have Three Practical Options

Practices on Business Basic or Business Standard face a choice when they need encrypted email for HIPAA. The Encrypt button is not available on their plan. They have three practical options.

Option one is a full plan upgrade to Business Premium. This adds encryption, advanced threat protection, and device management at around ten dollars extra per seat per month. It fits practices that will use the other Business Premium features beyond encryption.

Option two is a per-seat Azure Information Protection Premium P1 add-on. This adds encryption without upgrading the base plan. Cost runs about two dollars per seat per month. It fits practices that only need encryption and not the other Business Premium features.

Option three is a dedicated HIPAA email service that works alongside Office 365. The service handles PHI-containing mail through its own encryption and BAA. Office 365 handles general mail. This fits practices where only a fraction of staff handle regulated content.

Mailhippo Works Alongside Office 365 for HIPAA Mail

Mailhippo secure email service works alongside Office 365 without changing the plan structure. The signed BAA is included in the base plan. Practices keep Office 365 for general mail and use Mailhippo for patient-facing PHI.

The sender uses Office 365 for internal communication, scheduling, and vendor mail. When a message contains PHI, the sender routes it through Mailhippo either from a browser interface or from an Outlook add-in. The message encrypts, delivers to the recipient link, and logs the send in the audit trail.

The recipient opens the message through a one-click link with a one-time passcode delivered to the same email address. No account creation, no password reset, no software install. This is the shortest recipient path among common HIPAA options.

The broader compliance stack pairs encrypted email with HIPAA-compliant website design and patient portal configuration. Encrypted email is one layer of the stack. The full stack covers the practice end to end.

[mh_faqs]

Posted on

Outlook Secure Email Encryption for Healthcare and Business Users

outlook secure email encryption guide featured image

[mh_key_takeaways]

Outlook secure email encryption covers three distinct mechanisms, and each one solves a different problem. Confusing them wastes IT hours and leaves protected mail exposed.

Microsoft ships Purview Message Encryption, S/MIME, and opportunistic TLS across the Microsoft 365 stack. The right choice depends on plan level, recipient environment, and whether the send touches regulated data like PHI. For teams that need a simpler layer over Outlook or Gmail, a dedicated encrypted email service handles the details in the background.

This guide walks each option, the license and setup requirements, and where Outlook secure email encryption fits inside a HIPAA compliant workflow.

The Three Encryption Layers Outlook Actually Supports

Outlook does not have a single encryption switch. It exposes three layers, and each protects a different piece of the send.

Transport Layer Security protects the connection between the sender mail server and the recipient mail server. Microsoft 365 negotiates TLS on every outbound send by default. If the receiving side supports it, the wire hop is encrypted.

Microsoft Purview Message Encryption sits on top of Exchange Online and wraps the message in a portal experience. The Encrypt button on the Outlook Options ribbon triggers it. External recipients open the message through a link and authenticate with Microsoft, Google, or a one time passcode.

S/MIME encrypts the message body with a certificate pair. The sender needs a certificate installed in the Windows certificate store. The recipient needs a matching public certificate that the sender has previously received. It is the strictest option and the most technical to run at scale.

TLS Is a Baseline, Not a Compliance Answer

TLS in Outlook covers the connection between mail servers. Exchange Online offers TLS 1.2 and TLS 1.3 depending on the negotiation with the receiving system.

The catch is that TLS is opportunistic by default. If the receiving mail server does not advertise TLS support, Exchange Online delivers over plain text unless a mail flow rule enforces the connection or blocks the send.

TLS also does nothing once the message lands. The body sits in the recipient inbox as regular mail. Anyone with access to the receiving mailbox can read it, and anyone who compromises that account reads the message too.

For HIPAA sends, TLS is the floor. Auditors expect message level encryption on top of TLS, either through Purview, S/MIME, or a third party secure email service. Force TLS on outbound connectors with mail flow rules when TLS must not fall back.

outlook secure email encryption in article illustration one

Microsoft Purview Message Encryption Explained

Microsoft Purview Message Encryption, formerly Office 365 Message Encryption, is the mechanism most Outlook users know as the Encrypt button. It builds on Azure Rights Management.

Senders click Options, then Encrypt, then pick a policy. The default policies are Encrypt Only, Do Not Forward, Confidential, and Highly Confidential. Encrypt Only lets the recipient read and reply. Do Not Forward blocks forwarding and printing.

External recipients receive a wrapper email with a link. Clicking the link opens the Microsoft encrypted message portal. They authenticate with a Microsoft account, a Google account, a Yahoo account, or a one time passcode delivered by email.

Microsoft 365 users inside the same tenant see the message inline. No portal is needed. See the Microsoft Learn Message Encryption documentation for full setup detail.

S/MIME Setup for Certificate Based Encryption

S/MIME uses a certificate pair for signing and encryption. It is the strongest form of Outlook secure email encryption in the sense that only the recipient private key decrypts the message.

Start by obtaining a valid S/MIME certificate. Public certificate authorities issue them, and enterprises with an internal PKI can issue them as well. Install the certificate in the Windows certificate store on the sender device.

In Outlook desktop, open File, Options, Trust Center, Trust Center Settings, Email Security. Under Encrypted email, click Settings and pick the installed certificate. Set the hashing and encryption algorithms. AES-256 for content and SHA-256 for signatures are the current defaults.

Before encrypting to a recipient, send a signed message first. The signature carries the sender public certificate. The recipient client stores it and can then encrypt replies back. Both sides need this exchange to complete before message level encryption works.

[mh_example]

Comparing Purview, S/MIME, and TLS at a Glance

Each Outlook encryption path fits a different use case. The table below maps the main attributes so an IT lead can pick without reading three product pages.

Attribute Purview Message Encryption S/MIME TLS
Encryption scope Message body and attachments Message body and attachments Server to server connection
License required Business Premium, E3, E5, or add on Any Microsoft 365 plan with valid certificate Included on all plans
Recipient experience Portal link with sign in or passcode Inline in S/MIME capable clients Transparent
Per recipient setup None Public certificate exchange None
Fits HIPAA sends Yes, under Microsoft BAA Yes, with proper key management Only as a supporting layer
Ease of ad hoc use High Low N/A

Purview and a third party service handle the ad hoc case cleanly. S/MIME fits fixed partner exchanges where certificates are exchanged once and reused.

Enabling the Encrypt Button in the Outlook Ribbon

Purview Message Encryption is on by default for eligible tenants. The Encrypt button appears in Outlook on the web, Outlook for Windows, Outlook for Mac, and modern mobile Outlook apps.

If the button is missing, the tenant likely lacks a qualifying license, or Azure Rights Management is not activated. In the Microsoft 365 admin center, an administrator can verify license assignment on the user and confirm the Rights Management service is active.

Administrators can also set default encryption behavior through mail flow rules in the Exchange admin center. A rule can apply Encrypt Only when a message contains the word confidential in the subject, or when the recipient domain matches a partner list.

Sensitivity labels created in Purview can bind an encryption policy to specific document types or user groups. Labels apply on the client and travel with the message. See Microsoft Learn on sensitivity labels for configuration steps.

outlook secure email encryption in article illustration two

HIPAA and Outlook Encryption in Practice

Healthcare organizations sending protected health information over email need message level encryption plus a business associate agreement with the vendor handling the mail. Microsoft signs a BAA covering Microsoft 365, Exchange Online, and Purview Message Encryption on eligible plans.

The BAA only applies to workloads that are actually enabled and licensed. A tenant without Business Premium cannot rely on the Purview coverage inside the BAA for encrypted sends.

Related reading on the compliance side sits in the Mailhippo library. See the sibling guide on hipaa secure email for a broader compliance walkthrough and the piece on office 365 hiipa compliant secure email encryption outlook for the direct Microsoft 365 configuration path.

Practices building the underlying digital estate can also review Redefine Web guidance on healthcare website security features, which covers the wider control set that pairs with encrypted email.

Purview Versus Voltage, Cisco, and Third Party Services

Purview Message Encryption is the native path. Other tools plug into Outlook and Exchange Online through connectors or transport rules.

OpenText Voltage Secure Email, formerly Voltage SecureMail, uses identity based encryption. Recipients open messages through a browser or an add in without exchanging certificates. It suits large enterprises with existing OpenText security investment.

Related sibling coverage on the Cisco side sits at the guide on secure email encryption service cisco, which walks the Cisco Secure Email Encryption Service configuration path for organizations already on the Cisco email security stack.

For a broader look at the encryption format layer, the sibling piece on secure mail email encryption covers S/MIME versus PGP tradeoffs in more depth. Third party services fit best when the goal is a BAA in the base plan and a one click recipient experience without per certificate management.

[mh_protip]

Common Outlook Encryption Errors and How to Fix Them

Users hit a small set of predictable errors. Most are license or certificate mismatches rather than product defects.

  • Encrypt button is grayed out. The user account is not licensed for Business Premium, E3, E5, or a compliance add on. Assign the license or route through a third party service.
  • Recipient cannot open the message. The portal link expired or the recipient blocked the sign in email. Resend with a one time passcode option enabled in the mail flow rule.
  • S/MIME message shows Signature not valid. The sender certificate expired or was not issued by a trusted root the recipient client recognizes. Renew the certificate and confirm the root chain.
  • Message drops to plain text on send. The receiving server did not offer TLS. Configure a partner connector with force TLS and TLS certificate verification.
  • Encrypted attachment cannot be opened. The recipient client stripped the wrapper. Use the Encrypt Only policy rather than Do Not Forward for external partners on non Microsoft clients.

Log message trace results in the Exchange admin center to confirm what actually happened on the send. Trace results show whether TLS negotiated and which mail flow rule applied.

When a Dedicated Secure Email Service Fits Better

Native Outlook encryption works well on Business Premium and above with a stable IT team. Smaller practices and mixed environments hit friction on license cost, certificate management, and recipient support.

A dedicated secure email service like Mailhippo layers on top of the existing Outlook or Gmail mailbox. The sender workflow does not change. A short button sends the message through the encrypted channel, and the recipient opens it with a one click link. A BAA is included in the base plan.

The tradeoff sits between native platform integration and simplified operations. Purview is deeply tied into the Microsoft 365 admin experience. A dedicated service is faster to deploy across a small team, cheaper per seat below the Business Premium line, and does not require certificate management.

Rollout Checklist for a Clean Outlook Encryption Setup

A tidy rollout avoids the two common failure modes: users cannot find the Encrypt button, and receivers cannot open the message. Both trace back to preparation.

  • Audit Microsoft 365 licenses. Confirm the seats that need to send encrypted mail are on Business Premium, E3, E5, or a compliance add on.
  • Verify Azure Rights Management is active in the Microsoft 365 admin center.
  • Sign the Microsoft BAA and archive it with compliance records. Confirm the covered workloads.
  • Build mail flow rules that apply Encrypt Only for messages tagged confidential in the subject or sent to a defined partner list.
  • Publish an internal one page guide with the exact steps to click Encrypt, plus a screenshot of the recipient portal.
  • Test end to end with a personal Gmail address and a personal Yahoo address before the first live send.

Practices that need a BAA at a lower price point or that run mixed Gmail and Outlook environments should evaluate Mailhippo alongside the native path. The HIPAA Journal encryption reference gives the compliance backdrop for either choice.

Sibling reading for teams still building the compliance stack sits at the guides on hipaa secure email and secure encrypted email. The right Outlook secure email encryption setup is the one that matches license reality, recipient behavior, and the audit trail the compliance team needs.

[mh_faqs]

Posted on

Secure Email Encryption Service Buyer Guide for 2026

secure email encryption service guide featured image

[mh_key_takeaways]

A secure email encryption service protects the contents of a message from the moment a sender hits send to the moment a recipient opens it. Covered entities under HIPAA, financial institutions under GLBA, and law firms handling privileged material all use these services to meet regulatory requirements.

The market splits into three groups. Native tools built into Microsoft 365 and Google Workspace, dedicated third party services like Mailhippo encrypted email, and enterprise gateways from Barracuda, Cisco, and Proofpoint. Each group solves a different problem.

This guide walks through what a secure email encryption service actually delivers, how the main providers compare, and how to test recipient experience before you sign anything.

Secure email encryption service defined

A secure email encryption service scrambles message content so only the intended recipient can read it. The service uses TLS between mail servers as the baseline layer.

On top of TLS, providers add a second layer through S/MIME certificates, PGP keys, or a portal-based delivery model. The second layer protects the message once it lands on a server the sender does not control.

Enterprise services stack more features. Data loss prevention scans outbound content for regulated data. Archiving retains messages for compliance audits. Phishing filters catch inbound threats. Administrative controls let IT enforce encryption on messages that match specific policies.

The core deliverable stays the same across every vendor. Content confidentiality, sender identity verification, and delivery proof. Everything else is packaging.

Office 365 email encryption service options

Microsoft ships Office 365 Message Encryption with Business Premium, E3, and E5 plans. The service runs on Microsoft Purview and adds the Encrypt button to the Outlook Options ribbon on desktop, web, and mobile.

Senders click Encrypt, pick a permission preset, and send. External recipients get a portal link and sign in with Microsoft, Google, or a one-time passcode. Internal recipients see the encrypted message in Outlook without extra steps.

Business Basic and Business Standard plans do not include the Encrypt button. Practices on those SKUs need to upgrade to Business Premium at $22 per user per month or add a dedicated encryption gateway.

Microsoft signs a business associate agreement with covered entities on qualifying plans. Admins need to accept the BAA in the Microsoft 365 admin center under Contracts before sending PHI. Documentation lives at Microsoft Learn Purview Message Encryption.

secure email encryption service in article illustration one

Gmail email encryption service options

Gmail encrypts every message in transit using TLS. Google Workspace paid plans add S/MIME support on Enterprise Plus, which requires certificate management for both senders and recipients.

Confidential mode adds link expiry and SMS passcode options on every Workspace tier. Confidential mode does not encrypt content end to end. The message content sits in Google servers in a readable form for the sender organization.

Google signs a business associate agreement with covered entities on paid Workspace plans configured for HIPAA. Admins accept the BAA in the Workspace admin console. The BAA covers Gmail, Drive, Calendar, Meet, and other core services.

Practices sending real PHI usually stack a dedicated encryption gateway on top of Workspace. The gateway triggers on subject line keywords, data patterns, or recipient domain rules, then routes the message through an encrypted delivery path. See Google Workspace encryption documentation for the current feature matrix.

GoDaddy email encryption service pricing

GoDaddy resells Proofpoint-powered email encryption as an add-on to its Microsoft 365 packages. The add-on runs about $7 per user per month on top of the base 365 license, so a five-seat practice pays roughly $85 per month total.

Senders trigger encryption by adding [encrypt] to the subject line or clicking a button. Recipients register a Proofpoint portal account or verify a one-time code to open messages.

GoDaddy signs a business associate agreement on qualifying plans. The BAA covers the encryption service and the underlying Microsoft 365 tenant. Practices with existing Proofpoint contracts should compare direct Proofpoint pricing at higher seat counts, which often beats the GoDaddy reseller rate.

Support quality varies. GoDaddy phone support handles billing and provisioning. Encryption configuration issues route back to Proofpoint, which adds a delay when a message fails to send. Test the escalation path before you deploy across all seats.

[mh_example]

Free secure email encryption service trade offs

Free encryption services exist for personal use. ProtonMail, Tutanota, and Skiff offer end to end encrypted email between accounts on the same platform.

Messages to external recipients require the recipient to accept a link, verify a passcode, or install a certificate. Solo practitioners often use free plans for the first quarter of operation, then upgrade once patient email volume rises past 200 messages per month.

Free services rarely sign a business associate agreement. ProtonMail offers a paid Business plan that includes a BAA at $12.99 per user per month. Tutanota and Skiff do not currently offer a BAA at any tier.

Free plans also lack retention controls, audit logs, and admin tools. Compliance risk usually outweighs the license savings once real PHI enters the mailbox. Read the HHS guidance on business associate agreements before picking any free tier for regulated content.

US Bank secure email encryption service model

US Bank uses a portal-based encryption service to send account statements, wire transfer confirmations, and loan documents to customers. Recipients get a notification email with a link to the portal.

The recipient registers an account on the first message, sets a password, and opens the message inside the browser. Follow-up messages from US Bank arrive at the same portal. The model works well for high volume, low urgency correspondence.

Portal-based encryption pushes friction onto the recipient. A customer who cannot find the login page will call the bank. A customer with an expired portal password will call the bank twice.

Financial institutions accept the friction because regulatory pressure outweighs support cost. Healthcare practices with lower call center capacity often pick a zero-step model instead, which delivers the encrypted message directly to the recipient normal inbox.

secure email encryption service in article illustration two

Nonprofit 365 pricing for email encryption service

Microsoft runs a nonprofit program that discounts 365 plans by 30 to 75 percent. Business Basic drops to $0 per user per month for the first 10 seats. Business Standard runs about $3 per user per month.

Business Premium, the plan that includes Purview Message Encryption, drops to about $5.50 per user per month for verified nonprofits. A community clinic with 20 seats pays $110 per month for encrypted email plus Office desktop apps, Intune, and Defender.

Nonprofits still sign the standard business associate agreement in the admin center. The BAA does not change with nonprofit pricing. Documentation lives at the Microsoft Nonprofits portal.

Barracuda, Cisco, and Proofpoint also offer nonprofit discounts of 20 to 50 percent. The discount usually applies to the base plan and not to compliance add-ons, so a small clinic saving money on seats still pays list price for the archiving module.

Mobile and desktop email encryption service parity

The best encryption service works identically on mobile and desktop. Services that require an S/MIME certificate on each device create setup pain for both senders and recipients.

Portal-based services often break the reply flow on mobile browsers. A recipient on an iPhone taps the portal link, logs in, reads the message, then hits reply and gets bounced to a login page again.

Zero-step encryption models handle the mobile case best. The sender uses the normal Gmail or Outlook app on any device. The recipient opens the message inside a standard inbox view on any device.

Test the reply flow on iOS Safari, Android Chrome, and desktop Chrome before committing to a multi-year contract. Vendors will send a test message on request. A five-minute test saves months of user complaints later.

[mh_protip]

Provider comparison for secure email encryption service buyers

Buyers picking between vendors weigh four factors above everything else. BAA inclusion, delivery model, price predictability, and admin controls.

Native Microsoft and Google options work well for organizations that already pay for the higher tier plans. Dedicated services like email encryption service providers and encryption email service platforms fit organizations that need a signed BAA in the base plan without a Business Premium upgrade.

Enterprise gateways from Barracuda email encryption service and secure email encryption service cisco add DLP, phishing protection, and archiving in one bundle. The bundles fit organizations with dedicated security teams.

Key evaluation questions:

  • Does the vendor sign a BAA in the base plan or as an add-on
  • Does encryption trigger automatically on regulated content patterns
  • Does the recipient need a portal account, a certificate, or a passcode
  • Does the price stay flat on renewal or jump after year one
  • Does the admin console log every encrypted message for audit

Healthcare practices and secure email encryption service selection

Healthcare covered entities and business associates carry the highest regulatory load. HIPAA, state privacy laws, and payer contracts all require encrypted transmission of PHI.

The right service for a five-person dental practice looks nothing like the right service for a hospital system with 4000 clinicians. Practices with under 50 seats usually pick a zero-step service with a bundled BAA. Larger organizations layer an enterprise gateway on top of Microsoft 365 or Google Workspace.

Practice websites also need to match the same security posture. Patient intake forms, appointment booking, and portal login pages all handle PHI. A HIPAA compliant website design partner handles the web side while the email service handles the mail side.

Practices running healthcare website security features already have most of the operational habits needed to run an encryption service. Password rotation, MFA on admin accounts, and audit log review carry over directly.

Choosing a secure email encryption service without regret

Most buying regret traces back to two mistakes. Picking a vendor without testing the recipient experience, and signing a long contract to lock in a first-year discount that resets on renewal.

Run a 30-day pilot with a single department. Send 50 real messages. Track how many recipients open the message on the first try, how many call for help, and how many ignore the message entirely.

Mailhippo works as an alternative when HIPAA compliance and per-recipient friction both matter. The service adds a BAA in the base plan, works with existing Gmail or Outlook accounts, and delivers messages without asking the recipient to install a certificate or register a portal account. The setup takes minutes.

Whatever vendor you pick, read the renewal clause before signing. Ask for the second-year rate in writing. Confirm the BAA transfers with account transfers. A secure email service that hides its renewal pricing is a service that plans to raise the price on renewal. Reference materials from HIPAA Journal on compliant email and NIST SP 800-177 Trustworthy Email help buyers write a defensible selection memo.

[mh_faqs]

Posted on

Encrypted Emails in Outlook Sending Guide and Troubleshooting Fixes

encrypted emails outlook guide featured image

[mh_key_takeaways]

Sending encrypted emails in Outlook is straightforward once the correct license and configuration are in place. The confusion for most users starts with which encryption method their license supports and whether the Encrypt button in the ribbon is available at all.

This guide covers the three practical routes for encrypted email in Outlook: Microsoft Purview Message Encryption, S/MIME through certificates, and third-party add-ins. Each section includes step-by-step instructions and the license or setup requirement.

A dedicated troubleshooting section addresses the “cant send encrypted emails Outlook” errors that generate the most support tickets. Every fix is based on Microsoft’s current documentation and typical production configurations.

Three Encryption Routes in Outlook

Outlook supports encrypted email through three separate mechanisms. The right choice depends on the Microsoft 365 license, the recipient population, and whether the organization needs certificate-based zero-knowledge encryption.

Microsoft Purview Message Encryption is the most common route. It ships with Microsoft 365 Business Premium and Enterprise E3, E5, A3, and A5 licenses. Users encrypt messages with a single click in the Options ribbon.

S/MIME is the second route. It requires an X.509 certificate installed on the sender’s device and prior key exchange with the recipient. S/MIME is standards-based and interoperable across mail clients that support it, but the setup burden limits adoption.

Third-party add-ins are the third route. Virtru, Mailhippo, and Barracuda all publish Outlook add-ins that add encryption capability to Outlook regardless of the underlying Microsoft license. These add-ins fit tenants on lower license tiers or workflows that need features Microsoft native encryption does not cover.

Sending an Encrypted Email with Purview Message Encryption

Purview Message Encryption is the fastest route to encrypted email in Outlook for tenants with an eligible license. The sending workflow takes four steps.

Compose a new message in Outlook Desktop or Outlook on the web. Click the Options tab in the ribbon at the top of the compose window. Click the Encrypt button in the Options ribbon. Choose the encryption policy from the dropdown: Encrypt-Only for content encryption or Do Not Forward for encryption plus forwarding restrictions.

  • Compose the message as normal (recipient, subject, body, attachments)
  • Click Options in the ribbon
  • Click Encrypt, then select the policy
  • Click Send

Recipients on Microsoft 365 read the message inline in their inbox with no additional steps. External recipients receive a notification email with a link to Microsoft’s Message Encryption portal. They sign in with a Microsoft account, Google account, or a one-time passcode to read the message.

encrypted emails outlook in article illustration one

Sending an Encrypted Email with S/MIME in Outlook Desktop

S/MIME encryption in Outlook Desktop requires an X.509 certificate installed in the Windows certificate store on the sender’s machine. The certificate can be issued by an internal certificate authority or a commercial CA.

Once the certificate is installed, configure Outlook to trust it. Open Outlook, click File, Options, Trust Center, Trust Center Settings, Email Security. Under Encrypted email, click Settings. In the Security Settings Name dropdown, name the profile. Under Signing Certificate and Encryption Certificate, click Choose and select the S/MIME certificate. Click OK.

To send an encrypted message, compose the message as normal. Click the Options tab and select Encrypt (or Sign, if digital signing only). Send. For encryption to work, Outlook needs the recipient’s public certificate. If the recipient has sent a previously signed message, Outlook captures the certificate automatically.

Our companion piece on how to send encrypted emails covers the S/MIME setup in more depth including certificate procurement from commercial CAs.

Understanding Encrypt-Only Versus Do Not Forward

The Encrypt button dropdown in Outlook offers two Purview policies: Encrypt-Only and Do Not Forward. The difference matters because it affects what recipients can do with the message after they read it.

Encrypt-Only applies message-level encryption to the content in transit and at rest. Recipients can read, reply, forward, print, and copy the content freely once decrypted. The encryption protects against server-side exposure and network interception.

Do Not Forward adds rights management restrictions on top of encryption. Recipients using compliant clients cannot forward, print, or copy the content. The restrictions are enforced by the recipient’s mail client, so they may not hold in all environments (particularly on mobile clients or non-Microsoft mail apps).

Choose Encrypt-Only when the concern is transport and mailbox exposure and the recipient needs full flexibility to work with the content. Choose Do Not Forward for messages containing internal deliberations, confidential negotiations, or sensitive personnel information where distribution controls matter.

[mh_example]

Fixing “Cannot Send Encrypted Emails” Errors in Outlook

The most common cause of the “cant send encrypted emails Outlook” error is a license mismatch. Purview Message Encryption is not included in Microsoft 365 Business Basic or Business Standard. The Encrypt button in the ribbon does not appear when the license is not eligible.

Verify the license in the Microsoft 365 admin center at admin.microsoft.com. Navigate to Billing, Licenses, and confirm the assigned license is Business Premium, E3, E5, A3, or A5. If the license is Business Basic or Business Standard, upgrade to enable Purview Message Encryption.

The second common cause is Azure Rights Management being disabled at the tenant level. In the admin center, navigate to Settings, Org settings, Services, and confirm Rights Management is set to Activated. Microsoft’s documentation at learn.microsoft.com purview ome covers the tenant-level activation steps.

The third common cause is Outlook not being fully signed in to the Microsoft 365 mailbox. Check the account status in File, Account Settings and confirm the account shows as connected. Sign out and sign back in if the account shows as offline or unauthenticated.

encrypted emails outlook in article illustration two

Encrypted Emails in Outlook on the Web

Outlook on the web (outlook.office.com) supports Purview Message Encryption with the same license eligibility as Outlook Desktop. The compose window includes an Encrypt option in the toolbar.

Click New message. Compose the message. Click the ellipsis (three dots) in the message toolbar. Select Encrypt, then choose the policy. The recipient experience matches the Desktop workflow.

Outlook on the web does not support S/MIME as fully as Outlook Desktop. Some S/MIME features require the S/MIME extension for Edge or Chrome. Organizations relying on S/MIME should standardize on Outlook Desktop or accept the reduced feature set in the web client.

For workflows where users move between Desktop and web frequently, Purview Message Encryption provides a consistent experience. S/MIME works best when the user consistently uses Outlook Desktop.

Encrypted Emails in Outlook Mobile

The Outlook mobile app for iOS and Android supports Purview Message Encryption for both sending and reading. The interface mirrors the desktop workflow with an Encrypt option in the compose menu.

To send an encrypted message on mobile, tap New Message. Compose the message. Tap the three-dot menu. Tap Encrypt and select the policy. Tap Send.

S/MIME on mobile is more limited. iOS Mail supports S/MIME natively when a certificate is provisioned through a configuration profile. Outlook mobile has limited S/MIME support and generally requires organization-specific configuration through Intune or a similar mobile device management platform.

For practices where mobile use is heavy, Purview Message Encryption provides a smoother path than S/MIME. Users who need S/MIME on mobile should plan on iOS with MDM-managed certificates rather than trying to make it work on Android or Outlook mobile.

[mh_protip]

Encrypted Emails in Outlook for HIPAA Compliance

Healthcare practices sending PHI through Outlook need a Business Associate Agreement (BAA) covering the Microsoft 365 tenant. Microsoft signs a BAA for Business and Enterprise plans but not for free Outlook.com accounts.

The BAA plus TLS in transit plus encryption at rest satisfies the HIPAA Security Rule’s transmission and storage safeguards. Adding Purview Message Encryption or S/MIME provides additional message-level protection. HHS publishes BAA guidance at the HHS BAA reference page.

Practices should confirm the BAA is signed before sending PHI. The Microsoft 365 admin center under Compliance shows the BAA status for enterprise agreements. For Business tier agreements, the BAA is typically part of the Microsoft Products and Services Data Protection Addendum available from the Microsoft Trust Center.

Our team at Redefine Web has published guidance on healthcare website security features for practices building broader HIPAA programs beyond email.

Third-Party Encryption Add-Ins for Outlook

Tenants on Microsoft 365 Business Basic or Business Standard cannot access Purview Message Encryption. Rather than upgrading the whole tenant license, some practices add a third-party encryption product that includes an Outlook add-in.

Common options include Virtru (browser and Outlook add-in), Barracuda Email Gateway Defense (Outlook add-in through the gateway), and inbox-native services such as Mailhippo (Outlook add-in with recipient inbox delivery).

These add-ins install through Microsoft AppSource and integrate into the Outlook compose window. Users click an encryption button in the ribbon or toolbar to route the outbound message through the service.

The trade-off is that the sender manages two encryption tools if the tenant also uses Purview. For small practices, standardizing on a single add-in and skipping Purview keeps the workflow simpler. Larger organizations that already own Business Premium or higher typically standardize on Purview and use add-ins only for niche workflows.

Opening and Forwarding Encrypted Emails in Outlook

Recipients on Microsoft 365 read Purview-encrypted messages inline in Outlook Desktop, Outlook on the web, or Outlook mobile. No additional steps are required.

External recipients receive a notification email with a Read the message button. Clicking opens Microsoft’s Message Encryption portal in a browser. The recipient signs in with a Microsoft, Google, Yahoo, or one-time passcode option. The decrypted message displays. Our companion piece on how to open encrypted emails in Outlook covers this flow.

Forwarding an encrypted email depends on the policy. Encrypt-Only messages can be forwarded and remain encrypted in transit. Do Not Forward messages are blocked from forwarding in compliant clients. S/MIME messages can be forwarded, but the forwarding recipient must have the original recipient’s public certificate for the encryption to reach them successfully.

For practices where forwarding is common (referrals, care coordination), Encrypt-Only is usually the correct default policy. Do Not Forward suits legal, personnel, and executive communications where distribution controls matter more than workflow flexibility.

[mh_faqs]

Posted on

How to Encrypt Email in Outlook (2026 Complete Guide)

how to encrypt email in outlook guide featured image

[mh_key_takeaways]

Outlook offers built-in encryption on most business plans, but the button only appears when the license, tenant configuration, and client version all line up. Missing one piece leaves the sender clicking on a feature that does nothing.

This guide walks through every path for how to encrypt email in Outlook, from the Encrypt button on Microsoft 365 to S/MIME certificates and Office Message Encryption rules. Where a healthcare team needs a simpler alternative, a secure email service with a BAA in the base plan often removes the recipient-side portal friction entirely.

Each method below includes the exact ribbon path, the license requirement, and the recipient experience. Skip to the section that matches your Outlook version and plan.

Outlook Supports Three Different Encryption Methods

Outlook does not have one encryption feature. It has three, and they behave differently at the recipient end.

Microsoft Purview Message Encryption is the modern default. It sits behind the Encrypt button in the ribbon on Microsoft 365 Business Premium and higher. External recipients get a portal link.

S/MIME uses X.509 certificates installed on each sender and recipient. It works entirely inside the client and produces a message that opens directly in Outlook without a portal step. Setup and certificate maintenance limit its practical reach.

Office Message Encryption is the older brand name for what is now Purview Message Encryption. Exchange Online admins can trigger it through mail flow rules based on subject keywords, recipient domain, or content sensitivity labels.

Picking the wrong path is the top cause of failed encryption rollouts. Read the recipient experience before deciding.

License Requirements Determine Which Method You Can Use

The Encrypt button in Outlook only appears on tenants with a qualifying license. Cheaper plans block the feature at the tenant level.

Microsoft 365 Business Premium, Enterprise E3, Enterprise E5, A3, A5, and G3/G5 all include Purview Message Encryption. Business Basic and Business Standard do not. Personal and Outlook.com accounts have no access at all.

Admins verify entitlement in the Microsoft 365 admin center under Billing, then Licenses. The full breakdown lives in the Microsoft Purview Message Encryption documentation.

S/MIME has no Microsoft license gate. It works on any Outlook client, including consumer accounts, provided each user brings a valid certificate from a public or internal certificate authority.

Practices that need HIPAA-grade encryption and do not want to upgrade all seats to Business Premium often pair a lower-cost Microsoft plan with a dedicated encrypted email service.

how to encrypt email in outlook in article illustration one

The Encrypt Button in New Outlook and Outlook 365

The most common path is the Encrypt button on the ribbon of Outlook 365 and the New Outlook client.

Compose a new message. On the ribbon, click the Options tab. Click Encrypt. A dropdown offers Encrypt-Only, Do Not Forward, and any custom sensitivity labels the admin has published.

Pick Encrypt-Only for standard transmission protection. Pick Do Not Forward when you need to block forwarding, copying, and printing on the recipient side.

Add the recipient, subject, and message body. Attachments inherit the same protection. Click Send.

Internal recipients on the same tenant open the message directly in their Outlook client. External recipients receive a notification email with a portal link.

If the Encrypt button is grayed out, the license is missing or the client has not synced. Sign out and sign back in before opening a support ticket.

Encrypting Email in Classic Outlook 2016 and 2019

Classic Outlook 2016 and 2019 support Purview Message Encryption through the same ribbon path, with one extra permission menu.

In classic Outlook, the button lives under File, Properties, Security Settings while composing. On the ribbon, click Options, then Permission. Pick Encrypt-Only or Do Not Forward from the dropdown.

Older Outlook 2013 installs need a client update patch and Azure Rights Management activated on the tenant. Without the patch, the Permission button prompts for a rights management server that does not exist.

The rest of the workflow matches the new client. Recipient portal experience, attachment inheritance, and admin logging all behave identically across versions.

Teams on Outlook 2013 should plan a client upgrade. Microsoft ended mainstream support for Office 2013 in 2018 and extended support in 2023.

[mh_example]

S/MIME Setup for Certificate-Based Encryption

S/MIME uses public-key cryptography. Each sender and recipient holds a certificate. The sender encrypts with the recipient public key. The recipient decrypts with their private key.

Obtain an X.509 certificate from a trusted CA or internal PKI. Import the certificate to the Windows certificate store under Personal. Match the certificate email address to the Outlook account email.

In Outlook, open File, Options, Trust Center, then Trust Center Settings, then Email Security. Click Settings under Encrypted email. Point Outlook to the installed certificate.

Before sending an encrypted message, exchange signed messages with each intended recipient. Each signed message carries the sender public key, which Outlook stores in the contact record for future encryption.

S/MIME certificates expire annually. Track expiration dates in a shared calendar. An expired certificate blocks all new encrypted sends until renewal.

how to encrypt email in outlook in article illustration two

Automatic Encryption Rules in Exchange Online

Manual clicking works for individual senders. Organizations that must encrypt every message matching a policy need mail flow rules.

An admin opens the Exchange Online admin center. Under Mail flow, then Rules, they create a new rule. Conditions can include subject contains PHI, recipient domain matches an external partner, or content contains a sensitive information type like Social Security number.

Action: Apply Office 365 Message Encryption and rights protection. Select Encrypt-Only or Do Not Forward. The rule fires server-side on every matching message without any sender action.

Rules cover the compliance gap when workforce members forget to click Encrypt. They also apply to messages sent from mobile clients that lack the ribbon.

Test the rule against a monitored test mailbox before pushing to production. False positives on internal messages create friction that pushes users to send from personal accounts.

Recipient Experience Determines Adoption

Encryption succeeds only when the recipient opens the message. Portal friction kills adoption.

Purview Message Encryption sends the external recipient a notification email. The email carries a link to the message portal. The recipient clicks, chooses a sign-in method, and reads the message.

Sign-in options include Microsoft account, Google account, or one-time passcode delivered to the same inbox. The passcode option adds thirty seconds and one extra click.

Elderly patients, referring physicians on legacy email systems, and vendor billing staff sometimes stall at the portal step. They call the practice for help. That call is the hidden cost of portal-based encryption.

Services like Mailhippo deliver encrypted email that opens like a normal message on the recipient side, which removes the support call entirely. Practices weighing tradeoffs should test both flows with a real referral partner.

[mh_protip]

HIPAA Compliance Requires More Than Encryption

Purview Message Encryption satisfies the Security Rule transmission security safeguard. It does not make a practice HIPAA compliant on its own.

The covered entity must sign a business associate agreement with Microsoft. The BAA is available at no extra cost through the Service Trust Portal. Practices without a signed BAA on file are not compliant even when the encryption works correctly.

Additional requirements include audit logging on message access, workforce training records, sanction policies, and documented procedures for PHI email. The HHS Security Rule guidance covers each safeguard in detail.

Practices that build websites handling patient data face parallel obligations. A HIPAA-compliant intake form pairs with encrypted email. See healthcare website security features for the site-side controls.

Compliance is a program, not a checkbox. Encryption is one piece.

Common Errors and How to Fix Them

Three errors account for most encryption support tickets. Each has a specific fix.

  • Encrypt button missing after license upgrade. Sign out of Outlook, close the app, wait up to 24 hours for tenant propagation, sign back in.
  • Recipient cannot open the portal. Confirm the notification email did not land in spam. Ask the recipient to request a one-time passcode instead of Microsoft or Google sign-in.
  • Attachments download without protection. Convert Word and Excel files to PDF before attaching, or apply Do Not Forward instead of Encrypt-Only.
  • S/MIME send fails with a no valid certificate error. Verify the recipient sent a signed message first so their public key is in the address book.
  • Mail flow rule fires on internal messages. Add a sender is outside the organization is false exception or scope by recipient domain.

Run each fix in order. If the error persists, capture the message header and open a Microsoft support case. Include the tenant ID, the affected user UPN, and the exact error text.

Related guides in this series cover how to encrypt email across providers, how to encrypt an email in Outlook 365, and how to encrypt email in new Outlook.

When a Dedicated Encrypted Email Service Fits Better

Outlook encryption works well for organizations already standardized on Business Premium or higher with dedicated IT staff. It creates friction elsewhere.

Small practices on Business Basic or Business Standard face a cost jump per seat to unlock Purview. Multi-provider teams running Google Workspace and Microsoft 365 side by side hit sign-in friction on the recipient portal.

Mailhippo is a HIPAA-compliant email service that works with existing Gmail and Outlook accounts, includes a business associate agreement in the base plan, and delivers messages to recipients without a separate portal login. Client-side encryption plus TLS covers the transmission security safeguard without requiring per-recipient S/MIME certificates.

Practices running healthcare marketing sites often pair encrypted email with a compliant patient-facing web presence. See healthcare marketing services for the site-side counterpart.

Pick the tool that matches the workflow. Outlook Purview for standardized enterprise tenants. S/MIME for internal certificate-managed teams. A dedicated encrypted service for practices that want one-click send and one-click open across every recipient.

[mh_faqs]

Posted on

HIPAA Secure Email Explained (Requirements, Providers, Setup)

hipaa secure email guide featured image

[mh_key_takeaways]

Every provider claiming to sell HIPAA secure email is technically selling a set of features and a legal agreement. HIPAA does not certify products.

The practice buys tools that let it meet the Security Rule, and the practice remains responsible for how those tools are used. A HIPAA-compliant email service like Mailhippo covers the encryption, the BAA, and the audit logging in one bundle so the practice does not have to assemble three separate products.

This guide walks through what actually makes an email service HIPAA secure, the provider options at each price tier, and the setup steps that separate a compliant workflow from a technically encrypted mess.

The Security Rule sets the requirements, not the vendor

The HIPAA Security Rule lists administrative, physical, and technical safeguards for electronic protected health information. Email falls under transmission security, access control, and audit control.

Encryption is an addressable specification, which means the covered entity has to implement it if it is reasonable and appropriate. In practice, HHS treats encryption as the default expectation for external PHI transmission.

No product carries a HIPAA certification. Any provider claiming to be HIPAA-certified is misrepresenting how the law works. Products can be HIPAA-ready or HIPAA-eligible, meaning they support the features a covered entity needs.

The covered entity is responsible for the workflow around the product. Buying compliant software and using it non-compliantly still produces a breach.

Three requirements separate secure email from ordinary email

Encryption is the first requirement. TLS 1.2 or higher for transit, AES-128 or AES-256 for content and storage. The exact ciphers and key lengths are documented in NIST Special Publication 800-52 Rev. 2 and NIST 800-111.

A signed business associate agreement is the second. The BAA makes the provider legally responsible as a business associate under HIPAA. Without it, sharing PHI with the provider is unauthorized regardless of the encryption.

Audit logging is the third. Administrators need to pull records showing who sent what, when, to whom, and whether the message was encrypted. Logs need to be retained for at least six years to match HIPAA’s records requirement.

Missing any of the three disqualifies the product. Practices that focus only on encryption discover during an incident that they cannot pull logs or that the provider never signed a BAA.

hipaa secure email in article illustration one

Big platform providers work if the plan tier is right

Google Workspace signs BAAs on all paid plans starting at Business Starter. The BAA covers Gmail, Calendar, Drive, Meet, and several other core services.

Microsoft 365 signs BAAs on business and enterprise plans. Business Basic and higher qualify. Outlook.com consumer accounts do not.

Both platforms encrypt messages at rest with provider-managed keys and use TLS 1.2 or higher for transit whenever the receiving server supports it. External delivery is the gap. Neither guarantees TLS on outbound if the receiver does not enforce it.

For full external encryption, Google Workspace practices need Enterprise Plus for native S/MIME or a third-party gateway. Microsoft 365 practices need Business Premium for the Purview Encrypt button or a similar gateway.

Dedicated healthcare email services simplify the setup

Dedicated HIPAA email services focus on the healthcare workflow specifically. Mailhippo, Paubox, LuxSci, Hushmail, TrueVault, and Enguard all fit this category.

The common pattern is a BAA in the base plan, encryption on every outbound message by default, and a simpler admin interface than the big platforms. Prices typically run $5 to $30 per user per month depending on the feature set.

Some services replace the mailbox entirely. Enguard, Hushmail, and Paubox on their hosted-mailbox tiers provide a full mail service including the mailbox, the encryption, and the compliance controls.

Others layer over existing Gmail or Outlook. Mailhippo and Paubox both offer gateway options that let the practice keep its current email address and inbox while the service handles the encryption and BAA.

[mh_example]

Enterprise appliances suit large hospital systems

Cisco Secure Email Encryption Service, Barracuda Email Protection, and Proofpoint Email Encryption serve large healthcare organizations. Each integrates with the organization’s broader security stack and its email security gateway.

These products cost more per user, require dedicated administration, and typically involve a services engagement to deploy. In return, they deliver deep integration with SIEM, DLP, and identity systems.

For a solo practice or small group, enterprise appliances are overkill. For a 500-provider hospital system with existing Cisco infrastructure, they are usually the right tier. Practices comparing options often review the enterprise secure email encryption service cisco tier alongside the smaller-practice choices.

All three enterprise vendors sign BAAs and support the technical safeguards HIPAA requires. The differentiators are scale, integration, and administrative model.

hipaa secure email in article illustration two

Free HIPAA secure email is not a real category

Every provider that signs a BAA charges for the service. The BAA carries legal liability, and the vendor prices that liability into the plan.

Free encrypted email tiers exist for personal use. ProtonMail, Tutanota, and CounterMail all offer free tiers. None of them sign a BAA at the free level.

The lowest-cost real HIPAA secure email starts around $5 per user per month. Google Workspace Business Starter, Microsoft 365 Business Basic, and small-practice-tier Mailhippo all fall in that range.

Practices that try to build a compliant workflow on free tools spend the savings on incident response the first time a message leaks. The math favors paying for a base plan.

The four-step setup workflow

Step one is signing the BAA. On Google Workspace, that lives in the Admin console under Account, Legal and compliance. On Microsoft 365, it is in the Service Trust Portal. Dedicated services usually include the BAA in the sign-up flow.

Step two is configuring encryption for outbound external mail. That is either native S/MIME, a portal-based product like Purview or Mailhippo, or a gateway that enforces encryption on all outbound.

Step three is access control. Enforce multi-factor authentication, disable legacy protocols like POP and IMAP unless required, and set role-based permissions so only staff who need PHI access have it.

Step four is documentation. A two-page policy covering the tool, the trigger, the recipient handling, and the annual review satisfies OCR expectations. The HHS Security Rule guidance and NIST SP 800-66 Rev. 2 outline the documentation elements.

[mh_protip]

What providers include and what they leave to the practice

Every provider handles the technical safeguards on their infrastructure. Encryption in transit and at rest, physical security of the data centers, redundancy, and platform-level access controls are the vendor’s job.

The practice handles the administrative safeguards. Staff training, policies and procedures, workforce clearance, sanctions for policy violations, and the risk analysis all sit with the covered entity.

The practice also handles the workforce-level access decisions. Who has an email account, what role they have, what content they are authorized to send, and how they authenticate.

A provider signing a BAA does not transfer the practice’s obligations. It shares the technical burden and it creates a legally responsible partner for the covered entity’s transmissions.

Common configuration mistakes that fail an audit

Forgetting to sign the BAA is the most common mistake. Practices that subscribe to Google Workspace or Microsoft 365 assume the BAA is automatic. It is not. A super administrator has to accept the BAA explicitly.

Leaving legacy protocols enabled is the second common mistake. POP and IMAP predate modern authentication and often bypass multi-factor requirements. Disable them for any account that does not need them.

Skipping audit log configuration is the third. Both Google and Microsoft log by default, but retention settings often need to be extended to meet HIPAA’s six-year record requirement.

Practices comparing options often check hipaa compliant secure email reviews and is email hipaa secure explainers before making the final call, because vendor marketing pages rarely surface these configuration details.

Choosing a provider based on the practice’s size and stack

A solo practitioner or small clinic usually gets the best fit from a dedicated healthcare service like Mailhippo. Setup takes an hour, the BAA is in the base plan, and the monthly cost is under $20.

A group practice already on Google Workspace or Microsoft 365 usually stays on the big platform and adds a gateway. Switching mail providers for a 30-person practice is a bigger project than adding an encryption layer.

A large hospital system with existing enterprise security infrastructure typically routes email through Cisco, Barracuda, or Proofpoint. The scale justifies the appliance cost and the administrative overhead.

Whichever provider fits, the practice’s marketing and patient acquisition side should match the security posture. Agencies specializing in healthcare marketing and healthcare website maintenance keep the intake forms, appointment reminders, and outbound clinical mail on a consistent compliance track.

  • Verify the BAA is signed and current for every service that touches PHI.
  • Confirm encryption for internal, external, transit, and at-rest paths.
  • Enforce multi-factor authentication and disable legacy protocols.
  • Enable and retain audit logs for at least six years.
  • Document the workflow, train annually, and review the setup once a year.

A HIPAA secure email service is a combination of encryption, a signed BAA, audit logging, and a documented workflow. Any product that delivers the four pieces qualifies. The differentiator between providers is how much of the setup the vendor handles and how much stays with the practice.

[mh_faqs]

2637 E. Atlantic Blvd.
#1063 Pompano Beach, FL 33062

© 2026 MailHippo, Inc.

View our Privacy Policy or contact our Customer Service team.

Optometrist Marketing Agency – Web Design, SEO, PPC & Maintenance