HorizLogoSm.fw_.png
Start Trial

Tag: outlook

Posted on

What It Means to Encrypt an Email in Plain Terms

what does it mean to encrypt an email guide featured image

[mh_key_takeaways]

To encrypt an email is to convert the message body and attachments into ciphertext before sending. The mail servers in between see only scrambled data. Only a recipient with the correct key or credential can read the content.

This guide explains what encryption means in practical terms, how an encrypted email looks to sender and recipient, and when a dedicated encrypted email service fits better than the built-in options in Outlook or Gmail.

The details vary by platform. The underlying protection is the same. Content is unreadable to anyone without the correct decryption key or authentication credential.

Encryption Converts Message Content Into Ciphertext

Encryption applies a mathematical algorithm to the message body and attachments. The algorithm uses a key to scramble the content into ciphertext. Only a matching key or credential can reverse the process and produce readable content.

The sender does not see the ciphertext. The compose window looks the same as a normal message. The encryption applies at send time, either automatically based on a policy or manually by clicking an Encrypt option.

The recipient does not see the ciphertext either. The mail client or portal decrypts before display. What both parties see is a normal-looking message with a lock icon or policy label that confirms encryption was applied.

The ciphertext exists on the wire between servers and at rest on the sending platform. Anyone who intercepts the traffic or gains access to the storage sees only scrambled data.

Three Layers of Encryption Cover Different Threats

Email encryption applies at three possible layers. Transport encryption between mail servers uses TLS. Message-level encryption uses S/MIME or PGP. Portal-based encryption stores encrypted messages on a server and delivers a link to the recipient.

TLS protects the message during network transmission. It does not protect the message at rest on the sending or receiving mail server. TLS is the baseline, not the full solution for regulated content.

Message-level encryption protects the content from the sender client to the recipient client. Servers in between see ciphertext. This is true end-to-end encryption and it fits scenarios where both parties can hold cryptographic keys.

Portal-based encryption sits between the two. The sending platform holds the encrypted content and manages authentication. The recipient reads the message in a browser session after signing in or entering a one-time passcode.

what does it mean to encrypt an email in article illustration one

The Sender View Looks Almost Identical to Regular Mail

The sender view of an encrypted email is nearly the same as a normal email. The compose window uses the same fields, the same formatting, and the same attachment controls. The one difference is a lock icon or a policy label on the message.

In Outlook, the sender clicks Options, then Encrypt, and picks a policy. In Gmail on Workspace with client-side encryption, the sender clicks a lock icon in the compose bar. In a HIPAA email service, the sender either clicks a Send Secure button or the encryption applies automatically to every outbound message.

The Send button behaves the same way. The message enters the outbound queue. The encryption applies before or during the send. The sender does not see any technical change.

The Sent folder shows the encrypted message under its subject line, the same as any other sent message. The sender can preview the content because the sender is a party to the encryption.

The Recipient View Depends on Platform and Method

The recipient view varies. Internal recipients on the same mail platform typically see the message inline. External recipients on other platforms follow a different path depending on the encryption method.

A Purview-encrypted message to a Gmail recipient arrives as a notification email with a Read the message button. The button opens outlook.office365.com in a browser. The recipient signs in with a Microsoft or Google account or requests a one-time passcode.

An S/MIME message decrypts inside the recipient mail client if the client has the correct certificate. Otherwise the recipient sees an unreadable attachment. This is why S/MIME works well for internal or business partner scenarios and poorly for patient communication.

A HIPAA email service typically shows the recipient a branded notification with a Read Message button. The button opens a portal where the recipient reads the decrypted content. Some services deliver the message directly to the recipient inbox if the recipient is on a compatible platform.

[mh_example]

Unencrypted Email Exposes Content to Anyone on the Path

An unencrypted email travels as plain text or under opportunistic TLS only. Opportunistic TLS drops back to cleartext if the receiving server does not support TLS. Any mail relay along the path can read the content.

The mail servers at each end store the message in cleartext. A breach of a mail server exposes the content of every stored message. Backups of mail servers also carry the cleartext content.

For casual content this is often acceptable. Personal mail, meeting confirmations, and general business correspondence typically travel unencrypted. The exposure risk is low relative to the content sensitivity.

For regulated content, the exposure changes the calculus. PHI, financial records, legal work product, and trade secrets in unencrypted mail create compliance exposure under HIPAA, GLBA, HITECH, and similar frameworks. The HHS Security Rule treats encryption as an addressable specification for transmission and at-rest storage.

Encryption Methods Compared at a Glance

The four common methods differ in setup complexity, recipient experience, and threat coverage. The table below summarizes the trade-offs.

Method Setup Complexity Recipient Experience Fits Best For
TLS Low, on by default No change Baseline transit protection
S/MIME High, needs certificates Automatic in-client decrypt Internal and B2B mail
Microsoft Purview Medium, needs license Portal sign-in or passcode Outlook tenants on Business Premium
HIPAA Email Service Low, gateway configured One-click portal Patient and PHI communication

The right choice depends on the recipient environment, the license already in place, and the compliance requirements. Practices sending to patients almost always want the one-click portal experience because patient tech literacy varies.

what does it mean to encrypt an email in article illustration two

Encrypting an Email in Outlook Uses Microsoft Purview

In Outlook on Microsoft 365 Business Premium and higher, encrypting an email means clicking Options, then Encrypt, in the compose ribbon of a new message. Two policies are available: Encrypt-Only and Do Not Forward.

Encrypt-Only encrypts the content and lets the recipient reply, forward, and print. Do Not Forward encrypts the content and blocks forward, print, and download. The sender picks the policy at send time.

Microsoft Purview handles the delivery. Internal Microsoft 365 recipients see the message inline. External recipients receive a notification with a Read the message button that opens a browser portal for decryption.

The detailed sender steps are in the Microsoft support guide for encrypted messages in Outlook. Tenants on Business Basic or Business Standard do not have the button and need a license upgrade or a separate service.

Encrypting an Email in Gmail Depends on Workspace Plan

Gmail encryption depends on the Workspace plan. Enterprise Plus and Education Plus support client-side encryption. Other plans support confidential mode, which is not the same thing.

Client-side encryption encrypts the message content in the browser before it reaches Google servers. The keys stay with the customer through an external key service. Google cannot decrypt the message.

Confidential mode sets an expiration and disables forward, copy, print, and download. It does not encrypt the message body in a way that meets HIPAA transmission requirements. Google can still access the content.

Standard Workspace plans that need encryption for HIPAA use a HIPAA email service that routes outbound mail through a gateway. The Gmail interface stays the same. Encryption applies at the service layer.

[mh_protip]

Encryption Is One Layer of HIPAA Compliance

Sending an encrypted email is not the same as being HIPAA-compliant. The Security Rule requires administrative, physical, and technical safeguards. Encryption covers part of the technical safeguards.

The covered entity also needs a signed business associate agreement with the email provider, access logs on message activity, workforce training on when to encrypt, and a documented incident response plan.

Common gaps in the compliance picture include:

  • Sending encrypted mail without a signed BAA in place with the provider.
  • Encrypting outbound mail but leaving stored copies unencrypted at rest.
  • Missing workforce training that leaves staff unsure of when to encrypt.
  • No incident response plan for a mail account compromise scenario.
  • No access logs on message activity for audit review.

Each of these gaps is a real audit finding, not a theoretical concern. Practices building out the wider security posture around encrypted mail also need to cover the website, patient portal, and intake forms. See the guide on healthcare website security features for the site-side controls that pair with encrypted email.

When a HIPAA Email Service Simplifies the Encryption Decision

A dedicated HIPAA email service handles the encryption, the BAA, the access logs, and the recipient portal in a single plan. The sender writes mail in a familiar Gmail or Outlook interface. Outbound mail routes through the service gateway.

Mailhippo is one option in this category. It works with existing Gmail and Outlook accounts. The BAA is included in the base plan. Encryption applies to every outbound message. Recipients open messages with one click and no account creation.

The secure email service approach fits practices that need HIPAA compliance without adding license overhead or IT complexity. The trade-off is a routing dependency on the service.

Related reading covers what encrypted mail actually looks like and how it behaves in specific tools: what does encrypt an email mean, what does encrypting an email do, what happens when you encrypt an email outlook, what is an encrypted email mean, what does an encrypted email look like, and encrypt an email.

The Practical Decision Comes Down to Three Questions

The practical decision on how to encrypt an email comes down to three questions. Who is the recipient. What license is already in place. What compliance framework applies.

If the recipient is another employee or a business partner with technical staff, S/MIME or Purview inline delivery works well. If the recipient is a patient or a member of the public, a portal experience with one-click access is the realistic path.

If the license is Microsoft 365 Business Premium or higher, Purview is the built-in option. If the license is a lower Business plan or a Workspace plan without Enterprise Plus, a HIPAA email service fills the gap without an upgrade.

If HIPAA applies, the choice must include a BAA with the provider handling encryption. A dedicated HIPAA email service handles the BAA by default. The wider healthcare digital footprint, including site and portal, can be coordinated by a healthcare marketing agency that pairs the compliance stack with the marketing stack.

[mh_faqs]

Posted on

TLS Encryption for Email Explained (How It Works, Where It Fails)

tls encryption email guide featured image

[mh_key_takeaways]

Most email delivery today runs over TLS. That protects the connection between mail servers, but it does not protect the message body itself.

Understanding tls encryption email is the difference between assuming a message is safe and knowing where it is exposed. For compliance-driven senders, TLS alone may not satisfy the requirement, and layering an encrypted email service on top closes the fallback gap that opportunistic TLS leaves open.

This guide covers what TLS actually does, where it falls short, and how to verify a mail flow is using TLS the way the sender expects.

TLS encrypts the connection, not the content

Transport Layer Security is the same protocol that secures HTTPS. In email, it secures the SMTP session between two mail servers.

When a sending server hands a message to a receiving server, both sides negotiate a TLS session. Once negotiated, all traffic on that connection is encrypted, including the message headers and body.

The receiving server decrypts the connection and stores the message. Whatever protection the message had during the transfer ends at that point. If the receiving mailbox is unencrypted at rest, the message sits in cleartext until the recipient reads it.

TLS protects against passive network eavesdropping between servers. It does not protect against the receiving server, an administrator on the receiving side, or anyone with legitimate mailbox access.

Opportunistic TLS is the default and its weakness

The default SMTP delivery model is opportunistic TLS. The sending server offers TLS, and the receiving server accepts if it supports the protocol.

If the receiving server does not support TLS, the message falls back to plain SMTP. The sending server delivers the message in cleartext rather than bouncing it.

The fallback is intentional. It preserves delivery in a world where not every mail server supports current standards. It also opens a downgrade attack path.

A network attacker who can intercept the SMTP conversation can strip the STARTTLS command from the greeting, and both sides will proceed in cleartext. This is called STRIPTLS and is well-documented in the mail security research community.

tls encryption email in article illustration one

MTA-STS and DANE close the fallback gap

MTA-STS publishes a policy in DNS and at a well-known HTTPS URL that tells sending servers to enforce TLS to a specific domain. If the handshake fails, the sender bounces the message rather than falling back to cleartext.

Google, Microsoft, and most large providers publish MTA-STS records and honor them on outbound. Smaller domains often do not, though adoption is climbing.

DANE uses DNSSEC-signed records to publish TLS certificate fingerprints. It provides similar downgrade protection with a different mechanism. DANE requires DNSSEC on the recipient’s domain, which limits deployment.

Both standards are documented in RFCs. MTA-STS is RFC 8461, and SMTP DANE is RFC 7672. Practices sending regulated content to unknown domains should publish MTA-STS on their own domain and consider DANE if their DNS provider supports DNSSEC.

Office 365 uses TLS on both directions with enforcement options

Microsoft 365 supports TLS 1.2 and 1.3 on inbound and outbound mail. TLS 1.0 and 1.1 were disabled across the platform in 2020, and legacy connections that try to use them fail.

Administrators can enforce TLS to specific recipient domains through Exchange Online connectors. A connector configured to require TLS refuses to deliver if the handshake fails, bouncing the message back to the sender.

Enforcement is useful for delivery to known partners and providers. Enforcing TLS globally is not practical, because it would bounce messages to any receiver that does not support current standards.

The Microsoft 365 admin center publishes TLS statistics in the mail flow reports. Practices can see the percentage of outbound and inbound mail using each TLS version and identify low-TLS destinations.

[mh_example]

Outlook covers the client-to-server hop only

Outlook is a mail client, not a mail server. Its TLS coverage is the connection from the desktop or mobile app to the mail server it authenticates against.

Every current version of Outlook enforces TLS 1.2 or higher for that connection. The client-to-server hop is encrypted regardless of what any downstream mail server does.

What happens after the message reaches the Microsoft 365 or Exchange server is out of Outlook’s control. The server handles delivery, and that delivery depends on the sending server’s TLS enforcement and the receiver’s TLS support.

Sending an encrypted-looking message from Outlook does not guarantee end-to-end TLS. It only guarantees the first hop. For full-path assurance, the sender needs message-level encryption or verified TLS enforcement on every hop.

tls encryption email in article illustration two

TLS alone does not fully satisfy HIPAA

The HIPAA Security Rule requires encryption of PHI in transit when reasonable and appropriate. TLS 1.2 or higher meets the technical standard for cipher strength and key length.

The gap is opportunistic delivery. A message sent from a compliant server can still travel in cleartext if the receiving server does not support TLS and the sender does not enforce it.

HHS has never issued a rule that TLS alone is insufficient. It has fined practices for unencrypted PHI transmission when opportunistic TLS was assumed but not verified.

The safer approach is layered. Use TLS for the transit layer, and use message-level encryption for the content. That way the message is protected regardless of what any intermediate server does. Practices reviewing the boundary between the two often look at the difference between tls encryption and email encryption to make the case internally.

How to verify a mail flow is using TLS

The Received header of any email shows the TLS status of the last hop. Look for a line like “using TLSv1.3” or “with STARTTLS.” A missing TLS notation means the hop was cleartext.

Google Postmaster Tools shows outbound TLS percentage per receiving domain. Practices sending large volumes can see which destinations regularly downgrade.

CheckTLS runs an on-demand test against any receiver. Enter a destination address, and CheckTLS attempts a full delivery, reporting the TLS version, cipher, and certificate details.

Microsoft 365 admins can enable connection logging under the Exchange admin center. The logs show per-message TLS status and are useful for troubleshooting a specific destination that keeps downgrading.

[mh_protip]

When a receiver does not support TLS, options are limited

A sender cannot force a receiving server to support TLS. If a specific destination refuses TLS, the sender has to work around it.

Option one is message-level encryption. Send the message through a service that encrypts the body and delivers a portal link. The receiver opens the link in a browser, and the connection to the portal uses HTTPS regardless of the receiving mail server’s capabilities.

Option two is contacting the receiving organization. Ask them to enable TLS 1.2 on their server. Small clinics, universities, and government agencies sometimes run outdated infrastructure and are open to fixing it when asked.

Option three is choosing a different channel for that specific recipient. A patient portal upload, a secure file transfer, or physical mail may be more appropriate than fighting a mail server that will not encrypt.

Configuring outbound TLS enforcement on the sender side

On Microsoft 365, administrators create a partner connector under Exchange admin center, Mail flow, Connectors. The connector points to the recipient domain and enables the option to require TLS.

On Google Workspace, administrators configure Compliance rules under Apps, Google Workspace, Gmail, Compliance. TLS requirements are set per recipient domain.

Enforced connectors bounce messages if TLS fails. That is the trade-off. The bounce is a clear signal that the destination is not honoring TLS, and it prevents the practice from accidentally sending PHI in cleartext.

For frequently-contacted partners, enforced TLS is worth the small operational overhead. For one-off external contacts, message-level encryption is usually simpler than configuring a connector.

Practical setup for a healthcare practice

Start with the inbound side. Confirm the practice’s mail server accepts TLS 1.2 or higher, publishes MTA-STS, and rejects deprecated cipher suites. Test with CheckTLS.

Move to the outbound side. Verify that outbound mail uses TLS 1.2 or higher and honor MTA-STS records from receiving domains. Google and Microsoft handle this automatically for tenants on current versions.

Add message-level encryption for external PHI transmission. Layer a service like Mailhippo or Purview on top of TLS. That way the content is protected even if any hop along the way downgrades to cleartext.

Practices that want the broader security posture to match the email layer often work with an agency familiar with healthcare marketing and healthcare website security features. Consistent security across email, forms, and website matters to auditors and to patients. The NIST SP 800-52 Rev. 2 guidelines outline the cipher and version baselines to match.

  • Confirm inbound and outbound TLS 1.2 or higher on the mail server.
  • Publish MTA-STS on the practice’s own domain.
  • Enforce TLS to known partners through Exchange or Gmail connectors.
  • Add message-level encryption for external PHI mail.
  • Run quarterly TLS verification tests and log the results.

TLS encryption email covers the network path between servers. It does not cover the content once the message lands, and it can fall back to cleartext when a receiver refuses to negotiate. Understanding those limits is what separates a working mail flow from a compliant one.

[mh_faqs]

Posted on

PGP Email Encryption Explained for Gmail and Outlook

pgp email encryption guide featured image

[mh_key_takeaways]

PGP email encryption has been the go-to method for security-conscious technical users since the 1990s. The current OpenPGP standard, RFC 9580, still uses the same public-key model that Phil Zimmermann designed in 1991, refreshed with modern algorithms.

PGP is strong, well-audited, and free in its GnuPG form. It is also famous for being harder to use than any browser-based alternative, which is why enterprises pair it with commercial key management and why patient-facing practices usually reach for a portal-based encrypted email service instead.

This guide covers what PGP actually does, how it fits with Gmail, Outlook, and Symantec Encryption, where it stands next to S/MIME, and when a simpler alternative saves days of key management work.

PGP uses public-key cryptography to protect the message body

PGP encrypts the message body with a symmetric AES key that is itself encrypted with the recipient public key. The recipient decrypts the AES key with their private key, then decrypts the body.

The same message can be signed with the sender private key, which lets the recipient verify the sender identity by checking the signature against the sender public key.

Public keys are shared through key servers, personal websites, or attached to a first message. The recipient can verify the public key belongs to the claimed sender by comparing the key fingerprint out-of-band, typically over a phone call.

The full protocol is defined in RFC 9580. GnuPG on Linux and the command line, GPG Suite on macOS, and Kleopatra on Windows all implement the same standard.

PGP does not protect the subject line or the routing headers. It only encrypts the message body and any attached payloads inside the PGP envelope.

PGP for Gmail requires a browser extension

Gmail does not include native PGP support in either the web client or the mobile apps. A browser extension bridges Gmail and the local PGP toolchain.

Mailvelope is the most widely used extension. It stores keys in a browser-managed keyring, wraps the Gmail compose window with an encrypt and sign toolbar, and outputs an armored OpenPGP block that Gmail sends as normal message text.

FlowCrypt is a paid alternative that adds enterprise features like automatic key discovery, a shared keyring, and Outlook integration. It handles the same PGP protocol under the hood.

The recipient side needs the same extension or another PGP-aware client to decrypt. That works well for developer-to-developer mail but breaks down for patient mail because patients do not install extensions.

Practices already on Google Workspace Enterprise Plus can enable hosted S/MIME instead, which handles encryption at the Gmail server side. S/MIME setup and key management is documented in the guide on S/MIME email encryption.

pgp email encryption in article illustration one

PGP for Outlook uses gpg4win or a commercial add-in

Outlook on Windows integrates with PGP through an add-in. Gpg4win with the GpgOL plug-in is the free option and installs a set of encrypt, sign, and decrypt buttons in the compose ribbon.

The add-in reads keys from the local GnuPG keyring. Enterprise deployments typically populate the keyring through a central key server or a directory that stores each user public key alongside their Active Directory entry.

Symantec Encryption Desktop, sold today under the Broadcom Symantec Encryption product line, is the commercial packaging. It adds central policy control, a Symantec Encryption Management Server for key escrow, and support for Outlook and other clients.

Outlook on macOS does not have an official gpg4win port. Users on macOS typically switch to Apple Mail with GPG Suite for PGP, or they run Outlook in a browser and use a PGP-aware webmail extension.

Outlook on the web does not support PGP add-ins directly. Organizations using OWA for their primary interface generally pick S/MIME or Purview Message Encryption instead, or route mail through a gateway that applies encryption at the transport.

Symantec PGP centralizes key management for the enterprise

Symantec PGP was originally sold by PGP Corporation, acquired by Symantec in 2010, and now sold under the Broadcom umbrella. The product line is Symantec Encryption Desktop and Symantec Encryption Management Server.

The Encryption Management Server is the piece that most GnuPG deployments do not have. It centralizes key generation, escrow, revocation, and policy enforcement across the tenant.

Encryption Desktop installs on each endpoint and handles the Outlook add-in, disk encryption, and file encryption. It reads policy from the management server on start and applies encryption rules to outbound mail.

The commercial packaging removes the key management overhead that stops many teams from adopting PGP. It does not remove the recipient-side requirement, so PGP still fits internal enterprise mail and B2B mail with a matched setup better than it fits patient mail.

Support and licensing are through Broadcom. Pricing is not published publicly, and quotes come through a Broadcom sales contact or an authorized reseller.

[mh_example]

PGP compared to S/MIME on the practical decisions

PGP and S/MIME both use public-key cryptography to encrypt email. They differ on trust model, mail client support, and enterprise integration.

PGP relies on a web of trust, where users sign each other keys directly. S/MIME relies on a certificate authority, where a trusted CA signs each user certificate.

S/MIME is built into Outlook, Apple Mail, and Google Workspace Enterprise Plus without a plug-in. PGP requires an extension or an add-in for every mainstream email client.

Feature PGP S/MIME
Trust model Web of trust Certificate authority
Standard OpenPGP RFC 9580 S/MIME RFC 8551
Native Outlook support Add-in required Built in
Native Gmail support Browser extension Hosted S/MIME on Enterprise Plus
Native iPhone Mail Not supported Built in with configuration profile
Key exchange Manual or key server Certificate exchange in signed messages
Typical use case Developer to developer, B2B security teams Enterprise internal, government

For patient mail, neither PGP nor S/MIME is a great fit because patients do not hold keys. Portal-based encrypted email services skip the key exchange step and are documented in the guide on email encryption.

pgp email encryption in article illustration two

Key management is the hard part of PGP

Generating a PGP key pair takes one command. Managing that key pair across a laptop, a phone, a work desktop, and a home machine, over five years and multiple client switches, is the actual work.

Best practice is to keep the private key on a hardware security module or a YubiKey rather than on the disk. That removes the risk of a stolen laptop exposing years of encrypted mail.

Public keys need to be published somewhere the sender can find them. Options include the personal Keyoxide profile, a personal website, a company directory, or the older SKS keyserver network, which is now mostly deprecated.

Key revocation is the other hard problem. When a private key is compromised, the user needs to publish a revocation certificate so that senders stop encrypting to the old key.

Enterprise deployments handle this through a management server. Individual users typically write the revocation certificate to paper when they generate the key and store it in a safe.

HIPAA compliance needs more than PGP encryption alone

PGP encryption satisfies the transmission security part of the HIPAA Security Rule when applied to messages containing protected health information. That is not the full compliance picture.

HIPAA also requires a signed business associate agreement with any vendor that handles PHI, access controls on the mailbox and the key store, audit logs of who sent and received each message, and an incident response procedure for lost or stolen keys.

Google Workspace and Microsoft 365 offer a BAA on eligible paid plans, but the practice must actively request and sign it. Free consumer Gmail and personal Outlook.com are never covered by a BAA, regardless of whether PGP is layered on top.

The HHS Covered Entities reference covers when a BAA is required. Any vendor that touches, stores, or transmits PHI on the covered entity behalf falls under the rule.

Practices building a full patient communication stack also need to think about the surrounding website. Guidance on security features for healthcare websites covers form handling, SSL, and portal integration alongside encrypted mail.

[mh_protip]

PGP fits developer and B2B mail better than patient mail

PGP shines in two common use cases. The first is developer-to-developer mail, where both sides already have keys, run a PGP-aware mail client, and value the strong cryptography.

The second is B2B mail between two security teams, where the setup cost is paid once and the volume justifies it. Enterprises exchanging incident data, threat intelligence, or contract packages often use PGP over commercial email gateways.

Patient mail rarely fits either shape. Patients do not have keys, do not run a PGP-aware client, and will not install a browser extension on the phone they use to check email.

For patient mail, portal-based encrypted email services deliver a link that the patient opens with a passcode. The message and any attachments live inside the portal, and the recipient reads and replies without installing anything.

Referring providers and insurance carriers usually accept portal-based delivery because it does not depend on their own encryption setup. That decouples the practice mail from every partner IT team.

Automation with PGP uses gpg and Bouncy Castle

Automated PGP encryption for batch mail from a report generator or a lab bridge uses the gpg command line on Linux and the Bouncy Castle PGP API on Java.

The gpg –encrypt –recipient email@example.com command reads the file from stdin, encrypts with the recipient public key, and writes the armored output. A shell script pipes the output into mutt or msmtp for delivery.

Bouncy Castle provides the PGPEncryptedDataGenerator, PGPCompressedDataGenerator, and ArmoredOutputStream classes. The Java code loads the recipient public key from a keyring, wraps the message bytes, and writes the resulting armored OpenPGP block into a MimeBodyPart.

For applications sending PHI at scale, calling a secure email API that handles encryption server-side is usually faster than adding key management inside the application. The API pattern also simplifies deployment because the container image does not carry key files.

The choice comes down to whether the recipients already run PGP. If yes, the code path stays inside the application. If no, a portal delivery service handles the recipient side without asking them to set up anything.

When PGP is the right answer and when to pick something else

PGP is the right answer when both sides already run PGP, the recipient will not accept portal links, and the volume justifies the setup cost. It is also the right answer when the recipient is a security team that expects an armored OpenPGP block in the message body.

S/MIME is the right answer for internal enterprise mail where every mailbox is on the same Outlook or Google Workspace tenant and every user already has a certificate through the corporate PKI.

Portal-based encrypted email is the right answer for patient mail, referring providers, and insurance carriers. The recipient opens a link, signs in with a passcode, and reads the message without any account setup.

For a small practice sending a mix of internal, referring provider, and patient mail from Gmail or Microsoft 365, layering a dedicated encrypted email service on top of the existing mailbox covers all three cases with one setup step.

Whichever method fits, run a round-trip test with a real recipient before rolling it out. The most common cause of failed PGP deployments is that the sender got a green Encrypt button but the recipient never received a readable message.

[mh_faqs]

Posted on

How to Remove Encryption From Outlook Email in 2026

how to remove encryption from outlook email guide featured image

[mh_key_takeaways]

Removing encryption from an Outlook email sounds like a one-click task. In practice the steps depend on which layer of the Microsoft encryption stack applied the encryption in the first place.

Outlook uses three separate encryption layers. Microsoft Purview Message Encryption at the tenant policy layer, S/MIME at the per-message certificate layer, and Information Rights Management at the sensitivity label layer. Each layer has its own removal path. Users trying to manage encrypted email across a mixed environment need to know all three.

This guide walks through removing encryption from an outbound message before you send it, from a received message so you can reuse the content, and from tenant policy when an admin needs to shut off automatic encryption on a specific rule.

Identifying which Outlook encryption layer applied to a message

Open the message. Click the ellipsis or three-dot menu. Choose Message Options or Properties, depending on the Outlook version.

The Properties dialog shows the message class. rpmsg indicates Purview Message Encryption. IPM.Note.SMIME indicates S/MIME. The Sensitivity field shows any active IRM label. This one dialog answers most encryption-source questions in under a minute.

Once you know the layer, you know the removal path. Purview Message Encryption removes at the Encrypt button on the Options ribbon or through a tenant mail flow rule change. S/MIME removes through the Encryption toggle in the Options ribbon. IRM labels remove through the Sensitivity dropdown near the message subject line.

Users who skip the identification step end up clicking every toggle they can find. The wrong toggle often does nothing because it addresses a different layer than the one applying encryption.

Removing encryption from an outbound Outlook message on desktop

Compose the message as usual. Go to the Options ribbon at the top of the composer window. The Encrypt button lives in the Permission group near the middle of the ribbon.

Click the Encrypt button. If encryption was on, the button toggles off and the shield icon disappears from the composer. If the button opens a dropdown, choose No Encryption at the top of the list.

Send the message. The recipient receives the message without any portal link or password step. Verify by checking the sent copy in the Sent Items folder and reviewing the message class in Properties.

If the Encrypt button is grayed out, a tenant mail flow rule is enforcing encryption based on recipient domain, subject line keyword, or content pattern. The user cannot override the rule. Contact the tenant admin or route the message through how to encrypt email from outlook alternative flows if a genuine business need exists.

how to remove encryption from outlook email in article illustration one

Removing encryption from an outbound Outlook message on web

Outlook web uses a slightly different navigation. Compose the message. Click the three-dot menu at the top of the composer, next to the Send button.

Choose Encrypt from the dropdown. A submenu opens with encryption options. Select No Encryption or click the current option again to toggle it off.

Outlook web shows a lock icon at the top of the composer when encryption is active. The icon disappears after you toggle encryption off. Send the message when the icon is gone.

Outlook web hides some encryption options behind the plan tier. Business Basic users see fewer options than Business Premium users. Enterprise E5 users see the most options because Purview features are all included. Reference the current option matrix at Microsoft Learn Purview Message Encryption.

Removing encryption from an outbound Outlook message on mobile

The Outlook mobile app on iOS and Android places the encryption toggle inside the ellipsis menu of the composer. Tap the ellipsis to open the extended menu.

Tap Encrypt Message. A screen appears with the current encryption setting. Choose No Encryption and tap the back arrow to return to the composer.

The lock icon in the composer header disappears when encryption is off. Send the message from the mobile composer. The recipient receives an unencrypted message that opens in any mail client.

Users on personal iPhones sending occasional PHI often struggle with the mobile encryption workflow. A dedicated app like how to encrypt email from iphone guide setups or a service like Mailhippo simplifies the mobile case without requiring native Outlook encryption at all.

[mh_example]

Removing encryption from a received Outlook message

You cannot un-encrypt a message the sender encrypted. Outlook decrypts the message for display, but the encrypted copy stays in the mailbox database.

The workaround is to reply or forward without encryption when the sender policy allows. Open the message. Click Reply or Forward. Check the composer for the encryption toggle and turn it off if it appears.

Some sender policies apply Do Not Forward or block copy and paste at the label level. In that case the received message cannot be extracted at all. Reach out to the sender and ask them to resend without the restrictive label.

For content you need to move to another system, select all text in the decrypted view, copy, and paste into a fresh unencrypted message. Attachments require a separate step because Outlook often keeps attachments encrypted even when the body decrypts.

Removing encryption from Office 365 mail flow rules as an admin

Sign in to the Exchange admin center at admin.exchange.microsoft.com. Open Mail Flow, then Rules.

Review each rule in the list. Rules that apply encryption usually have Apply Office 365 Message Encryption or Apply RMS Template in the action list. Note the rule name and business owner before making any change.

To disable a rule, toggle the Enabled switch to off. To delete a rule, use the three-dot menu and choose Delete. Test the change on a pilot mailbox first. Send five test messages that would have matched the rule and confirm they arrive without encryption.

Common admin steps:

  • Document the business reason for removing the rule
  • Notify the privacy officer if the rule protected PHI
  • Set a change ticket in the tenant change log
  • Wait 30 minutes after disabling before testing
  • Keep an export of the rule XML for rollback
how to remove encryption from outlook email in article illustration two

Removing encryption from an Office 365 sensitivity label

Sensitivity labels in Microsoft Purview apply encryption at the label level. A message tagged with a Confidential label carries encryption for the life of the message.

To remove encryption from a specific label, sign in to purview.microsoft.com. Open Information Protection, then Labels. Select the label. Click Edit Label.

In the encryption settings step, choose None. Save the change. New messages tagged with the label send without encryption. Existing messages already sent with the label keep their encryption because the metadata was baked in at send time.

Removing encryption from a label affects every user who applies that label. Rename the label to avoid user confusion. A label named Confidential that no longer encrypts creates trust issues with the privacy officer and the audit team.

Removing S/MIME encryption in Outlook desktop

S/MIME encryption relies on a certificate installed on the sender machine. The certificate applies encryption per message through the Trust Center settings.

To turn off S/MIME on a single message, open the composer and go to Options, More Options, Security Settings. Uncheck Encrypt Message Contents and Attachments. Send the message without S/MIME encryption.

To turn off S/MIME across all outbound messages, go to File, Options, Trust Center, Trust Center Settings, Email Security. Uncheck Encrypt Contents and Attachments for Outgoing Messages. Click OK.

Removing the S/MIME certificate entirely happens in the Windows certificate store. Type certmgr.msc in the Run dialog. Open Personal, Certificates. Delete the S/MIME certificate. Deleting the certificate also breaks decryption of past S/MIME messages, so export a backup first.

[mh_protip]

Removing encryption from Outlook messages in bulk

Outlook has no built-in bulk decrypt feature. Third party tools claim to bulk decrypt, but most require the sender private key and produce plaintext exports rather than in-place changes.

The supported path for bulk access uses eDiscovery in the Purview compliance portal. Create a content search that includes the target mailboxes. Export the results as a PST with the Include All Encrypted Messages option checked.

The exported PST contains decrypted copies of every message the running admin has permission to read. Import the PST into the destination mailbox using the Outlook Import feature. The imported copies are unencrypted.

Use this pattern for legal hold, migration, or forensic review only. Bulk decryption for general access defeats the point of the encryption in the first place. Reference guidance from HHS HIPAA Security Rule before running bulk decryption on any mailbox with PHI.

Common Outlook encryption removal errors and fixes

The Encrypt button stays selected even after you click it. Usually a mail flow rule is forcing encryption at the tenant. Check with the admin.

The message arrives at the recipient with the encryption warning banner even though you removed encryption. The recipient mail server flagged the message as suspicious because the sender IP does not match the tenant SPF record. Fix the SPF record.

Attachments still open with a password prompt. Purview Message Encryption applies to attachments through the same policy. Removing encryption from the body does not automatically release the attachments. Re-attach the files after removing encryption to reset the attachment state.

The recipient sees a portal link instead of the message body. The recipient mail client stripped the message body during transport. Check the recipient inbox rules and any downstream security gateways.

When to keep Outlook encryption on and route around it instead

Removing encryption from healthcare, financial, or legal correspondence creates compliance exposure. HIPAA, GLBA, and state privacy laws require encryption of regulated content in transit.

Practices with intermittent encryption needs often benefit from a per-message alternative rather than a permanent policy change. How to send encrypted email guides and services like Mailhippo work alongside Outlook without replacing the native stack.

Mailhippo adds a per-message send option to Outlook. When the sender needs encryption for a specific message, the Mailhippo option applies encryption and a BAA-covered delivery path. When the sender does not need encryption, the message goes out through normal Outlook without any policy conflict. Practices also handling healthcare web hosting and healthcare website maintenance pair the same discipline across their web and email stacks.

For further reference, review CISA cybersecurity advisories on message encryption baselines and the HIPAA Journal on compliant email before making any tenant-level encryption change that affects regulated traffic.

[mh_faqs]

Posted on

Encrypted Email Microsoft 365 Setup Guide for 2026

encrypted email microsoft 365 guide featured image

[mh_key_takeaways]

Encrypted email on Microsoft 365 uses Microsoft Purview Message Encryption behind the scenes. The service ships with Business Premium, E3, E5, and F3 plans at no extra cost.

Practices sending PHI to patients or vendors need three things in place. A qualifying license, a signed business associate agreement with Microsoft, and a published sensitivity label that maps to an encryption template. Once those three exist, users see the Encrypt button in Outlook and can send encrypted email from any device.

This guide walks through the setup steps, the license comparison, the sender experience across desktop, web, and mobile, and where the portal-based delivery step creates friction for high-volume patient communication.

Encrypted email Microsoft 365 licensing landscape

Purview Message Encryption ships with Business Premium at $22 per user per month, E3 at $36, E5 at $57, and Frontline F3 at $8. Business Basic at $6 and Business Standard at $12.50 do not include the Encrypt button.

Practices on Basic or Standard have two upgrade paths. Move the tenant to Business Premium for the full compliance stack. Add the Microsoft 365 E3 Compliance add-on at $12 per user per month to gain Purview without paying for Business Premium features the practice does not use.

Nonprofits get 30 to 75 percent off list on every plan through the Microsoft Nonprofits program. Business Premium runs about $5.50 for verified nonprofits. Documentation lives at Microsoft Nonprofits portal.

Confirm the license status in the Microsoft 365 admin center under Billing, Licenses. See Microsoft 365 email encryption setup for the regional configuration walkthrough.

Business associate agreement for encrypted email Microsoft 365

Microsoft signs a business associate agreement with covered entities on qualifying paid plans. The BAA covers Exchange Online, SharePoint Online, OneDrive, Teams, and Purview.

Administrators accept the BAA in the Microsoft 365 admin center. Open Billing, Your Products, then click the Terms link on the eligible plan. Read the BAA in full and click Accept. The tenant is HIPAA-eligible immediately after acceptance.

The BAA does not cover any consumer Outlook.com account or any free Microsoft account. Verify the tenant type in the admin console before treating any mailbox as HIPAA-eligible.

After BAA acceptance, configure the required admin settings. Enable multi-factor authentication for every user. Turn on audit logging in the compliance portal. Set retention that meets the six-year Privacy Rule requirement. Reference the sample BAA at HHS sample BAA provisions.

encrypted email microsoft 365 in article illustration one

Enabling Microsoft 365 email encryption with Microsoft Purview

Sign in to compliance.microsoft.com with a global admin or compliance admin account. Open Information Protection, then Labels.

Click Create Label. Give the label a display name like Confidential, add a description, and pick a color. On the encryption step, choose Assign Permissions Now.

Configure the permission block. Add users or groups, set the permission level, and save the encryption settings. Publish the label to the tenant. Users see the Encrypt button in Outlook after publication.

Test on a pilot user before rolling to production. Send a message from the pilot mailbox to an external Gmail address and confirm the recipient gets the portal notification. Reference Microsoft Purview email encryption for the deep configuration walkthrough.

Sending encrypted email from desktop Outlook

Compose the message. Go to the Options ribbon at the top of the composer window. The Encrypt button lives in the Permission group in the middle of the ribbon.

Click Encrypt. A dropdown appears with the available permission templates. Pick Encrypt for basic encryption or Do Not Forward for stronger controls that block forwarding and printing.

The composer displays a lock icon at the top and a permission banner near the subject line. Send the message. External recipients get a notification email with a portal link.

If the Encrypt button is grayed out, the tenant does not have a published sensitivity label yet. Check with the admin. See encrypt email Microsoft Outlook for the full sender walkthrough.

[mh_example]

Sending encrypted email from Outlook web

Sign in to outlook.office.com. Compose the message as usual. Click the three-dot menu at the top of the composer, next to the Send button.

Choose Encrypt from the dropdown. A submenu opens with the available permission templates. Pick Encrypt or Do Not Forward. The composer shows a lock icon and a permission banner at the top.

Send the message. The recipient experience matches desktop Outlook. External recipients get a notification email with a portal link.

Outlook web sometimes hides advanced permission templates behind the tenant plan tier. Enterprise E5 tenants see every option. Business Premium tenants see the default four. See Microsoft Outlook 365 encrypt email for the tier-by-tier feature matrix.

encrypted email microsoft 365 in article illustration two

Sending encrypted email from Outlook mobile

The Outlook mobile app on iOS and Android places the encryption toggle inside the ellipsis menu of the composer. Tap the ellipsis to open the extended menu.

Tap Encrypt Message. A screen appears with the available permission templates. Pick the template and tap the back arrow to return to the composer.

The lock icon in the composer header confirms encryption is active. Send the message from the mobile composer. The recipient experience matches desktop and web.

Users on personal iPhones sending occasional PHI often struggle with the mobile encryption workflow because the ellipsis menu is not obvious. Train users on the workflow before rollout. Screenshots in the training material help far more than a written procedure.

Recipient experience for Microsoft 365 encrypted email

External recipients get a notification email with a portal link. The notification email includes the sender name, subject line, and a button that opens the portal.

Recipients sign in with Microsoft, Google, or a one-time passcode. The Microsoft option works for anyone with a Microsoft account. The Google option works for anyone with a Google account. The one-time passcode works for anyone else.

Reply from the portal stays encrypted. The reply routes back through Microsoft servers and lands in the original sender inbox as a normal encrypted message.

The friction of the portal step drops adoption. Practices sending 200 patient messages per week often see 30 to 50 first-time recipients need help with the portal. Support ticket volume tracks directly to the portal experience.

[mh_protip]

S/MIME as an alternative encrypted email path on Microsoft 365

S/MIME encryption sits alongside Purview Message Encryption in Microsoft 365. S/MIME uses certificates installed on the sender and recipient devices.

Configuring S/MIME in Microsoft 365 requires the admin to upload the certificate authority chain to the Exchange admin center. Users install their personal certificate in the Windows certificate store or the Outlook mobile app.

S/MIME provides stronger cryptographic guarantees than Purview because the message content decrypts only on the recipient device. Microsoft servers never see the plaintext.

The tradeoff is setup complexity. Most healthcare practices skip S/MIME because patients cannot install certificates. Reference the current S/MIME setup path at Microsoft Learn S/MIME configuration.

Common Microsoft 365 encrypted email problems and fixes

The Encrypt button is grayed out. The tenant does not have a published sensitivity label with encryption enabled, or the user account does not have a Purview-eligible license.

The recipient gets a portal link but cannot log in. The one-time passcode option ships to the same email address the notification came to. Ask the recipient to check the inbox for the passcode message and to check spam if the passcode does not appear.

Attachments open with a permissions error. The permission template applied to the message restricts attachments. Change the template to Encrypt without additional restrictions.

Common troubleshooting checklist:

  • Confirm the license includes Purview Message Encryption
  • Confirm the BAA is accepted in the admin center
  • Confirm at least one sensitivity label is published with encryption
  • Confirm the Outlook client version is current
  • Confirm the recipient inbox is not blocking the portal notification domain

When to layer a zero-step alternative on top of Microsoft 365

Practices with heavy external patient mail volume often outgrow the Purview portal experience. Support ticket volume from patients who cannot log in to the portal starts to eat into clinical time.

A zero-step encryption service like Mailhippo works alongside Microsoft 365. Purview handles internal traffic between mailboxes on the tenant. Mailhippo handles external mail to patients and vendors without a portal step. The two services coexist without a routing conflict.

Practices running HIPAA compliant website design already understand the reasonable and appropriate standard. Applying the same standard to email means picking the tool that keeps compliance tight while dropping recipient friction. See also security features for healthcare websites for the parallel web guidance.

For further reference, review Microsoft Learn Purview Message Encryption, the HHS HIPAA Security Rule, and the HIPAA Journal guide to compliant email before finalizing the Microsoft 365 encrypted email stack. See also Microsoft email encryption and Microsoft Office 365 email encryption for related walkthroughs. See the Mailhippo secure email service overview for the zero-step alternative details.

[mh_faqs]

Posted on

Zix Email Encryption Explained for Healthcare and Compliance Teams

zix email encryption guide featured image

[mh_key_takeaways]

Zix email encryption is a policy-driven secure email gateway used across regulated industries to enforce HIPAA, GLBA, and PCI email rules. The gateway scans every outbound message, applies encryption when a rule matches, and routes the recipient into a secure portal when the receiving server cannot accept TLS.

Healthcare practices adopt Zix for the same reason they adopt other encrypted email platforms. The gateway removes the burden of asking every staff member to remember when to encrypt. Content classification runs on the server, not in the mail client.

The tradeoff is complexity. Policy tuning, directory synchronization, and gateway routing require IT time that smaller practices often do not have. This guide covers how Zix works, what it costs, and where simpler options fit.

Zix Runs as a Gateway Between the Mail Server and the Internet

The Zix architecture places a gateway between the outbound mail server and the internet. Every message the mail server sends passes through the gateway before it reaches the receiving mail server. The gateway inspects the message, classifies the content, and applies the routing decision.

For Google Workspace, administrators configure the outbound gateway in the Gmail routing settings and point outbound mail at the Zix hostname. For Microsoft 365, administrators create an outbound connector in the Exchange Admin Center. The gateway sits in the delivery path without changing the sender client.

The inspection step matters. Zix reads the message subject, body, headers, and attachments. It matches the content against a library of built-in patterns for PHI, financial account numbers, and other regulated fields. Matched messages get encrypted. Non-matched messages route normally.

The gateway model works well for organizations with a dedicated IT team, consistent mail platform, and a compliance officer who owns policy tuning. Smaller practices often find the model heavier than the actual send volume justifies.

Policy Rules Drive the Encryption Decision

Zix ships with a policy library covering HIPAA, HITECH, GLBA, PCI DSS, and state privacy rules. Each policy contains a set of pattern matches, keyword lists, and structural checks. Administrators can enable full policies out of the box or customize them for the practice.

A HIPAA policy typically flags nine-digit numbers formatted as social security numbers, medical record numbers, ICD-10 codes, and combinations of patient identifier plus clinical information. The gateway can also flag messages sent to known covered entity domains or to any address that matches a directory of business associates.

When a message matches a policy, the gateway encrypts and delivers based on the routing rule. The sender does not need to click an Encrypt button. The compliance officer does not need to train the entire staff on when to encrypt. The gateway handles the decision.

The tradeoff is policy accuracy. False positives encrypt messages that do not require it. False negatives release regulated content in plaintext. Policy tuning is an ongoing activity, not a one-time setup. The HHS HIPAA Security Rule lists the transmission security requirements that policy design should map back to.

zix email encryption in article illustration one

Delivery Uses TLS First and Portal Fallback When Needed

Zix delivery follows a two-path model. The first path uses TLS when the receiving mail server supports it and passes Zix directory verification. In that case, the encrypted message decrypts at the gateway boundary and arrives in the recipient inbox as a normal email.

The second path routes to the Zix portal. The gateway sends the recipient a notification email with a link. The recipient clicks the link, signs in with a password, and reads the message inside the browser. First-time recipients set a password. Repeat recipients reuse the account.

Zix directory verification uses a network of known Zix-enabled organizations that can accept encrypted messages directly. If both parties run Zix, the message decrypts on delivery without the portal step. This is the Zix-to-Zix delivery model that reduces friction between practices already on the platform.

The portal fallback is the workhorse for messages sent to patients, external providers, and vendors not on the Zix network. It ensures every regulated message reaches the recipient over an encrypted channel, without depending on the receiving server TLS configuration.

Sender Experience Stays Inside Gmail or Outlook

Zix does not require a separate compose window or a browser plugin. The sender uses the native Gmail or Outlook interface. They write the message, add attachments, and click Send. The gateway takes over from there.

For senders who want to manually flag a message as encrypted regardless of policy, Zix supports a subject line keyword such as [Secure] that forces encryption on that specific message. The keyword is configurable. Administrators can also add an Outlook button through a template deployment.

Sent items appear in the sender Sent folder as normal messages. The sender can view the encrypted status in the message tracking report on the Zix administrative console. Recipients who need a resent link contact the sender, who initiates a resend from the console.

This is the main sender-side advantage. Encryption becomes an infrastructure function rather than a per-message decision. The sender does not have to remember to encrypt because the gateway makes the decision on their behalf.

[mh_example]

Recipient Experience Depends on the Receiving Server

Recipients see one of three experiences based on their mail environment. The first is a plain email in the inbox, delivered over TLS with no portal step. This happens when the receiving server supports TLS and passes Zix directory checks.

The second is the portal experience. The recipient receives a notification email with a link. They click, sign in, and read the message in the Zix web portal. Attachments download inside the portal. Reply from the portal encrypts the reply automatically.

The third is the Zix-to-Zix direct delivery, where both organizations run Zix and messages flow encrypted end to end without a portal step. This is the highest-friction-reduction path but requires both sides on the same platform.

The portal experience adds a step for external recipients. That step is a source of friction for elderly patients, low-technology recipients, and one-off external contacts. The friction is worth it for regulated content, but it should be measured against portal-based services designed for lighter-touch recipient handoffs.

Pricing Reflects Enterprise Feature Set Rather Than Practice Size

Zix does not publish list pricing. Practices request a quote based on seat count, plan level, and add-on modules. Reported public pricing from third-party reviews runs from single digits per mailbox per month at the low end into higher tiers for full enterprise bundles.

Add-on modules include archiving with retention controls, data loss prevention with content classification, inbound threat protection with URL rewriting, and encryption gateways for regulated industries beyond HIPAA. Each module adds to the base per-seat cost.

The pricing reflects an enterprise buyer profile. Practices under twenty seats often find the plan structure heavier than the actual send volume of PHI justifies. The seat rate covers features many small practices never use, and the setup time cuts into practical value.

Buyers should compare quoted Zix pricing against portal-based services that include the BAA and encryption in a base per-seat rate without a gateway deployment. The healthcare website security features guide covers additional layers that combine with encrypted email for a full compliance stack.

zix email encryption in article illustration two

Setup Requires Directory Sync and Policy Tuning

Zix deployment starts with directory synchronization. The gateway needs to know which users belong to the practice, which addresses are external, and which domains belong to known covered entities or business associates. Administrators sync Active Directory or Google Workspace into the Zix console.

The next step is outbound routing. For Microsoft 365, this means an outbound connector pointing at the Zix hostname. For Google Workspace, this means an outbound gateway rule in Gmail routing. Every outbound message routes through the gateway from this point forward.

Policy tuning is the third step and typically the longest. The compliance officer or IT lead reviews the default HIPAA policy, adjusts the pattern matches for the specific practice, and monitors the first weeks of traffic for false positives and false negatives. This is an iterative process.

Inbound routing, if used, requires an inbound connector plus an MX record change to point the practice domain at the Zix inbound gateway. This is a bigger change that affects every inbound message. It should be tested carefully before cutover.

The Gateway Model Has Real Advantages for Multi-Site Practices

Multi-site practices with hundreds of users, mixed mail platforms, and complex compliance needs benefit from the gateway model. Centralized policy means one team owns the encryption rules across every location, regardless of local mail configuration.

The advantages compound with size:

  • Uniform enforcement across every mailbox in every location
  • Centralized reporting for compliance audits
  • Directory-based policy that adjusts as staff join and leave
  • Inbound threat protection bundled into the same gateway
  • Automated encryption on regulated content without user decision

Health systems with an internal IT team, a compliance officer, and established procurement processes match this profile. The gateway pays back its complexity through scale.

Practices under fifty users rarely see the same payback. The setup, tuning, and administrative time exceeds the benefit at that scale. That is where portal-based alternatives become more attractive.

[mh_protip]

Portal-Based Alternatives Skip the Gateway Deployment

Portal-based HIPAA email services take a different approach. There is no gateway between the mail server and the internet. The sender routes messages through the service either by using an add-in inside Gmail or Outlook, by sending through an SMTP relay, or by using a separate compose interface hosted by the vendor.

Mailhippo is an example of the portal model. It works with existing Gmail or Outlook accounts, includes a signed BAA in the base plan, and delivers encrypted messages through a portal link. There are no PGP keys, no S/MIME certificates, and no gateway policy tuning. One click on the send side, one link click on the recipient side.

The portal model trades automated policy detection for simplicity. The sender decides which message needs encryption. There is no gateway scanning body text for PHI patterns. For practices where staff already know which messages contain PHI, the manual decision costs less than the gateway tuning effort.

The right choice depends on the practice profile. Multi-site health systems match the gateway model. Small and mid-size practices often match the portal model. Both approaches satisfy HIPAA transmission security when configured correctly.

Zix Sits Inside a Broader HIPAA Email Toolkit

Zix is one of several methods HIPAA teams use for email transmission security. The full toolkit includes TLS as the transport baseline, S/MIME and PGP for message-level encryption, gateway services like Zix, and portal-based HIPAA email services.

Each method covers a different case:

  • TLS covers the base case where both mail servers support opportunistic encryption
  • S/MIME and PGP handle end-to-end encryption between technically fluent parties
  • Gateway services enforce policy across a large user base with mixed skill levels
  • Portal services deliver encrypted mail to any recipient with a browser

A practice choosing between Zix and a portal service should map its actual email flow. How many outbound PHI messages per week. How many external recipients. How many staff need to send encrypted mail. The answers point to the right model.

The broader HIPAA compliance picture also covers HIPAA-compliant website design, patient intake forms, and access controls on internal systems. Email is one leg of the compliance stack, not the entire picture.

Mailhippo as a Simpler Path to HIPAA Email Compliance

Practices that find the Zix gateway heavier than their send volume justifies often move to a portal-based service. Mailhippo secure email service works with existing Gmail or Outlook accounts, includes a signed BAA in the base plan, and delivers encrypted messages through a one-click recipient link with no keys or certificates.

The tradeoff is manual encryption. The sender chooses which message to encrypt. There is no gateway detecting PHI patterns in the body text. Staff who already know which messages contain PHI make the decision at compose time.

For small and mid-size practices, the portal model deploys faster, costs less per seat, and requires no IT time on gateway policy tuning. Compare quoted Zix pricing against Mailhippo pricing and factor in the setup time before deciding.

Both approaches meet HIPAA transmission security. The right choice depends on staff count, mail platform, external recipient mix, and internal IT capacity. Map your actual email flow before picking a platform.

[mh_faqs]

Posted on

Encrypting Emails in Outlook

encrypting emails in outlook guide featured image

[mh_key_takeaways]

Outlook supports three encryption paths. The Encrypt button, S/MIME certificates, and layered third-party services. Each has a specific plan requirement and a specific recipient experience.

For healthcare organizations and any team handling regulated data, encrypting emails in Outlook means matching the method to the license, the recipient, and the compliance requirement.

This guide covers the setup for Outlook desktop and Outlook on the web across the main Microsoft 365 tiers.

The Encrypt Button Uses Microsoft Purview Message Encryption

The Encrypt button in the Outlook Options ribbon triggers Microsoft Purview Message Encryption. This is the native Microsoft option for sending encrypted mail to recipients outside the sender tenant.

The button appears on Microsoft 365 Business Premium, Enterprise E3, Enterprise E5, and comparable Education plans. It does not appear on Business Basic or Business Standard because those tiers do not include Purview Message Encryption.

If the tenant is on a qualifying plan and the button is missing, an administrator needs to enable Azure Rights Management under the Microsoft 365 Admin Center. Once activated, the Encrypt button appears in Outlook within a few minutes.

According to Microsoft documentation, Purview Message Encryption meets HIPAA transmission requirements when combined with a signed BAA available on qualifying Microsoft 365 tiers.

Encrypt-Only and Do Not Forward Provide Different Levels of Control

Clicking the Encrypt button opens a dropdown with two main options. Encrypt-Only sends the message with encryption in transit and at rest. Do Not Forward adds rights-management controls that block the recipient from forwarding, copying, or printing.

Encrypt-Only is appropriate when the sender trusts the recipient to handle the message responsibly but wants to protect it from network interception and mailbox compromise. The recipient can forward it to others once they read it, in encrypted form.

Do Not Forward is stronger when the sender wants to limit downstream distribution. The rights-management layer prevents the recipient from forwarding or exporting the content. Screenshots still work, but the automated actions are blocked.

For HIPAA and regulated content, Encrypt-Only meets the transmission standard. Do Not Forward adds a layer of downstream control that is optional under HIPAA but often used as a matter of practice policy.

encrypting emails in outlook in article illustration one

Encrypt Button Step-by-Step in Outlook Desktop

Open Outlook desktop and click New Email. Fill in the recipient, subject, and body as usual. Click the Options tab in the ribbon.

Click Encrypt in the ribbon. A dropdown appears with Encrypt-Only and Do Not Forward. Select the option that matches the message. A banner appears at the top of the message confirming the selected encryption.

Click Send. Outlook encrypts the message through Microsoft Purview and delivers it to the recipient. Internal recipients on the same tenant see it inline in Outlook. External recipients receive a portal link.

  • The banner in the compose window confirms which encryption level is applied.
  • To remove encryption before sending, click Encrypt again and select the same option to toggle off.
  • The Sent folder shows a lock icon on the encrypted message.

Encrypt Button Step-by-Step in Outlook on the Web

Open Outlook on the web and click New Message. Fill in the recipient, subject, and body. Click the three-dot overflow menu at the top of the compose window.

Select Encrypt from the menu. A banner appears at the top of the message with the selected encryption level. The default is Encrypt-Only. To switch to Do Not Forward, click Change Permissions in the banner.

Click Send. The message is encrypted through Microsoft Purview and delivered. Internal recipients on the same tenant read it inline. External recipients on Gmail, Yahoo, iCloud, or other providers receive a link to the Microsoft portal.

If the Encrypt option does not appear in the overflow menu, the tenant has not enabled Purview Message Encryption. An administrator needs to activate it in the Microsoft 365 Admin Center before the option becomes visible.

[mh_example]

S/MIME Setup for Outlook Desktop

S/MIME is the certificate-based encryption standard built into Outlook. It provides end-to-end encryption between sender and recipient without a portal step. Both parties need certificates from a trusted authority.

Get a certificate from DigiCert, Sectigo, IdenTrust, or another trusted authority. The authority delivers a .pfx file containing the public certificate and private key. Import the file into the Windows certificate store on Windows or the macOS keychain on Mac.

Open Outlook and navigate to File, Options, Trust Center, Trust Center Settings, Email Security. Click Settings under Encrypted email. In the dialog, select the certificate for signing and encryption from the dropdown. Click OK and restart Outlook.

When composing a message, click Options, then click Sign and Encrypt icons in the More Options section. If the recipient has a valid S/MIME certificate that Outlook can verify, the encrypted send works. If not, Outlook prompts to send unencrypted.

encrypting emails in outlook in article illustration two

HIPAA Coverage in Microsoft 365 Has Boundaries

Microsoft signs a business associate agreement covering Microsoft 365 core services, including Exchange Online, when the tenant has accepted the BAA under the Microsoft Trust Center. The BAA covers the transmission and storage of PHI in Outlook.

The sender remains responsible for enabling encryption on every PHI transmission. The BAA does not automatically encrypt every message. Sending a PHI message without clicking Encrypt still results in transmission over TLS or plaintext, which does not meet the HIPAA transmission standard for regulated data.

For consistent enforcement, administrators can configure a data loss prevention rule under the Microsoft 365 Purview compliance portal that scans outbound messages for regulated patterns and applies encryption automatically. This is not enabled out of the box.

For practices on Business Basic or Business Standard without Purview Message Encryption, the practical path is a layered encrypted email service. This pairs with broader work covered in healthcare website security features.

Recipient Experience Depends on Their Mail Provider

Recipients on the same Microsoft 365 tenant see the message inline in Outlook or Outlook on the web. They do not click a portal link. The message opens like any other, with a lock icon indicating encryption.

Gmail users get a notification email with a link. They click the link and either sign in with their Google account or request a one-time passcode by email. They read the message in a Microsoft portal in their browser.

Yahoo, iCloud, AOL, and other recipients receive a one-time passcode by email and view the message in the Microsoft portal. They cannot sign in with their mail provider because those providers do not federate with Microsoft identity services.

Test the workflow with a known recipient before relying on it for time-sensitive delivery. Some corporate mail gateways strip the notification link or block the Microsoft portal domain. Testing surfaces those issues before the first real send.

[mh_protip]

Third-Party Services Close the Gap on Lower Microsoft 365 Tiers

Microsoft 365 Business Basic and Business Standard tenants do not have the Encrypt button. Upgrading every seat to Business Premium for the encryption feature is often more expensive than adding a purpose-built encrypted email service.

Mailhippo integrates with any Outlook or Microsoft 365 account through SMTP relay or a plug-in. The sender continues to write and send from Outlook. The service intercepts the message, encrypts it, and delivers over TLS or through a portal fallback.

The service includes a signed BAA in the base plan and logs every message access. The recipient experience is a single click and passcode. No key management, no software install for the recipient.

For healthcare organizations coordinating email with website work, this pairs with services covered in healthcare marketing.

Verify Encryption on Every Sensitive Send

Before hitting Send on a regulated message, verify the encryption is active. In Outlook desktop, the banner at the top of the compose window shows Encrypt-Only or Do Not Forward. In Outlook on the web, the same banner appears.

For S/MIME, the Sign and Encrypt buttons in the Options ribbon show as active. The message icon in the Sent folder shows a lock. If the message went out without those indicators, encryption did not apply.

Microsoft 365 administrators can audit encryption status in the Purview compliance portal under Message Trace. This shows every outbound message with its encryption status, useful for HIPAA risk assessments and periodic compliance reviews.

According to HIPAA Journal, the most common documented compliance failure is a sender forgetting to enable encryption on a PHI message. Verification per send is the single most effective preventive control.

Choose the Outlook Path Based on Plan and Recipient

Match the encryption approach to the Microsoft 365 tier and the target recipient. Business Premium and above have the Encrypt button for a Microsoft-native experience. Business Basic and Business Standard need either an upgrade or a layered service.

  • Business Premium or higher, external recipients: Encrypt button with Purview Message Encryption.
  • Any tier, internal certified users: S/MIME with corporate certificates.
  • Business Basic or Business Standard, external recipients: layered HIPAA-compliant service.
  • Any tier, mixed compliance needs, patients as recipients: layered service with portal fallback.

For deeper coverage on related methods, see the sibling guides encrypting email in Outlook, encrypting an email, and how to open encrypted emails in Outlook.

The final point is that Outlook makes encryption easy on the right plan and unavailable on the wrong plan. Match the tool to the tier, and verify every sensitive send.

[mh_faqs]

Posted on

How to Open an Encrypted Email in Outlook Step by Step

how to open an encrypted email in outlook guide featured image

[mh_key_takeaways]

Opening an encrypted email in Outlook depends on the method the sender used. Microsoft Purview Message Encryption, S/MIME certificates, and third-party portal services each present a different recipient path. The steps take about a minute once the recipient identifies the method.

This guide covers how to open an encrypted email in Outlook across each method. It also covers the common errors that break the flow and how to fix them without a support call to the sender.

Look at the notification message first. The From address and the button label identify the method. That determines the correct opening steps.

Microsoft Purview Messages Open Through the Browser Portal

Microsoft Purview Message Encryption is the default encryption service for Microsoft 365. Recipients see a notification email in the Outlook inbox with a Read the message button. The From address usually reads microsoft@ or the sending organization plus a service address.

Click the Read the message button. A browser tab opens on outlook.office365.com. The tab shows three sign-in options: sign in with a Microsoft account, sign in with a Google account, or request a one-time passcode.

Choose the option that matches the recipient address. Microsoft accounts cover Outlook.com, Hotmail, Live, and Microsoft 365 tenants. Google accounts cover Gmail and Google Workspace. The passcode option works for any address, including personal accounts on other providers.

Once signed in or after entering the passcode, the decrypted message displays inline. Attachments appear below with download buttons. Detailed steps are in the Microsoft support guide for opening protected messages.

The One-Time Passcode Option Works for Any Recipient

The one-time passcode option is the universal fallback across every Purview message. Recipients who do not want to sign in with an existing account choose the passcode path.

The steps are:

  • Click the Read the message button in the notification
  • Choose the one-time passcode option on the sign-in screen
  • Check the same email inbox for the passcode email
  • Copy the passcode and paste it into the browser
  • View the decrypted message with attachments

The passcode email typically arrives within one minute. Check spam if it does not appear. Corporate mail servers sometimes quarantine passcode emails from Microsoft, and the IT team needs to release the message.

Passcodes expire after fifteen minutes. If the code expires before use, request a new one from the same browser tab. The new passcode arrives in a fresh email.

how to open an encrypted email in outlook in article illustration one

S/MIME Messages Decrypt Inline in Outlook

S/MIME encrypted messages open inline in Outlook when the recipient certificate is installed. The message displays in the reading pane with a lock icon in the header. No browser tab, no portal, no passcode.

The lock icon confirms encryption. Clicking the icon shows the encryption method, the certificate details, and the trust chain. Attachments open normally in the client after decryption.

If the certificate is missing, expired, or from an untrusted authority, Outlook shows the message as ciphertext or displays a security warning. The message body reads as encoded data instead of readable text.

The fix is certificate installation or renewal through the Trust Center. Go to File, Options, Trust Center, Trust Center Settings, Email Security. Add the certificate under Digital IDs or renew the existing certificate through the issuing authority.

Third-Party Portal Notifications Contain a Portal Link

Third-party encrypted email services deliver a notification email with a portal link. Common services include Proofpoint Encryption, Cisco Registered Envelope, and gateway-based services deployed by health systems or financial institutions.

The notification usually has a Click here to read your secure message button, a Register button, or an attached file called securedoc.html or message.html. Clicking the button or opening the attachment loads the vendor portal in a browser.

First-time recipients register with the email address and set a password. The registration screen asks for a name, an email address, and a password meeting the length and character requirements the sending organization configured.

Repeat recipients sign in with the existing password. The portal shows the decrypted message body and any attachments. Reply from inside the portal encrypts the reply back to the sender. Password reset works from a Forgot password link on the sign-in page.

[mh_example]

Attachments Follow the Message Encryption Method

Attachments in encrypted email decrypt through the same method as the message body. The recipient path varies by service but the underlying encryption is applied to the entire message envelope, body and attachments together.

Purview Encrypt-Only attachments appear in the browser tab below the message body with download buttons. Purview Do Not Forward attachments may show as preview only with no download. S/MIME attachments open in the Outlook client after the message decrypts. Portal attachments stay inside the portal.

Downloaded attachments lose the sender-side encryption once saved locally. The file on the local disk is subject to the standard local file protection rules. HIPAA still applies to the file content, but the encryption service does not continue to control the file after download.

Recipients working in a HIPAA-covered role should confirm the local file protection before saving. Practices should also configure local storage encryption on managed devices to protect downloaded attachments.

how to open an encrypted email in outlook in article illustration two

Reply From the Portal Keeps Encryption End to End

Every major encrypted email platform includes a Reply button inside the portal or browser tab. Replies sent from the portal encrypt automatically. The response reaches the sender through the same secure channel.

Do not reply from the notification email itself. The notification is a plaintext email that only alerts the recipient. A reply from the notification goes to a platform service address, not to the sender, and is often auto-discarded.

Portal replies maintain the audit trail for HIPAA and other compliance regimes that require encrypted responses to encrypted communications. The sender receives the reply through the same platform they used to send the original.

If the portal does not include a Reply button, the sender likely disabled reply as a policy setting. Contact the sender through a separate secure channel to continue the conversation.

Outlook Mobile Follows the Same Path

Outlook mobile on iOS and Android supports Purview Message Encryption through the same Read the message button. The notification email arrives in the mobile inbox. Tap the button to open the browser tab.

Sign in with the Microsoft account, Google account, or one-time passcode option. The decrypted message displays in the mobile browser. Attachments open in the browser or hand off to another app for download.

S/MIME on mobile requires a certificate installed through a Configuration Profile. Mobile device management deploys the profile to managed devices. Personal devices without MDM need manual certificate installation through the Settings app on iOS or the certificate manager on Android.

Third-party portal services provide mobile-friendly web interfaces or dedicated apps. Proofpoint, Cisco Registered Envelope, and Mailhippo all support mobile recipient flows through the mobile browser without an app install.

[mh_protip]

Common Errors and How to Fix Them

Encrypted email in Outlook works reliably most of the time. Common errors that break the flow include missing certificate for S/MIME, expired notification link, passcode delivery to spam, and browser cache issues on the portal.

The quick fixes are:

  • Missing certificate: install or renew through the Trust Center
  • Expired link: contact the sender for a resend
  • Passcode in spam: check spam folder, request a new code
  • Browser cache issue: try an incognito or private window
  • Corporate quarantine: ask IT to release the message from the queue

Recipients on managed devices sometimes have browser restrictions that block the portal load. Try a different browser or ask IT to allow the portal domain in the browser policy. The domains vary by service. Purview uses outlook.office365.com.

If none of the fixes work, contact the sender for an alternate delivery method. Some services support a plaintext fallback for recipients who cannot open the encrypted message. This should be used only when the content is not regulated.

The Recipient Experience Determines Adoption

The single largest factor in encrypted email adoption is the recipient experience. Every step the recipient has to take lowers the open rate on regulated messages. Every extra sign-in or password reset lowers it further.

Practices sending encrypted mail to patients should track the open rate. If the rate drops significantly compared to regular mail, the recipient path is too long. Switch to a shorter path or add a heads-up plaintext email that primes the recipient for the encrypted delivery.

Front-desk staff should be trained to answer opening questions on the phone. A one-minute walk-through solves most confusion at the notification step. Patients who need a resend often just need someone to confirm the sender is legitimate.

The HIPAA-compliant website design approach uses the same principle for patient portals. Shorter steps, fewer clicks, higher completion.

Mailhippo Uses a One-Click Recipient Link

Mailhippo secure email service delivers encrypted messages through a one-click link with no account creation for the recipient. Recipients click the link, enter a one-time passcode delivered to the same email address, and read the message.

The signed BAA is included in the base plan. Attachments open inline. Replies encrypt automatically. There are no keys, no certificates, and no password reset on the recipient side. This is the shortest recipient path among common HIPAA email options.

For healthcare practices sending encrypted mail to patients on Outlook, Gmail, Yahoo, or other providers, the shorter recipient path directly raises the open rate on regulated messages. Front-desk staff spend less time walking patients through portal registration.

The broader compliance stack pairs encrypted email with healthcare website security features, patient portal configuration, and internal access controls. Encrypted email is one layer. The full stack covers the practice end to end.

[mh_faqs]

Posted on

Office 365 Email Encryption Setup and HIPAA Configuration

office 365 email encryption guide featured image

[mh_key_takeaways]

Office 365 email encryption runs on Microsoft Purview Message Encryption. The service ships with Business Premium and higher plans. It powers the Encrypt button in the Outlook ribbon and handles external recipient delivery through a browser portal.

This guide covers the Office 365 email encryption setup, the license structure, the recipient experience, and the HIPAA configuration. It also covers the fit for a separate encrypted email service when the Office 365 plan does not include the Encrypt button.

The choice depends on plan level, seat count, and how many staff need to send PHI. Read each section and match the approach to the actual practice flow.

Purview Message Encryption Powers the Encrypt Button

Microsoft Purview Message Encryption is the underlying service for the Encrypt button in Outlook. The button appears in the Options ribbon on new messages. Users click Encrypt and pick Encrypt-Only or Do Not Forward.

Encrypt-Only encrypts the message content in transit and at rest. Recipients can reply, forward, and print. Do Not Forward applies rights management and blocks forward, print, and download. The sender picks based on the sensitivity of the content.

Both options deliver to internal Microsoft 365 recipients inline. Both options deliver to external recipients through a notification email with a browser tab open on outlook.office365.com. The recipient experience is consistent across the two options.

Detailed sender steps are in the Microsoft support guide for encrypted messages in Outlook.

License Tiers Determine Access to Encryption

The Encrypt button in Office 365 is not available on every plan. The license tier determines whether the feature appears in Outlook. Practices should confirm the plan level before assuming encryption is available.

The plans that include Purview Message Encryption are:

  • Microsoft 365 Business Premium
  • Microsoft 365 E3 and E5
  • Office 365 E3 and E5
  • Microsoft 365 Apps for Enterprise with Azure Information Protection Premium
  • Standalone Azure Information Protection Premium P1 or P2

Plans that do not include the Encrypt button are Microsoft 365 Business Basic, Microsoft 365 Business Standard, Microsoft 365 Apps for Business, and Office 365 E1. Users on these plans do not see the Encrypt button in Outlook.

Adding the button requires either a plan upgrade or a per-seat Azure Information Protection Premium license add-on. The choice depends on how many features of Business Premium the practice needs beyond encryption.

office 365 email encryption in article illustration one

Tenant Setup Takes Thirty Minutes on a Fresh Deployment

Enabling encryption on a fresh tenant takes about thirty minutes. The setup happens entirely in the Microsoft 365 admin center. No changes to individual mailboxes or client software are required.

The steps are: sign in as global administrator, activate Azure Rights Management under Settings and Org settings, verify Message Encryption availability under the compliance section, configure the default template that recipients see, and confirm license assignment for the users who will send encrypted mail.

Existing tenants with Azure Information Protection already licensed do not need additional activation. The Encrypt button appears in Outlook after the client restart. Administrators can push the setting through Group Policy or MDM to ensure consistent behavior across the fleet.

Test the setup with a small pilot group before rolling out to all users. Send an encrypted message to an external recipient. Confirm the notification, the browser tab, and the decrypted message. Fix any policy or template issues before wide rollout.

Comparing Office 365 Encryption Options at a Glance

Office 365 supports several encryption methods with different fit profiles. The right choice depends on recipient mix, plan level, and administrative overhead.

Method Recipient Setup Plan Required Best Fit
Purview Message Encryption Browser tab, sign-in or passcode Business Premium or higher External patient and vendor mail
S/MIME Certificate pre-installed Any plan with desktop Outlook Internal mail with managed PKI
Sensitivity Labels Depends on label configuration E3 or E5 Enterprise policy-based encryption
Mail flow rule Encrypt-Only Same as Purview portal Business Premium or higher Automated encryption on patterns
Third-party HIPAA service One-click portal link Any Office 365 plan Small practices on Business Basic or Standard

Practices with mostly external recipients on personal accounts choose Purview or a third-party HIPAA service. Practices with mostly internal or partner mail choose S/MIME. Enterprise deployments use Sensitivity Labels for policy-driven automation.

Map the send flow before committing. How many external recipients per week. How often the recipient list changes. How many staff need to send encrypted mail. The answers point to the right method.

[mh_example]

The BAA Is Included in Every Microsoft 365 Tenant

Microsoft signs a business associate agreement covering the Microsoft 365 services under the standard BAA terms. The BAA is available at no extra cost. Administrators accept it in the Microsoft 365 admin center.

The BAA covers Exchange Online, SharePoint Online, OneDrive for Business, Teams, and the Purview compliance services. It applies to the tenant from the acceptance date forward. New services added to the tenant fall under the BAA automatically if Microsoft lists them as covered.

The BAA does not cover consumer services like Outlook.com or Hotmail. Practices using consumer accounts for patient mail need to move to a business tenant to fall under the BAA. This is a common misconfiguration that HIPAA auditors flag.

The HHS guidance on business associate agreements lists the terms required. Confirm the Microsoft BAA against the HHS requirements at the time of tenant setup.

office 365 email encryption in article illustration two

Sensitivity Labels Automate the Encryption Decision

Sensitivity Labels are the automated version of the Encrypt button. Administrators define labels in the Microsoft Purview compliance portal and configure rules that flag messages containing PHI or other regulated fields.

Applied labels can require encryption automatically, restrict forwarding, block download of attachments, and apply retention rules. The sender does not have to decide. The label is applied by policy based on the message content.

Deployment requires Microsoft 365 E3 or E5 licensing and Purview Information Protection configuration. Content patterns, sensitive information types, and label rules all need to be defined. This is a significant setup effort.

Sensitivity Labels pay back at enterprise scale where hundreds of users benefit from centralized policy. Small practices usually do not see the same payback and use the manual Encrypt button or a third-party service instead.

Mail Flow Rules Enforce Encryption on Patterns

Mail flow rules in Exchange Online provide a middle ground between manual Encrypt and full Sensitivity Labels. Administrators create rules in the Exchange admin center under Mail flow, Rules.

Rules match on conditions such as message subject containing a keyword, recipient domain matching a known partner, sender belonging to a specific group, or content matching a sensitive information type. Matched messages apply the Encrypt-Only or Do Not Forward template automatically.

This automation removes the sender decision on the most common regulated flows. A rule that encrypts every message with subject line containing [PHI] covers a large fraction of patient-record sends without training staff on the Encrypt button.

Mail flow rules also work as a safety net alongside manual Encrypt. If a sender forgets to click Encrypt but includes a PHI pattern in the body, the rule catches the message and applies encryption automatically.

[mh_protip]

GoDaddy-Provisioned Office 365 Follows the Same Structure

Office 365 licenses provisioned through GoDaddy follow the same plan and feature structure as direct Microsoft licenses. The Encrypt button appears on the same Business Premium and higher plans. The BAA is available in the same admin center.

Practices that provisioned Office 365 through GoDaddy sometimes cannot find the compliance settings because the admin panel is a subset of the full Microsoft 365 admin center. In that case, administrators can access the full center at admin.microsoft.com using the same credentials.

The BAA and the Purview settings are available in the full admin center. GoDaddy does not restrict access to compliance features. The initial setup routes through the GoDaddy dashboard, but administrators can move to the Microsoft admin center for full configuration.

Practices that need the Encrypt button and are on a GoDaddy Business Basic subscription should upgrade to Business Premium in the GoDaddy dashboard, or add per-seat Azure Information Protection through the Microsoft admin center.

Practices on Lower Plans Have Three Practical Options

Practices on Business Basic or Business Standard face a choice when they need encrypted email for HIPAA. The Encrypt button is not available on their plan. They have three practical options.

Option one is a full plan upgrade to Business Premium. This adds encryption, advanced threat protection, and device management at around ten dollars extra per seat per month. It fits practices that will use the other Business Premium features beyond encryption.

Option two is a per-seat Azure Information Protection Premium P1 add-on. This adds encryption without upgrading the base plan. Cost runs about two dollars per seat per month. It fits practices that only need encryption and not the other Business Premium features.

Option three is a dedicated HIPAA email service that works alongside Office 365. The service handles PHI-containing mail through its own encryption and BAA. Office 365 handles general mail. This fits practices where only a fraction of staff handle regulated content.

Mailhippo Works Alongside Office 365 for HIPAA Mail

Mailhippo secure email service works alongside Office 365 without changing the plan structure. The signed BAA is included in the base plan. Practices keep Office 365 for general mail and use Mailhippo for patient-facing PHI.

The sender uses Office 365 for internal communication, scheduling, and vendor mail. When a message contains PHI, the sender routes it through Mailhippo either from a browser interface or from an Outlook add-in. The message encrypts, delivers to the recipient link, and logs the send in the audit trail.

The recipient opens the message through a one-click link with a one-time passcode delivered to the same email address. No account creation, no password reset, no software install. This is the shortest recipient path among common HIPAA options.

The broader compliance stack pairs encrypted email with HIPAA-compliant website design and patient portal configuration. Encrypted email is one layer of the stack. The full stack covers the practice end to end.

[mh_faqs]

Posted on

How to Send Encrypted Emails Across Outlook Gmail and Yahoo

how to send encrypted emails guide featured image

[mh_key_takeaways]

Sending an encrypted email means applying an encryption method before the message leaves the sender. The specific steps vary by platform. Outlook, Gmail, Yahoo, and GoDaddy each handle encryption differently, and each has gaps that a dedicated service can fill.

This guide walks through the sender steps for each platform, covers attachments and password-protected files, and identifies where a HIPAA-focused encrypted email service fits the workflow.

The underlying protection is the same across methods. Content is unreadable to anyone without the correct key or credential. The differences are in setup, license, and recipient experience.

Sending an Encrypted Email in Outlook Uses Purview

The Outlook path starts in the compose ribbon of a new message. Click Options, then Encrypt, and pick a policy. Two policies are available: Encrypt-Only and Do Not Forward.

Encrypt-Only encrypts the content and lets the recipient reply, forward, and print. Do Not Forward encrypts the content and blocks forward, print, and download. The sender picks the policy at send time.

The tenant must be on Microsoft 365 Business Premium or higher for the Encrypt button to appear. Business Basic and Business Standard do not include the button. Adding it requires an upgrade or a per-seat license add-on.

External recipients see a notification with a Read the message button. The button opens outlook.office365.com in a browser. The recipient signs in with a Microsoft or Google account or requests a one-time passcode. Detailed steps are in the Microsoft support guide for encrypted messages in Outlook.

Sending an Encrypted Email in Gmail Depends on Workspace Plan

Gmail on Google Workspace Enterprise Plus or Education Plus supports client-side encryption. The admin enables it in the Google Admin console under Security, Access and data control, Client-side encryption. Users see a lock icon in the compose window.

The lock icon toggles encryption on for the message. The message content is encrypted in the browser before it reaches Google servers. The keys stay outside Google through a customer-controlled external key service.

Standard Workspace plans and personal Gmail do not support client-side encryption. Confidential mode is available on every Gmail account. Confidential mode sets an expiration date and disables forward, copy, print, and download. It does not encrypt content in a way that meets HIPAA transmission requirements.

Practices on standard Workspace plans that need encryption for HIPAA route outbound mail through a HIPAA email service. The Gmail interface stays the same. The encryption applies at the service layer.

how to send encrypted emails in article illustration one

Sending an Encrypted Email in Yahoo Requires a Workaround

Yahoo Mail does not offer native message-level encryption on standard consumer or business accounts. There is no Encrypt button in the Yahoo compose window equivalent to the Outlook or Gmail options.

Yahoo users send encrypted mail through one of three workarounds:

  • Install a browser extension such as Mailvelope that adds PGP support to the Yahoo web interface.
  • Attach a password-protected ZIP file to the message and share the password through a separate channel.
  • Route outbound mail through a HIPAA email service that adds encryption at the outbound gateway.

Yahoo does not sign a business associate agreement for consumer accounts. The platform is not appropriate for PHI regardless of the encryption workaround. Practices sending regulated content should move to a compliant mail platform rather than relying on Yahoo with encryption bolted on.

Sending an Encrypted Email From GoDaddy Requires a Third-Party Layer

GoDaddy Professional Email is hosted mail on the godaddy.com or a custom domain. The service does not offer native message-level encryption in the web interface or in the standard IMAP client access.

Practices using GoDaddy for hosted email send encrypted mail through one of three options. Add a third-party S/MIME certificate to Outlook or Apple Mail connected to the GoDaddy account. Use a browser extension that supports PGP or S/MIME. Route outbound mail through a HIPAA email service.

GoDaddy signs a business associate agreement for some hosted email plans through a separate compliance add-on. The BAA covers storage of PHI on GoDaddy infrastructure. It does not cover the encryption of outbound transmission automatically.

Practices sending PHI from GoDaddy typically pair the account with a dedicated encryption service. The GoDaddy account handles inbound receipt and stored mail. The encryption service handles the outbound HIPAA-required protection.

[mh_example]

Sending Encrypted Files Uses the Same Message Encryption Path

Encrypted files travel as message attachments protected by the same encryption applied to the message body. S/MIME, PGP, Microsoft Purview, Google client-side encryption, and HIPAA email services all treat the attachment as part of the encrypted message.

The recipient sees one verification step. After the sign-in or key decryption, both the body and the attachments become readable. Do Not Forward rights in Microsoft Purview show attachments in the portal preview and block download.

Attachment size limits apply. Outlook caps standard attachments at 20 megabytes. Gmail caps at 25 megabytes. Larger files exceed the limit before encryption is even attempted. The message bounces with a size error.

For large files, use a HIPAA-compliant file transfer service and put the link in the message body. The email delivers the link. The file service handles the payload with its own encryption at rest and in transit.

how to send encrypted emails in article illustration two

Sending a Password-Protected File as a Workaround

Sending a password-protected file through email is a common workaround for accounts without full encryption. The sender ZIP-encrypts the file with a password and attaches the ZIP to the message.

Tools that support AES-256 encryption include 7-Zip, WinRAR, and the built-in Archive Utility on macOS with a strong password. The encrypted ZIP is unreadable without the password. This protects the file at rest and in transit.

The password must go through a separate channel. Phone call, text message, or a secure messaging app all work. Never include the password in the same email as the encrypted attachment. That defeats the encryption.

Password-protected attachments do not meet the HIPAA requirement for encrypted transmission of PHI when the message body itself contains identifying information. The workaround protects the file but leaves the body exposed. Dedicated encryption remains the required control for regulated content.

Sender Steps Compared Across Platforms

The sender view differs across platforms. The table below summarizes the steps and license requirements for each.

Platform Sender Step License Required Recipient Experience
Outlook Options, Encrypt, pick policy Business Premium or higher Portal sign-in or passcode
Gmail (Workspace) Lock icon in compose Enterprise Plus or Education Plus Portal sign-in with key service
Yahoo Browser extension or gateway None native Depends on workaround
GoDaddy Third-party layer None native Depends on layer added
HIPAA Email Service Send Secure button or automatic Service subscription One-click portal, no account creation

The service approach is the shortest path for accounts without built-in encryption. It also fits practices on Business Premium or Enterprise Plus that want a simpler recipient experience for patient communication.

[mh_protip]

Sending Encrypted Mail to Recipients With No Encryption Setup

The most common friction point in sending encrypted mail is the recipient. A patient with a personal Gmail account does not have S/MIME certificates. A small business partner may not know how to use PGP.

Portal-based encryption solves this. Microsoft Purview and most HIPAA email services deliver the recipient a notification with a link. The recipient clicks the link, authenticates with a sign-in or one-time passcode, and reads the message in a browser.

The recipient does not install anything. The recipient does not need a specific mail client. The recipient does not need to hold any cryptographic material. The portal experience matches how patients already use online banking or telehealth portals.

Practices sending to patients almost always want the portal experience for this reason. The one-click access matches patient tech literacy across a broad population.

HIPAA Applies to Encryption Choices for Covered Entities

Covered entities and business associates operate under the HIPAA Security Rule. Encryption is one required technical safeguard. The HHS Security Rule guidance treats encryption as an addressable specification.

Addressable does not mean optional. The covered entity must either implement encryption or document why an alternative safeguard is reasonable. Most compliance reviews expect encryption on any transmission of PHI outside the internal network.

The sending platform must also have a signed business associate agreement in place with the covered entity. Microsoft 365 and Google Workspace include a BAA as part of the standard business terms. Personal Gmail and consumer Yahoo do not.

Practices building the wider HIPAA posture around encrypted mail also need to cover the website and patient portal. See the guide on healthcare website security features for the site-side controls.

Dedicated HIPAA Email Services Simplify the Sender Workflow

A dedicated HIPAA email service handles the encryption, the BAA, the access logs, and the recipient portal in a single plan. The sender writes mail in a familiar Gmail or Outlook interface.

Mailhippo is one option in this category. It works with existing Gmail and Outlook accounts. The BAA is included in the base plan. Encryption applies to every outbound message. Recipients open messages with one click, without creating a Microsoft or Google account.

Related reading covers the platform-specific how-tos: how to send varracuda encrypted email, how to send encrypted email, how to send an encrypted email, how to send encrypted email using gmail, send encrypted email, and how to send encrypted email via comcast.

Practices coordinating encrypted email with a wider healthcare digital strategy often pair the mail service with a compliant site and portal setup. A healthcare marketing agency handles the marketing overlay on top of the compliance stack.

[mh_faqs]

2637 E. Atlantic Blvd.
#1063 Pompano Beach, FL 33062

© 2026 MailHippo, Inc.

View our Privacy Policy or contact our Customer Service team.

Optometrist Marketing Agency – Web Design, SEO, PPC & Maintenance