HorizLogoSm.fw_.png
Start Trial

Tag: s mime

Posted on

S/MIME Email Encryption Explained for Business and Healthcare

s mime email encryption guide featured image

[mh_key_takeaways]

S/MIME email encryption is one of the two dominant standards for message-level email security. It uses X.509 certificates issued by a trusted certificate authority to sign and encrypt mail directly in Outlook, Apple Mail, and Google Workspace Gmail.

This guide covers how S/MIME works, where it fits in a business or healthcare workflow, and where it fails in practice. It also shows when a portal-based encrypted email service is the better operational choice.

S/MIME is documented in IETF RFC 8551. It has been in wide use since the late 1990s. The standard is stable, but real-world adoption depends on how each mail client handles certificates.

S/MIME Uses X.509 Certificates for Sign and Encrypt

Every S/MIME user holds a keypair. The public key sits inside an X.509 certificate issued by a certificate authority. The private key stays on the user device.

Signing works like this. The sender client computes a hash of the message and encrypts that hash with the sender private key. The recipient client decrypts the signature with the sender public key and verifies the hash matches the received message.

Encryption works the reverse way. The sender client encrypts the message body with the recipient public key. Only the recipient private key can decrypt the body.

Signing proves identity. Encryption protects content. A message can be signed only, encrypted only, or both. Most business setups sign every outbound message and encrypt only when the content warrants the extra step.

How S/MIME Email Encryption Works End to End

The sender writes a message and clicks encrypt. The mail client looks up the recipient certificate in its address book. If the certificate is not present, encryption fails and the client prompts for a public key.

Once the recipient certificate is available, the client generates a random symmetric session key. It encrypts the message body with that session key. It then encrypts the session key with the recipient public key.

Both the encrypted session key and the encrypted body are packaged into a MIME container and sent. The mail servers see only an encrypted blob. They cannot inspect content, run keyword rules, or scan for malware inside the encrypted portion.

The recipient client decrypts the session key with the recipient private key. It then decrypts the body with the session key. This hybrid approach uses public key cryptography only for the small session key, which is much faster than encrypting the whole body asymmetrically.

s mime email encryption in article illustration one

Certificate Acquisition and Installation Are the First Hurdle

A user needs a valid S/MIME certificate before they can send or receive encrypted mail. Certificates come from public CAs, corporate PKI systems, or free personal issuers.

Public CA options include Sectigo, DigiCert, GlobalSign, and Actalis. Prices range from free personal certificates to $200 per user per year for higher assurance levels. The email address in the certificate must match the address the user sends from.

Corporate deployments use Active Directory Certificate Services on Windows Server or a hosted PKI service. Certificates issue automatically to domain-joined machines through group policy. This is the workflow at hospitals and large insurance carriers.

Installation involves importing the PKCS 12 file into the mail client certificate store. The private key must be marked non-exportable in enterprise deployments to prevent theft. Backup happens through key escrow held by IT.

Outlook Supports S/MIME on Microsoft 365 Business Standard and Above

Outlook on Windows, Mac, and Outlook on the web all support S/MIME. The user installs a certificate, opens Options, and selects Trust Center, then Email Security.

Under Encrypted email, the user picks a certificate for signing and a certificate for encryption. These are often the same certificate. The user chooses whether to sign or encrypt outgoing messages by default.

Once configured, a new lock icon and signature icon appear in the compose window. The user toggles them per message. Address book entries for recipients cache public certificates as they arrive on signed messages.

Microsoft published detailed S/MIME configuration guidance for Exchange Online and Outlook. Admins deploying S/MIME across a tenant should follow that guidance rather than a per-user manual install path.

[mh_example]

Gmail Supports Hosted S/MIME on Enterprise and Education Tiers

Google Workspace supports S/MIME on Enterprise Standard, Enterprise Plus, Education Standard, and Education Plus. Personal Gmail and Business Starter, Standard, and Plus do not support S/MIME.

The admin uploads root and intermediate CA certificates in the Google Admin console. They then enable S/MIME for the organizational unit. Individual users upload their personal certificate through Gmail settings under Accounts.

Once uploaded, a lock icon appears next to the recipient field in the Gmail compose window. Green means an encrypted message is possible because the recipient certificate is on file. Gray means encryption is not available for that recipient.

Google documents the setup at the Google Workspace admin help center. Practices considering the Enterprise upgrade for S/MIME should weigh the per-user cost difference against a gateway alternative that works on Business Standard and Plus.

s mime email encryption in article illustration two

S/MIME and HIPAA Compliance Have Real Alignment

HIPAA requires the covered entity to implement technical safeguards for PHI in transit and at rest. S/MIME provides encryption at the message level, which covers both transit and storage on the recipient side.

A signed BAA with the mail provider handles the business associate relationship. Microsoft 365 and Google Workspace on Business Standard and above both offer a BAA. The CA that issues S/MIME certificates is usually not a business associate because it never handles PHI content.

Where S/MIME clears HIPAA is peer-to-peer clinical email between certificate-holding parties. Where it fails is patient-facing mail, because patients do not hold certificates. Practices sending PHI to patients need a portal service or a secure messaging platform. See the general framing on healthcare website security features for context on how email fits inside the wider stack.

Documentation matters. HIPAA auditors want to see certificate lifecycle records, key backup procedures, and workforce training on encryption use. A policy document that describes when to sign and when to encrypt is required for a defensible S/MIME program.

Common S/MIME Failure Modes and Their Fixes

Certificate expiration is the top cause of S/MIME failures. Certificates typically renew every one to three years. A missed renewal breaks all signing and encryption on the day of expiry.

Address mismatch is the second most common problem. If the certificate email address does not exactly match the sender From address, the recipient client shows a security warning and sometimes blocks the message. Aliases and shared mailboxes trigger this often.

Common S/MIME failure modes include:

  • Expired sender or recipient certificate
  • Missing intermediate CA in the recipient trust store
  • Sender From address does not match certificate email
  • Recipient never exchanged a signed message, so no public key is cached
  • Private key lost during mailbox migration or device replacement
  • Mobile client without certificate provisioning receives content as an unopenable attachment

Related linked topic: email encryption software for a broader look at tools that address these failure modes automatically.

[mh_protip]

S/MIME Versus PGP for Business Use

S/MIME and PGP solve the same problem with different trust models. S/MIME uses centralized certificate authorities. PGP uses a web of trust where users sign each other public keys.

For business use, S/MIME wins on native client support. Outlook, Apple Mail, and enterprise Gmail all handle S/MIME without plugins. PGP requires a plugin like GPG Suite for Apple Mail or Mailvelope for Gmail.

PGP wins on cost and independence. There is no CA to pay, and no gatekeeper to trust. That makes PGP popular with journalists and open source projects but rare in regulated business workflows where auditability is required.

Related context: email encryption as a broader category, and email encryption service for hosted options that hide the S/MIME versus PGP choice behind a portal.

S/MIME Comparison With Other Encryption Methods

The table below sets S/MIME against the other common methods a business considers.

Method Trust Model Native Client Support Recipient Setup Required Fit for HIPAA
S/MIME X.509 CA Outlook, Apple Mail, Gmail Enterprise Certificate install Peer to peer only
PGP Web of trust Plugins in most clients Keyring install Rare in healthcare
TLS only Server certificate All modern clients None In transit only
Portal gateway Vendor account Any browser Password or one-time code Patient and peer both work

Most healthcare practices end up with a mix. S/MIME for peer clinics that hold certificates and a portal for patients and one-off external contacts. See related coverage in secure email encryption service and encryption for email.

When to Use S/MIME and When to Use a Gateway

Use S/MIME when the organization already runs on Microsoft 365 Business Standard or higher, or Google Workspace Enterprise, and the recipient set is stable and technical. Peer clinics, insurance carriers, and referring specialists fit this pattern.

Use a gateway when recipients are variable, include patients, or refuse to install certificates. Portal-based services handle any recipient with any browser. The tradeoff is the extra click on the recipient side.

Mailhippo is a portal gateway that sits on top of Gmail or Outlook, includes a BAA in the base plan, and requires no per-user certificate management. It complements an S/MIME deployment rather than replacing it. Peer traffic can still run over S/MIME. Patient traffic runs through the gateway.

Practices building a compliant public-facing site alongside their email strategy often pair encryption planning with HIPAA-conscious website design so intake, contact, and email flows all stay inside the same compliance boundary.

[mh_faqs]

Posted on

Encryption and Email Security in a Layered Stack

encryption and email guide featured image

[mh_key_takeaways]

Encryption is a checkbox item on most email security procurement forms. It sits next to inbound filtering, DLP, archiving, and identity controls. Buyers who focus on one checkbox at a time miss how the layers depend on each other.

This guide covers how encryption and email security fit together in a working stack. Where a healthcare team needs the outbound layer without integrating four vendors, a dedicated secure email service with a BAA in the base plan often solves the immediate compliance gap.

Read the sections in order. Each layer covers a different threat and a different auditor concern.

The Email Security Stack Has Five Layers

A complete email security posture combines five functional layers. Each addresses a different risk.

  • Inbound filtering removes phishing, malware, and business email compromise before delivery.
  • Identity controls including MFA and conditional access stop credential theft at the mailbox.
  • DLP scans outbound messages for sensitive content and enforces policy actions.
  • Outbound encryption protects message content in transit and at rest for regulated data.
  • Archiving preserves all inbound and outbound mail in tamper-evident storage for compliance.

Skipping any layer creates a gap. Filtering without encryption leaves outbound leakage. Encryption without filtering leaves the inbox exposed to the phishing that steals the credentials that bypass the encryption.

Buyers evaluating a single feature should confirm what covers the other four.

encryption and email in article illustration one

Encryption Handles Outbound Confidentiality

Email encryption operates on outbound messages. It transforms the body and attachments into ciphertext readable only by the intended recipient.

TLS handles server-to-server transport encryption. S/MIME or hosted portal services handle content encryption end to end. Both layers combine to protect messages from interception and unauthorized access.

Related guide: email encryption covers the methods and standards in depth. See also encryption for email and files.

Encryption does not protect against outbound errors. A workforce member emailing PHI to the wrong recipient still commits a HIPAA breach even when the message is encrypted correctly to that wrong address.

The DLP layer catches that case. Encryption alone does not.

Inbound Filtering Blocks Threats Before Delivery

Inbound filtering scans every incoming message against spam signatures, malware analysis, URL reputation, and behavioral indicators of business email compromise.

Microsoft Defender for Office 365 and Google Workspace Security Sandbox both bundle inbound filtering with their mail platforms. Third-party vendors like Proofpoint, Mimecast, and Barracuda offer specialized inbound protection.

Filtering catches most commodity threats. Sophisticated targeted attacks still get through occasionally. That is why the layer above it, identity controls, matters.

The CISA guidance on phishing and ransomware covers the current threat landscape that inbound filtering has to handle.

Healthcare senders face specific targeting because PHI has direct resale value. Filtering configuration for healthcare typically runs stricter than for general business.

[mh_example]

DLP Enforces Policy on Sensitive Content

Data loss prevention scans outbound content for defined patterns and enforces automatic policy actions.

Common patterns include Social Security numbers, credit card numbers, medical record numbers, ICD-10 codes, and custom keyword lists specific to the organization.

Policy actions include block and notify the sender, quarantine for admin review, redirect to a manager, or apply encryption automatically. That last option closes the gap between manual encryption decisions and consistent compliance.

Microsoft Purview DLP and Google Workspace Data Loss Prevention both include predefined content types. Custom rules cover organization-specific patterns.

Test DLP rules against a monitored test mailbox before pushing to production. False positives on internal messages create friction that pushes users toward personal accounts.

encryption and email in article illustration two

VPNs Add a Network Layer That Overlaps Partially

A VPN encrypts the network path between a client device and the VPN provider. It matters when workforce members send email from public Wi-Fi or shared networks.

The VPN protects the traffic from the coffee shop to the VPN endpoint. From there, the traffic exits to the mail server as normal internet traffic protected by the mail platform TLS.

Once the message leaves the sender mail server and travels to the recipient mail server, the VPN provides no protection. The message needs TLS between the mail servers and content encryption for the body itself.

A VPN is not a substitute for email encryption. It protects the first mile only. HIPAA-regulated content still requires end-to-end encryption on the message itself.

Practices deploying VPNs should still deploy email encryption. The layers cover different segments of the message journey.

Archiving Preserves Compliance Evidence

Archiving captures every inbound and outbound message at the gateway and stores it in tamper-evident form for defined retention periods.

HIPAA calls for six-year retention of documentation supporting security policies, which includes evidence of PHI communications. SOX requires seven years of financial records. FINRA requires three years of broker communications with clients.

The archive protects against message tampering after delivery, which matters during litigation and audit. Users cannot delete archived copies from their mailbox to hide activity.

Some vendors bundle archiving with encryption in one product. Others sell them separately. Buyers should confirm which vendor covers each function to avoid gaps or duplicate contracts.

The archive itself must also be encrypted at rest. Vendors typically use AES-256 with keys managed by the customer or the vendor per contract.

[mh_protip]

Identity Controls Guard the Mailbox Access Point

Encryption and filtering both fail when an attacker holds the legitimate mailbox credentials. Identity controls prevent that scenario.

Multi-factor authentication blocks most credential theft attacks. Conditional access rules restrict logins to known devices, networks, or geographies. Session timeout controls limit exposure when devices are left unattended.

Microsoft Entra ID and Google Workspace identity both include MFA and conditional access as core features. Enforce MFA for every workforce member with mailbox access.

Compromised mailbox credentials are the entry point for most business email compromise attacks. See the Microsoft business email compromise guidance for attack patterns and defenses.

Identity controls are cheap compared to the breach cost they prevent. Deploy them before adding more expensive encryption or filtering products.

HIPAA Requires the Full Stack for Covered Entities

HIPAA covered entities need every layer of the stack for the Security Rule and Privacy Rule requirements.

Encryption meets the transmission security safeguard. Inbound filtering supports the malicious software safeguard. DLP supports the administrative safeguard against workforce error. Archiving supports the six-year documentation retention requirement.

Each vendor that touches PHI signs a business associate agreement. Consolidated platforms simplify BAA management by putting encryption, filtering, and archiving under one contract. Specialized services require separate BAAs.

The HHS Security Rule guidance lists every safeguard the covered entity must implement.

Practices running patient-facing websites face parallel obligations. See healthcare website security features for the site-side controls that pair with the email stack.

Choosing Between Consolidated and Best-of-Breed Vendors

Buyers face a decision between one platform that covers every layer and multiple specialized vendors that each cover one layer well.

Consolidated platforms from Microsoft, Google, or major security vendors deliver encryption, filtering, DLP, and archiving through one console. Reporting is unified. One contract covers everything. Small practices favor this model for administrative simplicity.

Specialized vendors focus on one layer and often deliver a better recipient experience or specific compliance feature. Larger organizations mix a consolidated inbound filter with a specialized outbound encryption service like Mailhippo that delivers encrypted email without portal friction.

Related guides: email encryption solutions comparison, email encryption solutions for Outlook and Gmail, and HIPAA compliant texting and email.

Match the vendor mix to the operational team size. A one-person IT department cannot maintain four separate consoles. A dedicated security team can extract value from specialized products that a consolidated platform cannot match.

Neither approach is wrong. The wrong choice is buying encryption in isolation and ignoring the other four layers.

[mh_faqs]

Posted on

How Do I Send an Encrypted Email in Outlook, Gmail, and Yahoo

how do i send an encrypted email guide featured image

[mh_key_takeaways]

Sending an encrypted email looks different in every mail client. The button is in a different place in Outlook, Gmail, Yahoo, and Apple Mail. Some clients offer true end-to-end encryption while others offer a portal-based feature that looks similar but works differently.

This guide walks through the exact steps for each major provider. It also flags the HIPAA implications for practices sending PHI. For a gateway option that works across all of them, Mailhippo offers encrypted email as a portal service with a BAA in the base plan.

Start with the client you already use. Every section stands on its own with the buttons and menu paths named directly.

Sending Encrypted Email in Outlook 365

Outlook on Microsoft 365 Business Standard and above has an Encrypt button in the compose window. It uses Microsoft Purview Message Encryption underneath.

Open a new message. Click the Options tab in the ribbon. Click Encrypt. Choose Encrypt-Only or Do Not Forward from the dropdown menu that appears.

Write the message and click Send. The recipient receives an email with a link. They authenticate with Microsoft, Google, or a one-time passcode and read the message in a browser.

Business Basic and free personal Outlook.com do not have the Encrypt button. Upgrading to Business Standard or higher unlocks it. Related linked topic: how do you encrypt an email in outlook for the setup on older versions.

Sending Encrypted Email in Gmail With Confidential Mode

Gmail confidential mode is available on personal Gmail and every paid Google Workspace tier. Open a new message. Click the lock and clock icon at the bottom of the compose window.

Set an expiration date. Choose whether to require a passcode. Click Save. Write the message and click Send. The recipient receives a link and reads the message in a hosted view.

Confidential mode is not end-to-end encryption. Google holds the keys. The mode adds an extra step for the recipient and prevents forwarding, but the content is not sealed against the provider.

For a HIPAA workflow, confidential mode alone is not sufficient even with a BAA. Practices sending PHI need either hosted S/MIME on the Enterprise tier or a third-party gateway. See Google confidential mode documentation for the current feature list.

how do i send an encrypted email in article illustration one

Sending Encrypted Email in Gmail With Hosted S/MIME

Hosted S/MIME is the Gmail path to true end-to-end encryption. It requires Google Workspace Enterprise Standard, Enterprise Plus, Education Standard, or Education Plus.

The admin uploads root and intermediate CA certificates in the Google Admin console. They enable S/MIME for the organizational unit. Each user then uploads their personal certificate through Gmail settings under Accounts.

Once configured, a lock icon appears next to the recipient field in the compose window. Green means encryption is possible because the recipient certificate is cached. Gray means the recipient certificate is missing.

Recipients on personal Gmail, Business Standard, or Business Plus cannot receive hosted S/MIME encrypted messages. The encrypted content arrives as an unopenable attachment. This is the main operational limit of S/MIME in a mixed environment.

Sending Encrypted Email in Yahoo Mail

Yahoo Mail has no native encrypted email feature. There is no Encrypt button, no confidential mode, and no hosted S/MIME. Yahoo Mail Plus adds ad-free browsing and more storage but no encryption.

To send encrypted email from a Yahoo address, the practical options are limited. Connect the Yahoo account to Thunderbird by IMAP. Install an S/MIME certificate in Thunderbird. Send encrypted mail from Thunderbird using the Yahoo address as the From address.

The other option is a gateway service that authenticates against the Yahoo account and sends portal-delivered encrypted mail on its behalf. This is a workaround, not a supported feature.

Yahoo does not offer a Business Associate Agreement. Yahoo is not appropriate for HIPAA use. Practices on Yahoo should migrate to Google Workspace, Microsoft 365, or a dedicated healthcare mail provider before starting a real encryption program.

[mh_example]

Sending Encrypted Email in Apple Mail

Apple Mail on macOS and iOS supports S/MIME natively. The user installs an S/MIME certificate in the system keychain. Mail detects the certificate automatically.

On macOS, install the certificate through Keychain Access by opening the PKCS 12 file. On iOS, install through a configuration profile or by tapping the .p12 file in Files or Mail. Trust the certificate in Settings.

Once installed, a lock icon appears in the compose window when the recipient certificate is available. Click the lock to encrypt. A signed message from a recipient adds their public key to the local keychain automatically.

Apple Mail also opens Outlook Encrypt messages and portal-delivered messages from third-party gateways. Cross-platform S/MIME between Apple Mail and Outlook works reliably when both sides use the same certificate authority.

how do i send an encrypted email in article illustration two

Sending Encrypted Email With a Gateway Service

A gateway service sits between the sender mail client and the recipient. The sender writes the message in the normal client. A trigger word in the subject or a plugin button triggers encryption.

The service uploads the message to a hosted portal. The recipient receives a notification with a link. They authenticate with a passcode or SSO and read the message in a browser.

Gateway services work with any mail provider. They add a BAA when the underlying mail provider does not offer one. Setup takes minutes for a single user and hours for a full team.

Related linked topics: how to send an encrypted email for a broader walkthrough and how do I send encrypted email for cross-provider notes.

HIPAA Requirements for Encrypted Email Sending

Sending PHI over email requires a signed Business Associate Agreement with the mail provider and technical safeguards under the Security Rule. Encryption alone does not equal compliance.

Microsoft 365 Business Standard and above and Google Workspace Business Standard and above both offer BAAs. Personal Outlook.com, personal Gmail, personal Yahoo, and personal iCloud do not.

The HHS Security Rule requires access controls, audit logging, session timeouts, and workforce training in addition to encryption. Documentation of policies is required for a defensible program.

Verify recipient identity before sending PHI. A wrong email address is a HIPAA breach even when the message is encrypted. Related: security features for healthcare websites for how email fits inside the wider stack.

[mh_protip]

Encrypted Email Feature Comparison Across Providers

The table below summarizes what each major mail provider offers natively.

Provider Native Encryption Feature End-to-End BAA Available Free Tier Encrypted Send
Outlook 365 Business Standard+ Encrypt button, Purview No, portal-based Yes No
Gmail Workspace Business Confidential mode No Yes on Business Standard+ Confidential mode only
Gmail Workspace Enterprise Hosted S/MIME Yes Yes Not on personal
Yahoo Mail None native No No No
Apple Mail on iCloud+ Manual S/MIME Yes with certificate No Manual setup only
ProtonMail Business Password-protected portal Yes to Proton, portal to others Yes on Business Free tier has portal send

Common Sending Problems and Their Fixes

The Encrypt button is missing in Outlook. This happens on Business Basic or free personal Outlook.com. Upgrade to Business Standard or above, or use a gateway service.

The S/MIME lock icon is gray in Gmail. This means the recipient certificate is not cached. Ask the recipient to send you a signed message first. The certificate cache populates automatically from signed inbound mail.

The recipient cannot open the encrypted message. Common causes:

  • Recipient client does not support S/MIME (personal Gmail, Business Standard Workspace)
  • Notification email landed in spam
  • Recipient failed the passcode step
  • Certificate address mismatch on the sender side
  • Corporate firewall blocks the portal domain

Related linked topic: how do I open an encrypted email in outlook for recipient-side fixes.

Picking the Right Sending Path for Your Practice

Practices already on Microsoft 365 Business Standard or above should use the native Encrypt button for external mail. Setup is minutes. The BAA is already in place.

Practices on Google Workspace Business Standard should use confidential mode for casual privacy and add a gateway service for HIPAA-scoped mail. Upgrading to Enterprise for hosted S/MIME is often costlier than the gateway approach.

Practices on Yahoo, iCloud, or free personal accounts need to migrate to a business mail provider before starting a real encrypted email program. No workaround makes those tiers HIPAA-appropriate.

Mailhippo works as the gateway option across all of these providers. It sits alongside Gmail or Outlook, includes a BAA in the base plan, and requires no per-user certificate management. Practices building a compliant public site alongside their email program can pair this with HIPAA-conscious website design so the whole intake chain stays inside the same compliance boundary.

[mh_faqs]

Posted on

Encrypted Email Guide for Business and HIPAA Workflows

encrypted email guide featured image

[mh_key_takeaways]

Encrypted email protects message content from anyone who is not the intended recipient. The term covers three separate technical layers, and they solve different problems. Getting the layer right is what separates a defensible deployment from a false sense of security.

This guide walks through each layer, the tools that implement it, and where each one fits a business or healthcare workflow. It closes with a practical view on when to combine layers and when a portal-based encrypted email service is the right choice.

The reader should come out with enough context to decide which encryption model matches the recipients they email most often and what the budget implications are.

Encrypted Email Covers Three Distinct Layers

The first layer is TLS in transit. It encrypts the network connection between two mail servers. The message body travels through a tunnel that a passive network snoop cannot read.

The second layer is end-to-end encryption at the message level. S/MIME and PGP encrypt the body with the recipient public key. The mail server sees only ciphertext.

The third layer is portal-based delivery. The sender uploads the message to a hosted portal. The recipient authenticates and reads it in a browser. The mail itself never leaves the portal.

Each layer defends against a different threat. TLS covers passive interception. End-to-end covers a compromised or subpoenaed provider. Portal covers recipients who cannot install client-side keys.

TLS Is the Baseline for All Modern Mail Providers

Gmail, Outlook, iCloud, and most business mail providers negotiate TLS 1.2 or 1.3 by default. The two servers exchange certificates, agree on a cipher, and encrypt the connection.

TLS ends when the message arrives at the recipient server. The mail sits at rest on that server in a form the provider can decrypt. A subpoena, a rogue admin, or a provider compromise exposes plaintext.

TLS also fails when the receiving server does not support it. Older on-premise Exchange systems still exist in the wild. Google publishes a delivery status for each domain the user emails, which can reveal these gaps.

MTA-STS and DANE are add-ons that force TLS on the sending side. NIST covers the technical baseline in Special Publication 800-177 Trustworthy Email. Every modern deployment should have MTA-STS enabled at a minimum.

encrypted email in article illustration one

End-to-End Encryption Uses Keys the Provider Cannot See

S/MIME and PGP are the two dominant end-to-end standards. Both work by encrypting the message body with the recipient public key on the sender client before the message leaves the device.

S/MIME uses X.509 certificates from a certificate authority. It is native in Outlook, Apple Mail, and Google Workspace Enterprise. Setup requires a certificate for each user.

PGP uses a web of trust model where users sign each other public keys. It runs on plugins in most mail clients. Setup requires a keypair and public key exchange with every contact.

Both models fail when the recipient has no client-side setup. A referring physician on personal Gmail without S/MIME cannot receive an S/MIME encrypted message. Related linked topic: should I consider encrypted email using ProtonMail as one example.

Portal-Based Encrypted Email Works With Any Recipient

Portal delivery is the practical choice when recipients are variable, include patients, or refuse to install certificates. The sender writes the message in a normal mail client or a web portal.

The service uploads the message to a hosted portal. The recipient receives a notification with a link. They click the link, authenticate with a passcode or SSO, and read the message in a browser.

Microsoft Purview Message Encryption uses this model. Google Workspace confidential mode uses a similar model. Third-party services like Mailhippo use the same model with a HIPAA-focused BAA in the base plan.

Portal delivery works with any recipient on any device. The tradeoff is friction. Replies happen in the portal, not the recipient normal inbox. Threading breaks for downstream record keeping.

[mh_example]

HIPAA Requires More Than Encryption Alone

HIPAA compliance for email requires three things. A signed Business Associate Agreement with the mail provider. Technical safeguards under the Security Rule. Workforce training on encryption use.

Encryption is one technical safeguard. Access controls, audit logging, session timeouts, and secure key management are others. The HHS Security Rule spells out the full list.

A signed BAA is what makes the mail provider a business associate under 45 CFR 164.502(e). Without it, sending PHI through any encrypted service is still a HIPAA violation regardless of encryption strength.

Gmail on Google Workspace Business Standard and above and Outlook on Microsoft 365 Business Standard and above both offer BAAs. Free personal accounts do not. See related healthcare security context for how email fits inside the broader stack.

encrypted email in article illustration two

Common Encrypted Email Deployment Patterns

Small practices with a single mail provider usually run TLS plus a portal gateway. This covers passive interception and external recipient delivery in one setup.

Mid-size clinics with a stable set of peer providers add S/MIME on top for the peer traffic. TLS is baseline, S/MIME handles peer clinical mail, portal handles patients and one-off external contacts.

Larger hospitals with internal PKI use S/MIME across the entire clinical workforce. They still add a portal for patient communication. The two models coexist and are chosen per recipient by the mail client or by a policy rule.

Common encrypted email deployment components include:

  • TLS baseline with MTA-STS enforced on outbound
  • SPF, DKIM, and DMARC configured on the sending domain
  • S/MIME certificates issued to clinical users for peer traffic
  • Portal service for patient and external recipient traffic
  • DLP rules that auto-encrypt messages containing SSN, MRN, or PHI patterns
  • Audit logs retained per HIPAA six-year requirement

Free Encrypted Email Options and Their Limits

Free encrypted email exists but comes with real limits. Personal ProtonMail and Tutanota accounts offer zero-access encryption at rest and portal-based delivery for external recipients.

The catch is no BAA. Free tiers do not qualify for HIPAA use regardless of encryption strength. Storage caps and daily message limits also fail business use quickly.

Free personal S/MIME certificates from Actalis and similar issuers give real end-to-end encryption but require manual install and renewal. Time cost is often higher than a paid service.

For a solo user with occasional secure needs, free options are workable. For a practice with regulatory obligations, paid tiers with BAAs are the only defensible path. Related: free encrypted email for a fuller comparison.

[mh_protip]

Encrypted Email Feature Comparison

The table below compares the main encrypted email models on the dimensions that matter most for a business buyer.

Model Encryption Level Recipient Setup HIPAA Fit Best For
TLS only Transit None Baseline only General business mail
S/MIME End-to-end Certificate install Peer traffic Clinic-to-clinic
PGP End-to-end Keyring install Rare in healthcare Technical users
Portal gateway End-to-end at rest Passcode or SSO All recipients Patient and external mail
Zero-access mailbox End-to-end at rest Account creation With BAA on paid tier Privacy-focused solo users

Encrypted Email Troubleshooting Basics

Delivery failures are the most common encrypted email problem. TLS failures show up as messages sitting in the outbound queue or arriving in plain form when the receiving server does not support TLS.

S/MIME failures usually trace to certificate expiration, address mismatch, or a missing intermediate CA. The recipient client shows a specific error that names the failing check.

Portal delivery failures often trace to the recipient marking the notification as spam. Adding the sender portal domain to a safe-sender list at the recipient side fixes this. See related linked topic: how to troubleshoot encrypted email.

Deliverability upstream matters too. A domain without SPF, DKIM, and DMARC lands portal notifications in spam even when the portal itself works. The Gmail sender guidelines apply to portal notification email the same way they apply to normal outbound mail.

Choosing an Encrypted Email Setup for Your Practice

The right choice depends on three questions. Who are you emailing most often. Are they technical enough to hold a certificate. Do you already run on Microsoft 365 or Google Workspace.

For a practice that emails patients daily and peer clinics occasionally, a portal gateway is the higher-value setup. Patients never install anything. Peer clinics can still receive the portal notification and open it in a browser.

For a practice that emails peer clinics daily and rarely emails patients, S/MIME across the peer network with a portal fallback for patients is the higher-value setup. Peer traffic runs at inbox speed with no extra clicks.

Mailhippo operates as a portal gateway on top of Gmail or Outlook, includes a BAA in the base plan, and requires no per-user certificate management. It fits practices that need patient-safe encryption without moving off their existing mail provider. Practices building a compliant public site alongside their email strategy can pair this with healthcare marketing support so intake, contact, and email flows stay inside the same compliance boundary.

[mh_faqs]

Posted on

How to Send Encrypted Email from Gmail

send encrypted email from gmail guide featured image

[mh_key_takeaways]

Gmail handles more than 1.8 billion active accounts, and a large share of small healthcare practices, therapists, and specialty clinics run their day-to-day communication through it. The default protection is TLS in transit, which is not the same as end-to-end message encryption.

To send encrypted email from Gmail in a way that satisfies HIPAA or protects sensitive content from mailbox breaches, you need to add a layer on top of the default setup. Google offers two native options, S/MIME on select Workspace tiers and Confidential Mode on all tiers, and a third-party route sits above both.

This guide walks through each option with the exact console clicks, the tier requirements, and the cases where each method fits. It also covers the cross-provider gap that catches most senders on the first try.

Gmail Uses TLS in Transit, Not Content Encryption

Standard Gmail encrypts the connection between Google and the receiving mail server using opportunistic TLS. If the receiving server accepts TLS, the message is protected on the wire. If the receiving server does not support TLS, the message drops to plaintext for that hop.

Once the message arrives at the destination mailbox, the TLS protection ends. The message body is stored in the recipient mailbox in a form the mail provider can read. The same applies to the copy in your Sent folder.

TLS in transit does not meet the HIPAA requirement for end-to-end protection of PHI. It also does not protect against a mailbox breach on either side. A stolen password or a compromised admin session exposes every message in the account.

For content-level encryption you have three native or near-native paths from Gmail. S/MIME through Workspace, Confidential Mode, or a third-party plugin or gateway. Each has a different security ceiling and a different setup cost.

S/MIME Requires a Supported Google Workspace Tier

Hosted S/MIME in Gmail is available on Google Workspace Enterprise Plus, Education Standard, and Education Plus. Business Starter, Business Standard, and Business Plus do not include it. Personal Gmail accounts do not include it either.

To enable it, an admin signs in to the Google Admin console, opens Apps, selects Google Workspace, then Gmail, then User settings. The S/MIME section allows the admin to enable the feature for specific organizational units.

Each user then needs a valid S/MIME certificate issued by a public certificate authority or a private CA integrated with the tenant. The certificate is uploaded to the user profile, either manually or through an API integration with the CA.

Once the certificate is in place, the Gmail composer shows a lock icon in the address field. The icon turns green when the recipient public certificate is known to Google. If the recipient has never sent an S/MIME message to your organization, the lock stays gray.

send encrypted email from gmail in article illustration one

Confidential Mode Is Access Control, Not Encryption

Confidential Mode sits in the Gmail composer next to the send button. Click the lock and clock icon, set an expiration date, and optionally require an SMS passcode. The recipient sees the message with forwarding, printing, and copy disabled.

The message content itself is not encrypted. It sits in Google storage in a form Google can read, and the recipient views it through a Google-hosted preview page. The expiration date deletes the preview link, but the underlying copy in Sent Mail remains in your account.

Confidential Mode is useful for reducing casual forwarding and setting a self-destruct on a routine message. It is not a substitute for encryption when PHI or regulated data is involved.

The Department of Health and Human Services has been consistent that HIPAA requires content-level protection of PHI at rest and in transit. Confidential Mode does not meet that bar on its own. Reference the HHS Security Rule guidance if you need the underlying text.

Google Signs a BAA for Paid Workspace Tiers Only

Google will sign a Business Associate Agreement for Business Starter, Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, Education Standard, and Education Plus. The BAA is opt-in through the Admin console under Account, then Legal and Compliance.

The BAA does not extend to personal Gmail accounts. Sending PHI from a free Gmail address is a HIPAA violation regardless of what encryption method you layer on top. The mail provider itself has to be under a BAA.

The Google BAA covers Google storage and transport. It does not cover the recipient mailbox, the recipient mail server, or any downstream forwarding by the recipient. Once the message leaves Google, the Google BAA no longer applies.

That is why message-level encryption matters. TLS protects the wire between Google and the next hop. Message-level encryption protects the content itself all the way through to the intended reader.

[mh_example]

PGP Requires Key Exchange with the Recipient

PGP is a public-key encryption system that predates S/MIME by several years. It works well between two technical users who have exchanged public keys, and it works poorly at scale across a healthcare organization.

On Gmail, PGP is delivered through browser extensions like FlowCrypt or through a desktop client that syncs with Gmail over IMAP. The sender private key stays on the local device. The recipient needs the same tooling and needs to import your public key before decrypting.

Key management is the friction point. Every new recipient needs a public key exchange. Every device change needs the private key transferred securely. Lost private keys mean lost access to every previously encrypted message.

PGP is not a good fit for a clinical staff workflow where messages go to dozens of external patients, insurance carriers, and referral partners per week. It fits a small circle of technical users. It does not fit a front-desk workflow.

Cross-Provider Encryption Breaks Without a Shared Method

The hard case is sending an encrypted message from Gmail to a Yahoo, Outlook.com, or AOL account. None of those recipients typically has an S/MIME certificate on file. None of them typically has PGP tooling installed. A Confidential Mode message drops to a preview link the recipient may not trust.

The workable pattern for cross-provider encryption is a portal-based encrypted email service. The service intercepts the outbound message, encrypts the payload with a key held on its servers, and sends the recipient a link to a hosted decryption page.

The recipient clicks the link, authenticates with a passcode or email verification, and reads the message in a browser session. The message never lands in the recipient mailbox in decrypted form. Only the link and the metadata do.

This is the same pattern Microsoft uses with Purview Message Encryption for Outlook. It is provider-agnostic on the recipient side, which is why it works for cross-provider sending.

send encrypted email from gmail in article illustration two

Third-Party Services Work with Existing Gmail Accounts

A HIPAA-compliant encrypted email service usually plugs into Gmail one of two ways. The first is a Chrome extension that adds an encrypt button to the composer. The second is a routing configuration in Google Admin that sends outbound mail through the service gateway.

The extension approach fits solo practitioners and small teams. The user installs the extension, signs in to the service account, and gets a new send button next to the standard Gmail send button. The clinical staff experience stays inside Gmail.

The gateway approach fits larger practices with a Workspace admin. Outbound mail from designated accounts is routed through the service SMTP relay, which applies encryption based on the recipient domain or a keyword in the subject line.

Mailhippo uses this pattern. Users keep their existing Gmail account, the recipient gets a portal link, and Mailhippo signs a BAA that covers the encrypted mail path. No S/MIME certificates and no key exchange with the recipient.

Client-Side Encryption Keeps Keys Outside Google

Google Workspace Enterprise Plus offers client-side encryption, or CSE, for Gmail. Keys are held by an external key service that the customer controls, and Google never sees the plaintext of the message or the encryption key.

CSE is designed for regulated customers who need to prove that the mail provider cannot decrypt their messages even under legal request. Government agencies, defense contractors, and some large healthcare systems fit the profile.

The setup cost is significant. The admin has to stand up or contract with a Key Access Control List Service that speaks the Google CSE API, then configure each user account to use it. External recipients need matching CSE tooling, which limits interoperability.

CSE is the right choice for a small subset of Enterprise Plus customers with an existing key management infrastructure. It is not a first-move option for a typical outpatient clinic on Business Standard.

[mh_protip]

Mobile Gmail Sends Encrypted Messages Through the Same Paths

The Gmail mobile app on iOS and Android supports Confidential Mode natively. Tap the three-dot menu in the composer and select Confidential Mode. The expiration and passcode options are the same as on desktop.

S/MIME on mobile requires a Workspace tier that supports it plus a certificate provisioned to the mobile device. iOS handles certificate installation through a configuration profile pushed by MDM. Android handles it through the enterprise container.

Third-party encryption services that offer a Chrome extension do not run on the Gmail mobile app. Their mobile support is usually a standalone iOS or Android app that composes an encrypted message and sends it through the service directly.

For a clinical staff workflow where phones and tablets are common, verify the mobile path before rolling out the desktop-first setup. A method that works on the browser but not on a phone will not survive contact with actual daily use.

Practical Setup Order for a Small Healthcare Practice

Start with the BAA. Confirm the Google Workspace tier and enable the BAA in the Admin console. A personal Gmail account is not a starting point for PHI. Move to Workspace first.

Second, decide on the encryption method based on tier. If the practice is on Enterprise Plus and has an existing PKI, S/MIME is a clean fit. If the practice is on Business Standard or Business Plus, a third-party service is the shorter path than upgrading every seat to Enterprise Plus.

Third, train the front desk on the send workflow. The most common failure mode is a staff member forgetting the encrypt button and sending PHI in cleartext. A gateway that encrypts based on recipient domain or subject keyword removes that human step.

For related work on other clients, see the send a encrypted email from outlook guide and the how to send encrypted email from yahoo account reference. For a mobile-first walkthrough, see how to send an encrypted email from phone. Practices building out the broader digital stack for patient trust often pair encrypted email with a locked-down healthcare website security posture and a HIPAA-aware healthcare website design.

Common Failure Modes and How to Avoid Them

The most common failure is treating Confidential Mode as encryption. Front-desk staff assume the lock icon means the message is safe. It reduces forwarding but leaves the body readable to Google. Document the difference in the staff handbook.

The second is sending PHI from a personal Gmail account. There is no BAA, so any PHI in the message is a breach the moment it is sent. Migrate every clinical account to Workspace and disable personal Gmail forwarding.

The third is assuming S/MIME works when the recipient public certificate is not on file. The lock icon stays gray and the message goes out with TLS only. Set the tenant policy to block outbound send on the gray-lock state for accounts that handle PHI.

See the NIST SP 800-177 Rev 1 guidance on trustworthy email for the underlying reasoning on why TLS alone is not sufficient. The HIPAA Journal encryption requirements page summarizes the practical bar for covered entities.

  • Confirm your Workspace tier before assuming S/MIME is available.
  • Sign the Google BAA in the Admin console under Account, Legal and Compliance.
  • Never send PHI from a personal Gmail account.
  • Use Confidential Mode as a policy control, not as encryption.
  • Verify the mobile path before rolling out the desktop workflow.
  • Test S/MIME by exchanging a signed message with the recipient first, then encrypt.
  • Set a tenant policy that blocks unencrypted send for accounts that handle PHI.
  • Route outbound PHI mail through a gateway with a recipient-domain rule.
  • Keep the encrypt button visible in the composer to reduce human error.
  • Audit sent-folder contents monthly for accidental unencrypted PHI.

[mh_faqs]

Posted on

How to Encrypt Email Across Common Clients and Compliance Cases

encrypt email guide featured image

[mh_key_takeaways]

Encrypt email covers four different technical methods that each solve a different problem. Transport Layer Security handles the connection layer. S/MIME and PGP handle the message content. Portal-based services handle the recipient experience for external contacts.

This guide covers how to encrypt email across the major clients and use cases. Each method has a specific fit. Match the tool to the sensitivity of the content and the recipient environment.

The right choice depends on plan level, staff count, and how often external recipients change. Read each section for the fit and decide based on the actual send flow.

TLS Is the Baseline Encryption Every Modern Mail Server Uses

Transport Layer Security protects the connection between two mail servers. When one server sends to another, both negotiate a TLS handshake and encrypt the traffic in flight. Any observer on the network path sees only ciphertext.

TLS is on by default in Gmail, Outlook, Apple Mail, Yahoo, and every other major provider. Users do not turn it on. Administrators do not configure it per message. It happens automatically when both servers support it.

The catch is opportunistic fallback. If the receiving server does not support TLS, the sending server delivers the message in plaintext by default. No warning, no error. The sender sees a padlock in the client and assumes encryption, but the message reached the recipient over an unencrypted link.

For regulated content, the fallback rules out TLS as a standalone protection. The NIST SP 800-45 guide on email security recommends verified end-to-end encryption for sensitive email, not opportunistic TLS.

S/MIME Encrypts Message Content in Outlook and Apple Mail

S/MIME uses X.509 certificates to encrypt the message content itself. Once encrypted, only the recipient with the matching private key can read the message. The mail provider stores ciphertext and cannot decrypt.

Outlook supports S/MIME on all plans that include the desktop apps. Apple Mail supports S/MIME natively on macOS and iOS. Gmail supports S/MIME on Workspace Enterprise Plus, Education Standard, and Education Plus.

Setup requires a certificate for the sender and a certificate for the recipient. Certificates come from a trusted authority like DigiCert, Sectigo, or IdenTrust. Public keys attach to signed messages, so correspondents build up a keyring by receiving signed mail from each other.

S/MIME works well between internal users and formal partner organizations with matching PKI. It does not work well for one-off external contacts because most personal accounts do not have S/MIME set up.

encrypt email in article illustration one

PGP Uses an Open-Source Key Model

PGP is the open-source alternative to S/MIME. It does the same job with a different key management model. Users generate a public and private key pair, share the public key with correspondents, and encrypt messages with the recipient public key.

Thunderbird has built-in PGP support. Mailvelope provides a browser plugin for Gmail. GPG Suite covers Apple Mail on macOS. Outlook needs a third-party add-in like Gpg4win.

PGP has stronger cryptographic flexibility than S/MIME but a steeper learning curve. Key generation, keyserver management, and web-of-trust verification all fall to the user. Recipients unfamiliar with the process will not decrypt a PGP message without help.

PGP fits technical users and organizations where security-conscious sender and recipient both know the tooling. It does not fit patient-facing healthcare communication because most patients cannot manage PGP keys.

Portal Services Handle the External Recipient Case

Portal-based encrypted email services solve the friction problem that S/MIME and PGP create for external recipients. The sender writes the message in the normal client. The service encrypts the message and delivers a notification email with a click-to-open link.

The recipient clicks the link, verifies with a one-time passcode or a portal password, and reads the message in a browser. No key management, no certificate exchange, no software install for the recipient.

This is the model most healthcare practices adopt for patient-facing PHI. It works for patients, external providers, and vendors on any mail platform. The recipient does not need to configure anything on their end.

The tradeoff is that the message content lives on the vendor server. Vendor selection matters because that server becomes part of the compliance boundary. Portal services with a signed BAA and audit logging fit HIPAA. Consumer messaging apps generally do not.

[mh_example]

Encrypting Attachments Follows the Whole-Message Method

Attachments encrypt through the same method as the message body when using Purview, S/MIME, PGP, or a portal service. The sender does not need to encrypt attachments separately. The whole message envelope carries the encryption to the recipient.

Practices that need a separate attachment method have three options:

  • Save the file as a password-protected PDF and share the password through a different channel
  • Place the file in an encrypted ZIP archive using 7-Zip or WinZip with AES-256
  • Use a HIPAA-compliant file transfer service for very large files that exceed mail size limits

The whole-message method is easier for recipients and less error-prone than juggling separate passwords. Password-protected PDFs and ZIP files also fail when the sender emails the password in the same conversation, which happens frequently.

Once a recipient decrypts and downloads an attachment, the local copy is no longer covered by the sender-side encryption. HIPAA rules on the local file remain in force. That is a downstream concern for the recipient environment.

encrypt email in article illustration two

HIPAA Requires More Than the Encrypt Button

HIPAA compliance for email transmission requires four things: a signed business associate agreement with the mail platform, verified encryption in transit and at rest, access logs for six years, and workforce training on when to send PHI over email.

The Encrypt button alone does not cover all four. It covers the transmission layer. The BAA, the logging, and the training all fall to the covered entity to configure and maintain.

Microsoft 365 and Google Workspace both include HIPAA-eligible configurations with signed BAAs. Administrators accept the BAA in the admin center. The BAA applies to the tenant from that point forward. The covered entity handles the rest.

Dedicated HIPAA email services like Mailhippo include the BAA in the base plan without requiring plan upgrades on the underlying mail platform. This matches practices that need HIPAA-safe email but do not want to reconfigure the whole tenant.

Mobile Clients Support the Same Methods

Encrypt email on mobile works through the same methods as desktop. Outlook mobile supports Microsoft Purview Encrypt-Only and Do Not Forward through the same Encrypt option in the compose menu. Recipients open messages in the browser tab or in the Outlook mobile app.

Apple Mail on iOS supports S/MIME natively. Certificates install through a Configuration Profile pushed by mobile device management. The Encrypt icon appears in the compose window once the certificate is available.

Gmail mobile supports Confidential Mode through the standard compose interface. Portal-based encrypted email services provide mobile apps or work through the mobile browser. Mailhippo, Proofpoint, and other vendors all support mobile recipient flows.

The mobile recipient experience matters for patient-facing mail. Many patients read email on a phone. The service should present a clean mobile view of the decrypted message with tap-friendly buttons.

[mh_protip]

Cost Varies From Free to Enterprise Tier

Encrypted email cost ranges widely. TLS is free and included in every mail platform. Gmail Confidential Mode is free with any Gmail account. S/MIME certificates cost fifty to several hundred dollars per user per year depending on the authority and support level.

Microsoft Purview Message Encryption requires Business Premium at around twenty-two dollars per user per month, up from Business Basic at six dollars. That is a plan-wide upgrade, not a per-message cost. Dedicated HIPAA services typically run five to twenty dollars per user per month depending on plan tier.

Practices on Business Basic or Business Standard often find a dedicated HIPAA service costs less than upgrading every seat to Business Premium. The math depends on how many seats need to encrypt versus how many just handle general mail.

Compare total cost of ownership, not just per-seat rate. Setup time, training, and ongoing configuration also count. A simpler service with a higher per-seat rate can cost less overall.

The Recipient Experience Determines Adoption

The single largest factor in encrypted email adoption is the recipient experience. Every step the recipient has to take lowers the open rate on regulated messages. Every extra sign-in or password reset lowers it further.

The rough order from easiest to hardest recipient experience is:

  • TLS message that arrives inline with no extra step
  • Portal service with a one-click link and one-time passcode
  • Portal service with account registration and password
  • S/MIME message that requires certificate pre-install
  • PGP message that requires key pair generation

Practices should match the method to the recipient population. Patient-facing mail needs the simplest recipient path. Internal mail between staff can use a more complex path because the setup is done once during onboarding.

Measure the open rate on encrypted messages. If the rate drops significantly compared to regular mail, the recipient path is too long. Switch to a shorter path.

Mailhippo Handles the HIPAA Case With One-Click Recipient

Mailhippo secure email service works with existing Gmail or Outlook accounts and includes a signed BAA in the base plan. There are no PGP keys, no S/MIME certificates, and no license upgrades on the underlying mail platform.

The sender writes the message in a browser interface or through an add-in. Mailhippo encrypts the content and delivers a notification email to the recipient. The recipient clicks the link, enters a one-time passcode delivered to the same email address, and reads the message.

This is the shortest recipient path among common HIPAA options. Patients on any mail platform can open the message on desktop or mobile. Attachments open inline. Replies encrypt automatically back to the sender.

The broader compliance stack includes healthcare website security features, patient portal configuration, and internal access controls. Encrypted email is one layer. The full stack covers the practice end to end.

[mh_faqs]

Posted on

O365 Email Encryption Explained for Admins

o365 email encryption guide featured image

[mh_key_takeaways]

O365 email encryption is a bundle of features under Microsoft Purview Message Encryption, formerly known as Office 365 Message Encryption. It covers transport encryption, at-rest encryption on Exchange Online, and message-level encryption through a portal delivery model.

This guide walks through the licensing, setup, and known limits. If your tenant needs a supplementary encrypted email path for specific recipient groups or vertical compliance requirements, the vendor-neutral overview is a useful reference.

The audience assumed here is an IT admin or Microsoft 365 tenant owner setting up encryption for the first time or reviewing an existing configuration.

What O365 email encryption covers by default

Every Microsoft 365 tenant gets some encryption automatically. Exchange Online encrypts mail in transit using TLS 1.2 or higher between mail servers when both sides support it. This is the baseline any modern mail provider offers.

Exchange Online also encrypts mail at rest using BitLocker on the underlying storage and per-message encryption keys. This protects mail on disk against a physical theft or storage-layer attack.

The piece that is not on by default is the end-user Encrypt button. On-demand message-level protection requires a licensed feature, either Purview Message Encryption or S/MIME. Both are available on qualifying subscription tiers.

Compliance-covered communication requires the message-level layer in addition to the automatic transport and at-rest layers. Practices sending patient email cannot rely on the default alone. The Encrypt button is what makes the outbound message protected from server to recipient.

Licensing tiers and encryption features

Licensing determines which encryption features are available. The mapping is not obvious from the marketing pages, and admins routinely encounter tenants where the Encrypt button is missing because the license is wrong.

  • Business Basic and Business Standard: TLS and at-rest encryption only, no Encrypt button
  • Business Premium: full Purview Message Encryption including the Encrypt button
  • Enterprise E3: full Purview Message Encryption including the Encrypt button
  • Enterprise E5: Purview plus Advanced Message Encryption for branding, expiration, and revocation
  • Standalone add-on: Azure Information Protection Plan 1 or 2 adds Purview to lower tiers
  • Government: GCC and GCC High tenants have equivalent tiers with same feature mapping

Adding Purview to a Business Basic tenant through Azure Information Protection is technically possible but administratively awkward. Most tenants upgrade to Business Premium instead.

Confirm current licensing through the Microsoft 365 admin center before enabling encryption rules. Microsoft publishes the current feature mapping in the Microsoft Purview Message Encryption documentation.

o365 email encryption in article illustration one

Enabling Purview Message Encryption on the tenant

Enabling Purview requires a few specific steps. On new tenants provisioned after February 2019, Azure Rights Management is enabled by default. On older tenants, an admin needs to enable it through Exchange Online PowerShell.

Connect to Exchange Online PowerShell as a global admin. Run Enable-AadrmService to activate Rights Management on the tenant. Verify the state with Get-AadrmConfiguration. Once active, Purview Message Encryption is available to eligible users.

Assign Azure Information Protection or Message Encryption licenses to users through the admin center. Users see the Encrypt button in the Options ribbon in Outlook the next time they compose a message. Outlook on the web shows the same button in the compose interface.

Test with a compose to an external Gmail or Yahoo address before rolling out to end users. The test verifies the notification email arrives, the portal login works, and the message body renders correctly on the recipient side.

Automating encryption with mail flow rules

Mail flow rules in the Exchange admin center apply encryption automatically based on conditions. This removes the per-message decision from the sender and prevents the plaintext accident.

Common conditions include keyword lists in the subject or body, sender group membership, recipient domain matching, and attachment content patterns. A healthcare practice might trigger encryption on any outbound message to a patient domain list or containing terms like DOB, MRN, or diagnosis.

Configure the rule under Mail flow in the Exchange admin center. Add a new rule. Select Apply Office 365 Message Encryption and rights protection to the message. Choose the encryption template such as Encrypt or Do Not Forward. Save.

Test the rule with a message that matches the condition. Confirm the message is delivered encrypted. Then move on to the next rule. Complex mail flow with many rules can produce order-of-evaluation issues, so keep the rule set small and documented.

[mh_example]

Comparing Purview Message Encryption to S/MIME in O365

Both Purview and S/MIME are supported in O365. They solve different problems and are often deployed together in the same tenant for different use cases.

Attribute Purview Message Encryption S/MIME
Recipient prerequisites None, portal-based Public certificate installed
Setup complexity Tenant-side only Sender and recipient certificate exchange
Recipient experience Portal login Inline in mail client
Reach to any address Yes Only PKI-equipped recipients
Typical fit Business to consumer Government, defense, enterprise PKI
Branding Portal branded on Enterprise E5 No portal to brand

Purview is the modern default for reaching external recipients on any platform. S/MIME is the preferred path when both sides already run PKI and inline decryption is required by policy.

Practices comparing broader alternatives can review the email encryption category overview alongside the Purview and S/MIME options.

Signing and encrypting in the same message

Signing and encryption are separate operations. Some organizations require both on the same message. O365 supports this through S/MIME with certificates installed in Outlook Trust Center.

Signing uses the sender’s signing certificate to hash the message and encrypt the hash with the sender’s private key. The recipient uses the sender’s public certificate to verify the signature. This proves sender identity and message integrity.

Encryption uses the recipient’s public certificate to encrypt the message content. Only the recipient’s private key can decrypt. Applying both operations on the same message provides authenticity and confidentiality together.

Sign-only, encrypt-only, and sign-and-encrypt are all valid options. Government and financial services organizations often mandate sign-and-encrypt as the default. Healthcare practices sending patient email usually apply encryption without signing because recipients are not verifying certificate chains.

o365 email encryption in article illustration two

Branding the recipient portal experience

Advanced Message Encryption on Enterprise E5 supports portal branding. This changes what an external recipient sees when they open the portal to read the encrypted message.

Configure branding through Exchange Online PowerShell using Set-OMEConfiguration. Parameters include OMEConfiguration for logo URL, background color hex, disclaimer text, portal text, and email text. Multiple configurations can be created and mapped to different mail flow rules.

Branding appears when external recipients open the portal. It does not appear on messages viewed inline in Outlook by internal recipients on the same tenant. Branding does not change the encryption itself. It changes the recipient trust signal.

Practices with a website and consistent visual identity often extend the same branding to the encrypted portal. Redefine Web covers the underlying identity work in the overview of healthcare web design.

Encryption at rest and mailbox-level protection

At-rest encryption in Exchange Online uses BitLocker on the underlying storage. This is transparent to admins and users. Every stored mail item is encrypted at the storage layer.

Customer Key is an option on Enterprise E5 and Advanced Compliance add-ons. It allows the customer to provide their own encryption keys used alongside Microsoft-managed keys. Losing the customer key results in permanent data loss, so key management overhead is significant.

Customer Key is a control for regulated industries that require key custody separate from the platform provider. For most healthcare and business use cases, Microsoft-managed keys are sufficient and much easier to operate.

Microsoft publishes the at-rest encryption architecture in the Microsoft Purview encryption reference. The design is aligned with NIST cryptographic guidance in NIST SP 800-52 Rev. 2.

[mh_protip]

Known limitations and workarounds

Every encryption system has limits. Documenting them in advance saves helpdesk hours later.

  • Branding does not appear on messages viewed inline in Outlook, only in the portal view
  • External recipients occasionally lose the portal notification to spam filtering
  • Outlook 2013 requires patching and the Message Encryption add-in for the Protect button
  • S/MIME needs certificate pre-exchange, which is not practical for ad hoc external sends
  • Some compliance frameworks require signing in addition to encryption, doubling the setup work

Workarounds include publishing a short recipient guide, allowlisting the Microsoft notification domain on partner mail servers, and upgrading beyond Outlook 2013. Each mitigation is small individually and adds up to a smoother user experience.

Some organizations supplement O365 encryption with a dedicated email encryption service for specific use cases where the portal experience is not suitable. The two can coexist through mail flow rules that route matching messages through the vertical vendor.

Operational monitoring and audit trails

Encryption is only useful if it stays on. Operational monitoring catches drift, misconfiguration, and user error before they turn into compliance events.

Enable audit log retention for at least six years in the Microsoft Purview compliance portal. HIPAA record-keeping applies to policies and procedures, and the audit log is the evidence trail during any Office for Civil Rights inquiry.

Monitor the Encrypt button usage through Message Trace and Advanced Message Encryption reports. Users who never use the button after a rollout are either not sending sensitive mail or are bypassing the encryption workflow. Both cases warrant follow-up.

Review mail flow rule hits monthly. A rule that produced regular hits then stopped may indicate an upstream change that broke the trigger. Diagnosing early prevents a silent gap in encryption coverage.

Practical rollout plan for a new O365 encryption deployment

A first-time O365 encryption deployment can run in one afternoon for a small tenant or across two weeks for a larger organization. The key stages are the same.

Confirm licenses cover the target user population. Enable Azure Rights Management if not already active. Configure mail flow rules for the initial triggers, such as external mail with specific keywords. Assign encryption-eligible licenses to pilot users.

Pilot with five to ten users for two to three weeks. Collect feedback on the sender workflow and the recipient portal experience. Adjust mail flow rules and branding based on the pilot findings. Roll out to remaining users in staggered groups.

Publish a one-page recipient guide for external partners describing the portal login process. Practices with a broader compliance program should coordinate the rollout with related work such as healthcare website maintenance to keep the whole patient communication stack aligned.

[mh_faqs]

Posted on

Email Encryption Programs Explained for Small Practices and Solo Providers

email encryption programs guide featured image

[mh_key_takeaways]

Email encryption programs protect messages that carry protected health information, financial records, or legal documents as they travel between mail servers and inboxes. The category covers native features built into Outlook and Gmail, browser plugins, and dedicated gateway services that route mail through a policy layer.

Choosing between them looks simple until a practice tries to deploy one across a staff of ten and a rotating list of referral partners. This guide compares the real options, explains what each protocol actually does, and covers the HIPAA rules that shape the decision. For clinics sending patient data every day, a HIPAA-ready encrypted email service removes most of the friction.

The wrong program does not just leak data. It also produces a workflow so awkward that staff bypass it to finish the day. Below is what actually works.

Native client encryption is the starting point for most offices

Outlook, Apple Mail, and iOS Mail all support S/MIME natively. Once an IT team installs an X.509 certificate on the user device, the Encrypt button appears in the compose window and the mail app handles the cryptographic work.

Gmail supports S/MIME on Google Workspace Enterprise and Education plans. Confidential mode is a separate feature that adds expiration and passcode gating but is not true end-to-end encryption. The message still sits on Google servers in a form Google can read.

Microsoft 365 Business Premium and higher include Purview Message Encryption. Staff click Encrypt in the Options ribbon, pick a policy, and Outlook handles the rest. External recipients get a portal link and sign in with Microsoft, Google, or a one-time passcode.

Native features work when everyone uses the same platform. The moment referrals cross between Outlook, Gmail, and older Exchange servers, gaps appear. That is where dedicated encryption for email gateway tools earn their subscription cost.

Free email encryption programs have real limits for HIPAA workflows

Mailvelope, an OpenPGP browser extension, encrypts Gmail and Outlook Web messages from inside the browser. Enigmail forks and GnuPG add PGP to desktop clients like Thunderbird. Both are free and technically strong.

The problem is not the cryptography. It is the operational model. Every recipient needs a keypair, a way to publish the public key, and a habit of protecting the private key. Patients and small billing partners rarely meet any of those requirements.

Free tools also do not sign a Business Associate Agreement. HHS makes the BAA a hard requirement at 45 CFR 164.308(b) for any vendor that processes PHI. Without that document on file, a covered entity carries the compliance risk alone.

Practices that want a free email encryption service for personal correspondence can use these tools safely. For clinical email, the missing BAA rules them out. This is the single most common mistake in small-office HIPAA audits.

email encryption programs in article illustration one

S/MIME and OpenPGP handle key management differently

S/MIME relies on a hierarchy of certificate authorities. A trusted CA issues each user a certificate, mail clients verify certificates against a root store, and revocation lists let administrators kill a compromised key. The model matches how corporate IT already thinks about identity.

OpenPGP uses a decentralized web of trust. Users sign each other keys, publish public keys to a keyserver, and rely on personal verification rather than a central authority. It is powerful for technical users and painful for everyone else.

Neither protocol encrypts the subject line or the To and From headers. Metadata leaks through both. NIST covers key management requirements in Special Publication 800-175B, available at nist.gov/publications.

Practices adopting S/MIME need a plan for certificate renewal, mobile provisioning, and revocation. Practices adopting OpenPGP need a plan for user training. Both are legitimate paths, but neither is a low-effort choice.

Gateway encryption services remove the recipient key problem

A gateway service sits between the practice mail server and the wider internet. When the outbound message matches a policy, the gateway diverts it to a secure web portal and sends the recipient a notification with a link.

The recipient clicks the link, verifies identity through a one-time code or federated login, and reads the message in a browser. No plugin, no certificate, no keypair. This is the pattern behind Microsoft Purview, Google client-side encryption, and dedicated HIPAA services.

Gateway tools also produce audit logs that show when the recipient opened the message, when the link expired, and whether the message was forwarded. Those logs feed directly into the HIPAA risk analysis process.

For practices comparing options, the deciding question is usually recipient experience. If patients reply from phones, gateway wins. If all recipients are corporate IT-managed staff, native S/MIME works. A more detailed best free email encryption solution comparison can help narrow the shortlist.

[mh_example]

Deployment paths differ across Outlook, Gmail, and Apple Mail

For Microsoft 365 Business Premium and Enterprise plans, administrators enable Purview Message Encryption in the Exchange admin center, publish rights management templates, and the Encrypt button appears in Outlook for every user. Microsoft documents the full path at learn.microsoft.com/purview.

For Google Workspace, S/MIME requires the Enterprise plan. Administrators upload each user certificate to the admin console, and Gmail activates the encrypt option in compose. Confidential mode works on all plans but is not a HIPAA control by itself.

For Apple Mail on macOS and iOS, users import certificates into the keychain and the Encrypt lock icon appears in the compose window. Mobile device management profiles can push certificates automatically to staff phones.

Deployment complexity grows with the mix of platforms. A practice on a single Microsoft tenant has the easiest path. A practice with staff on Gmail, Outlook, and personal iPhones needs either uniform S/MIME provisioning or a gateway service to bridge the gap.

Comparison of common email encryption programs

The table below shows how the three main categories compare on cost, recipient experience, and HIPAA fit. Practices should treat this as a starting point rather than a purchasing rule.

Program type Cost model Recipient experience BAA available
Native S/MIME (Outlook, Apple Mail) Included in Microsoft 365 Business Premium or Google Workspace Enterprise Requires recipient certificate Through Microsoft or Google BAA
OpenPGP plugin (Mailvelope, GnuPG) Free Requires recipient PGP keypair No
Gateway service (Microsoft Purview, dedicated HIPAA) Per user per month Portal login with one-time passcode Yes, included in HIPAA plans
Confidential mode (Gmail) Included in Google Workspace Passcode or in-Gmail preview Not sufficient alone

Cost per seat rarely tells the full story. Total cost also includes support tickets when recipients cannot open a message, certificate renewal work, and the compliance risk of a program that does not sign a BAA.

email encryption programs in article illustration two

HIPAA rules that shape the encryption program decision

The HIPAA Security Rule at 45 CFR 164.312(e)(1) treats transmission security as an addressable standard. Addressable does not mean optional. It means the practice must implement the safeguard or document why an equivalent alternative works.

HHS guidance points to NIST 800-52 Rev. 2 for TLS baselines and NIST 800-175B for cryptographic key management. Both documents are free at csrc.nist.gov/publications. Auditors expect to see specific citations in the practice policy documents.

The Business Associate Agreement requirement at 45 CFR 164.308(b) covers any vendor that creates, receives, maintains, or transmits PHI. That includes the email encryption vendor. A signed BAA on file before go-live is not negotiable.

Practices building a HIPAA-compliant patient communications program should also review healthcare website security features that carry the same rigor into the web layer where patient forms and portals live.

User training determines whether encryption actually gets used

Buying an encryption program is one line item. Getting staff to use it every time PHI leaves the office is a different project. Training programs that focus on when to encrypt work better than training that focuses on how.

Effective training covers the practical scenarios. A referral letter to another clinic, a claim to a billing partner, an intake form sent back to a patient, a lab report forwarded to a specialist. Each one is a moment where a staff member decides to encrypt.

Policy-based gateway services reduce the training burden by making the decision automatic. If the message contains a subject keyword, a policy trigger, or goes to a domain on the encryption list, the gateway encrypts without a manual click.

  • Train new hires in the first week, not the first month
  • Include encryption steps in the intake and referral workflows
  • Test the process quarterly with a live send to a personal address
  • Document exceptions where encryption was skipped and why

[mh_protip]

Cost breakdown across common encryption program tiers

Free tools cost nothing but time. Staff spend hours provisioning keypairs, and IT spends hours resolving recipient errors. For a two-person clinic that sends encrypted mail twice a week, that math might still work.

Microsoft 365 Business Premium runs about $22 per user per month and includes Purview Message Encryption. Google Workspace Enterprise Standard starts higher but includes S/MIME and client-side encryption controls.

Dedicated HIPAA email services typically price between $5 and $15 per user per month with the BAA included. That range covers the encryption itself, the portal, audit logs, and support. For a five-person office, the total sits around $50 to $75 a month.

Practices that also invest in HIPAA-compliant website design and encrypted email together get consistent controls across the patient-facing surface and the back-office communication layer.

Migration paths from a free tool to a HIPAA-ready service

Practices already using Mailvelope or a similar free tool can migrate in a phased plan. Start by identifying which mail flows carry PHI and which do not. Only the PHI flows need the paid service.

Next, run the new service in parallel for two weeks. Staff send a copy of each encrypted message through both tools and confirm the recipient can open it. This catches configuration errors before the free tool gets turned off.

After the parallel period, publish a written cutover date, decommission the free tool, and export any archived messages the practice needs to retain. HIPAA retention rules at 45 CFR 164.316(b)(2) require six years for policy documentation.

Services designed for healthcare use, including a HIPAA-compliant secure email service, plug into existing Gmail or Outlook accounts and remove the recipient key problem in a single onboarding step.

Ongoing controls that keep an encryption program compliant

Encryption controls decay over time. Certificates expire, staff turn over, recipient domains change hands, and vendors update their portals. A control that worked last year may not work this year.

NIST recommends quarterly verification of encryption controls as part of the risk analysis process. A simple test send to an external address, review of the message headers, and confirmation of the portal login flow catches most drift issues.

  • Review the BAA renewal date with each vendor annually
  • Rotate S/MIME certificates before expiration, not after
  • Audit access logs quarterly for portal-based services
  • Update the risk analysis document after any material change
  • Test disaster recovery for encrypted mail at least once a year

Practices that pair encryption controls with strong healthcare website maintenance keep the entire patient communications stack aligned. Encryption is one layer. The web layer, the endpoint layer, and the training layer all need the same maintenance rhythm to hold up under audit.

The HHS Office for Civil Rights publishes enforcement actions at hhs.gov/hipaa/enforcement. Reading the recent cases shows which encryption gaps trigger investigations. Almost every settlement includes a missing or outdated risk analysis.

[mh_faqs]

Posted on

Can I Encrypt an Email in Gmail (and Every Other Client)

can i encrypt an email in gmail guide featured image

[mh_key_takeaways]

Encrypting an email should be a one-click operation. In practice it depends on which client, which plan, and which recipient the sender is dealing with.

The core question, can I encrypt an email in Gmail, has three answers. So does the same question for Outlook and GoDaddy. This guide walks through each path, when to use it, and when a hosted encrypted email service is the simpler choice.

The setup order matters. Check the client, check the plan, then choose the encryption method that matches the recipient. A method that works for a colleague on the same tenant may not work for a patient on a free consumer account.

Gmail Confidential Mode is not encryption

Confidential Mode appears in the Gmail compose window as a lock icon at the bottom of the toolbar. Clicking it opens a dialog for expiration and passcode settings.

The message body is not encrypted. Google servers store the message in the same format as any other Gmail message. The controls are behavioral, meaning they restrict what the recipient can do in the Gmail interface.

The recipient can still screenshot the message, retype it, or print the screen. The expiration setting removes access from the Gmail viewer, but any content already read is out of the sender’s control.

For casual privacy, Confidential Mode is useful. For HIPAA or any regulated data, it is not sufficient. The Security Rule requires actual encryption of the transmitted content.

Native S/MIME in Gmail requires Enterprise Plus

Google Workspace supports hosted S/MIME on Enterprise Plus, Education Standard, and Education Plus. Business Starter, Standard, Plus, and Enterprise Standard do not include native S/MIME.

To enable S/MIME, an administrator uploads each user’s S/MIME certificate through the Admin console and configures the S/MIME setting under Apps, Google Workspace, Gmail, User settings.

Sending an encrypted message to an external recipient requires the recipient’s public certificate. If Gmail does not have the certificate on file, the compose window shows the message as signed but not encrypted.

The certificate exchange problem is the reason most practices skip S/MIME even when the plan supports it. Patients and external contacts rarely have S/MIME certificates.

can i encrypt an email in gmail in article illustration one

Third-party extensions add encryption to any Gmail plan

Browser extensions like Mailhippo, Virtru, and FlowCrypt add an encryption toggle to the Gmail compose window. When the toggle is on, the extension encrypts the message before it leaves the browser.

External recipients receive a link and open the message in a portal. They authenticate with a Google, Microsoft, or email-verified passcode, depending on the extension.

The advantage over S/MIME is that recipients need no configuration. The advantage over Confidential Mode is that the encryption is real. The trade-off is a per-user monthly fee.

For healthcare senders, the extension has to come with a signed BAA. Mailhippo, Virtru, and Paubox all offer BAAs. FlowCrypt does not, which rules it out for HIPAA use. Practices weighing which extension to install often compare notes across how can i encrypt my emails and similar decision guides.

Outlook 365 has an Encrypt button that triggers Purview

Can I encrypt an email in Outlook? Yes. On Microsoft 365 Business Premium or higher, the Encrypt button appears on the Options ribbon in Outlook Desktop and in the Actions menu in Outlook on the web.

Clicking Encrypt applies Microsoft Purview Message Encryption. The message body and attachments are encrypted, and external recipients receive a portal link that they open after authenticating with Microsoft, Google, or a one-time passcode.

The Encrypt button only appears if Azure Rights Management is active on the tenant. If a super administrator has never enabled it, the button is invisible even on the correct license.

On Business Basic or Business Standard, the Encrypt button is not available. Practices on those plans need to upgrade to Business Premium or use a third-party gateway.

[mh_example]

Outlook Desktop supports S/MIME on any plan

Outlook Desktop has supported S/MIME for over 20 years. The setup runs through File, Options, Trust Center, Trust Center Settings, Email Security.

A user imports an S/MIME certificate from a certificate authority into the Windows certificate store, then binds it to their Outlook profile. Digital signing and encryption become available on the compose window.

To send an encrypted message to an external recipient, the sender needs the recipient’s public certificate. Outlook stores public certificates from previously received signed messages, which is how the exchange usually happens.

Outlook on the web has more limited S/MIME support and requires the S/MIME control installed through the browser. Outlook Mobile does not support S/MIME send at all on most versions.

can i encrypt an email in gmail in article illustration two

Consumer Outlook.com has free encryption between Microsoft accounts

Outlook.com consumer accounts include free encryption for messages between Microsoft accounts. The shield icon in the compose window toggles encryption on.

The recipient experience depends on what account they use. Other Outlook.com or Microsoft 365 users see the decrypted message natively. External recipients on Gmail, Yahoo, or similar receive a portal link.

The free encryption tier does not include a BAA. Microsoft signs BAAs on Microsoft 365 business plans, not on consumer Outlook.com. Healthcare users on Outlook.com are not compliant.

For a personal user who wants to send an encrypted message once in a while, Outlook.com’s built-in encryption is a fine free option. For a practice, it is not.

GoDaddy email splits into two products with different encryption options

GoDaddy sells two email products under two brand names. Professional Email is GoDaddy’s own product, and Microsoft 365 from GoDaddy is a rebranded Microsoft 365 tenant.

On Professional Email, transit encryption uses TLS whenever the receiving server supports it. There is no built-in body encryption. Users who need it install a third-party extension or upgrade.

On Microsoft 365 from GoDaddy, encryption works exactly like any Microsoft 365 tenant. Business Premium and higher get the Encrypt button. Lower tiers do not.

GoDaddy does not sign a BAA for its consumer-tier products. Healthcare senders on GoDaddy need to be on the Microsoft 365 Business Premium tier, activate the BAA through the Microsoft admin center, and use Purview or a third-party service for encryption.

[mh_protip]

Comparison of encryption methods across common clients

The three main methods, TLS, S/MIME, and portal-based, each have trade-offs. TLS is automatic and covers most modern receivers, but the sender has no visibility into whether a specific message actually used TLS on delivery.

S/MIME is strong when both sides have certificates, but the certificate exchange kills the workflow for most external recipients. Portal-based services solve the certificate problem but add a step for the recipient.

Method Recipient effort HIPAA-ready Included in
TLS only None Only with signed BAA plus verified TLS enforcement Every provider
Gmail Confidential Mode Passcode entry No Every Gmail plan
S/MIME Certificate install Yes, if BAA in place Enterprise Plus, Outlook Desktop, Microsoft 365
Purview Message Encryption Portal login Yes, if BAA in place Microsoft 365 Business Premium+
Third-party portal service Portal login Yes, with signed BAA Mailhippo, Virtru, Paubox

The right column matters more than the others for a healthcare practice. If the encryption method is not paired with a signed BAA, it does not meet the Security Rule requirement regardless of how strong the cryptography is.

What to choose based on the sender’s situation

A solo practitioner on Gmail should install a hosted encryption service and skip the plan-tier gymnastics. The monthly fee is smaller than the friction of managing S/MIME certificates for every recipient.

A small group practice on Microsoft 365 Business Standard should upgrade to Business Premium, activate the Encrypt button, and train staff on when to use it. That is the shortest path to compliance for a Microsoft-first shop.

A larger clinic with mixed email systems benefits from a gateway service that sits in front of every outbound path. The gateway enforces encryption regardless of which client the user sends from.

Practices that want the marketing site and patient intake to match the email compliance posture should work with an agency familiar with HIPAA-compliant website design so the intake forms, the appointment reminders, and the outbound clinical mail all share the same encryption story.

Quick setup steps for the three most common configurations

For Google Workspace Business Standard with a hosted encryption service: sign up with the vendor, connect the Gmail account through OAuth, install the browser extension, and send a test message to a personal address on a non-compliant server. Confirm the recipient sees a portal link.

For Microsoft 365 Business Premium: activate Azure Rights Management under Settings, Org settings, Services, Microsoft Azure Information Protection. Confirm the Encrypt button appears in the Outlook ribbon. Send a test message.

For Outlook Desktop with S/MIME: purchase a certificate from a certificate authority, install it in the Windows certificate store, bind it under Trust Center, Email Security, and exchange a signed message with the intended recipient to swap public certificates.

The Google Confidential Mode help page and the Microsoft Purview documentation both walk through the client-side steps for reference.

  • Check the plan tier before choosing an encryption method.
  • Skip Confidential Mode for any regulated data.
  • Use a third-party hosted service if S/MIME certificate exchange is not practical.
  • Confirm a signed BAA is in place before sending PHI over any channel.
  • Test with a real external recipient before rolling out to staff.

Answering can i encrypt an email in gmail is the easy part. The harder question is which method fits the sender’s plan, the recipient’s setup, and the compliance requirements attached to the content. The right combination changes the moment any of those three factors change.

[mh_faqs]

Posted on

Email Encryption Software for Business Use

email encryption software guide featured image

[mh_key_takeaways]

Email encryption software falls into four categories. Client-side plug-ins, SMTP relays, enterprise gateways, and native platform features. Each fits a specific team size and compliance requirement.

Choosing email encryption software starts with the mail platform already in use, the number of users, the volume of regulated content, and the recipient technical setup.

This guide walks through each category and the practical criteria for choosing between them.

Client-Side Plug-Ins Add Encryption Inside the Mail Client

Client-side plug-ins install inside Outlook, Gmail, or Apple Mail and add encryption to the compose interface. Mailvelope adds PGP to browsers. Virtru and similar third-party plug-ins add portal-based encryption to Gmail and Outlook.

Native S/MIME support in Outlook and Apple Mail also functions as a client-side plug-in path when combined with an installed certificate. The user clicks Sign or Encrypt on a per-message basis.

Plug-ins suit small teams that want encryption without changing the mail platform. Deployment installs on each user machine or account. Training is per-user because encryption depends on user action.

The tradeoff is that plug-ins require user action for every sensitive send. A forgotten click means an unencrypted send with regulated content, which is a documented HIPAA breach cause.

SMTP Relays Intercept Mail at the Transport Layer

SMTP-relay services sit between the sender mail client and the recipient mail server. The sender configures outbound SMTP to route through the relay. The relay applies encryption and forwards to the destination.

Purpose-built HIPAA-compliant services often use this model. Mailhippo works this way. The sender writes and sends from Gmail or Outlook as usual. The relay handles encryption, TLS delivery, and portal fallback when TLS is unavailable.

The advantage is enforcement. Every outbound message routes through the relay and gets encrypted. The user cannot forget because there is no per-message action to remember.

The tradeoff is that the relay must be trusted with plaintext during the encryption step. The vendor signs a BAA and provides access logs for audit, but plaintext transit through the service is part of the design.

email encryption software in article illustration one

Enterprise Gateways Inspect and Enforce at Scale

Enterprise email gateways from Cisco, Proofpoint, Barracuda, and Mimecast sit inline with the mail server. Every outbound and inbound message passes through the gateway for inspection.

Data loss prevention rules scan outbound content for regulated patterns like Social Security numbers, medical record numbers, or payment card numbers. Matching messages are encrypted or blocked according to policy.

Gateways suit hospital systems, large financial firms, and government agencies. Setup involves integration with the mail server, policy configuration, and ongoing tuning to reduce false positives. Administrator time is significant.

For small and mid-sized practices, gateway software is often more infrastructure than needed. A relay-based service delivers the enforcement benefit without the operational overhead.

Native Platform Encryption Depends on the Tier

Microsoft 365 and Google Workspace include native encryption features on specific tiers. Microsoft 365 Business Premium and higher include the Encrypt button and Microsoft Purview Message Encryption. Google Workspace Enterprise Plus includes S/MIME hosted encryption.

Lower tiers do not include these features. Microsoft 365 Business Basic and Business Standard rely on TLS transport and do not offer the Encrypt button. Google Workspace Business Standard and Business Plus rely on TLS and Confidential Mode.

Native platform encryption is often the lowest-cost path when the organization already pays for a qualifying tier. It removes the need for third-party software. The setup is contained within the existing platform administration.

According to Microsoft documentation, Purview Message Encryption meets HIPAA transmission requirements when paired with a signed BAA. The BAA is included with qualifying Microsoft 365 tiers.

[mh_example]

S/MIME Software Requires Certificate Management

S/MIME implementations run as native components of Outlook, Apple Mail, and Gmail on Workspace Enterprise. There is no separate S/MIME software to install beyond the certificate itself.

The certificate lifecycle is where the operational cost lives. Certificates come from a trusted authority such as DigiCert, Sectigo, or IdenTrust. They expire after one to three years and need renewal. Departing employees need their certificates revoked.

Enterprise deployments automate the certificate lifecycle through a managed public key infrastructure. Small practices typically manage certificates manually per user, which is manageable for a few users but scales poorly.

email encryption software in article illustration two

PGP Software Is Free but Requires Technical Users

PGP is open source. The GNU Privacy Guard command-line tool and its front ends including Gpg4win on Windows, GPG Suite on Mac, and Mailvelope for browsers are free to install and use.

PGP does not use a certificate authority. Users generate a public-private key pair, share the public key with correspondents, and encrypt with the recipient public key. There is no annual certificate cost.

The trade-off is user experience. PGP requires understanding key exchange, verifying key fingerprints, and managing a keyring. Non-technical users find the workflow confusing. This limits PGP to teams that can standardize on it.

HIPAA Software Requires a Signed BAA

For HIPAA, the software vendor must sign a business associate agreement covering the handling of protected health information. This is a legal requirement, not a technical one. Software with strong encryption but no BAA does not qualify for HIPAA-scoped transmissions.

Purpose-built HIPAA services include the BAA in the base plan. Microsoft and Google sign BAAs at qualifying tiers. Some plug-in vendors sign BAAs on higher tiers or by request. Free tools generally do not.

According to HHS guidance, the BAA must specify permitted uses and disclosures, safeguards required, and breach notification obligations. Standard BAAs from established vendors cover these terms without custom negotiation.

[mh_protip]

Integration Points Determine Deployment Time

The deployment time for encryption software depends on the integration point. Native platform features are already integrated; enabling takes minutes. SMTP-relay services require an outbound SMTP configuration change, typically completing in an hour. Client-side plug-ins install per user, so time scales with user count.

Enterprise gateways require the most setup. Integration with the mail server, policy design, testing, and rollout typically take weeks. Small teams almost never justify this scope.

  • Native platform features: minutes to enable, no user-side setup.
  • SMTP-relay services: hours to configure, no user-side setup.
  • Client-side plug-ins: minutes per user, scales with user count.
  • Enterprise gateways: weeks to deploy, requires ongoing policy tuning.

For small practices switching to encrypted email for the first time, the SMTP-relay path is typically the fastest to production with the fewest ongoing surprises.

Recipient Experience Shapes Adoption

The best encryption software fails if recipients cannot open the messages. Recipient friction is often the deciding factor between two otherwise comparable products.

S/MIME and PGP require the recipient to have keys installed and a supported client. Portal-based services require a click, a passcode, and a browser. Native platform encryption between users on the same platform requires no action.

For healthcare practices sending to patients, portal-based delivery is the standard. Patients cannot be expected to install S/MIME certificates or generate PGP keys. A one-click portal fits the workflow.

Test the recipient experience with a real recipient before choosing the software. Some corporate mail gateways strip portal links or block third-party domains. Testing surfaces those issues before deployment.

Choose Software That Matches the Existing Workflow

The final selection depends on user count, mail platform, compliance requirement, and recipient technical setup. The right software integrates with the platform already in use rather than requiring a switch.

  • Team under 10 users, Gmail or Outlook, HIPAA scope, external patients: purpose-built SMTP-relay service.
  • Team on Microsoft 365 Business Premium or higher, mixed recipients: native Encrypt button plus optional service for high-volume external.
  • Enterprise with S/MIME infrastructure, internal certified users: native S/MIME on Outlook or Workspace Enterprise Plus.
  • Large regulated organization, high message volume, DLP requirement: enterprise gateway with policy-based enforcement.

Sibling guides cover related considerations in what is the best email encryption software and HIPAA-compliant email software. For teams pairing email security with patient-facing infrastructure, resources on healthcare website security features add context.

The one-line summary is that the best email encryption software is the one that enforces encryption without breaking the workflow. Choose for enforcement, integration, and BAA coverage before feature lists.

[mh_faqs]

2637 E. Atlantic Blvd.
#1063 Pompano Beach, FL 33062

© 2026 MailHippo, Inc.

View our Privacy Policy or contact our Customer Service team.

Optometrist Marketing Agency – Web Design, SEO, PPC & Maintenance