HorizLogoSm.fw_.png
Start Trial

Tag: secure email

Posted on

Outlook 365 Encrypt Email Setup and Sending Guide

outlook 365 encrypt email guide featured image

[mh_key_takeaways]

Outlook 365 encrypt email works through Microsoft Purview Message Encryption, a service built into Business Premium and Enterprise plans. Clicking the Encrypt button in the Options ribbon triggers the flow, and the recipient reads the message inline or through a branded portal.

This guide walks through desktop, web, and mobile steps, the two default encryption templates, mail flow rule automation, and HIPAA fit. Practices that need a simpler option can layer a dedicated encrypted email service on top of the existing Outlook account.

Every step below reflects the Microsoft 365 admin experience as of 2026. Feature names shift year to year, so cross-check the Microsoft learn documentation before a large rollout.

Licensing decides whether the Encrypt button appears

The Encrypt button appears in Outlook only when the mailbox license includes Purview Message Encryption. Business Premium, E3, E5, and equivalent education, nonprofit, and government plans include it by default.

Business Standard, Business Basic, E1, and Apps-only plans do not include it. Users on those plans see no Encrypt option in the Options ribbon, and the compose window offers no sensitivity label picker.

Two paths fix the gap. Upgrade specific seats to Business Premium, or add the Microsoft 365 E5 Compliance license per user. Both carry a monthly cost that scales with headcount.

A third path skips the Microsoft licensing question entirely by routing sensitive mail through a dedicated service that owns the encryption layer. That approach fits smaller practices that resist the per-seat cost of Business Premium.

The Encrypt button in Outlook desktop lives inside the Options ribbon

Open a new message in Outlook for Windows or Mac. Click the Options tab at the top of the compose window. Look for the Encrypt button in the Permission group next to the sensitivity label picker.

Click Encrypt, then pick Encrypt-Only or Do Not Forward from the dropdown. A blue banner appears above the recipient field confirming the message is encrypted.

The dropdown may show additional custom templates if the tenant administrator created them. Common examples include Confidential, Highly Confidential, or a template branded with the practice name.

Attachments follow the same encryption policy as the message body. Office files stay protected after download for recipients who use Microsoft 365, and PDFs open through the portal viewer.

outlook 365 encrypt email in article illustration one

Outlook on the web uses a different menu path

The web app hides the Encrypt option under the three-dot menu at the top of the compose window. Click the three dots, hover on Encrypt, and pick a template.

The Encrypt icon shows a lock next to the recipient field once the setting applies. Removing the encryption before send requires clicking Change permissions and picking No Restriction.

Outlook on the web does not support switching from Encrypt-Only to Do Not Forward after the setting is applied without recomposing. Pick the template first, then finish the message body.

The web experience matches the desktop flow for external recipients. The link and portal path stay identical regardless of which Outlook client sent the message.

Mobile Outlook supports encryption on both iOS and Android

Open the Outlook mobile app and start a new message. Tap the arrow icon at the top right of the compose window to expand the options. Tap Encrypt and pick a template.

The mobile flow requires Outlook version 4.2338 or later on iOS and 4.2337 or later on Android. Older builds show the Encrypt option grayed out even on Business Premium tenants.

Attachments compose the same way as on desktop. Files pulled from OneDrive or SharePoint apply their existing sensitivity labels, and files uploaded from the device follow the message-level template.

Reading an encrypted message on mobile works inline for internal recipients. External recipients tap the Read the message button, which opens the browser to the Office 365 Message Encryption portal.

[mh_example]

Encrypt-Only and Do Not Forward templates behave differently

Encrypt-Only encrypts the message body and attachments during transit and at rest. The recipient reads, replies, forwards, prints, and copies content without restriction. This template fits routine sensitive mail like invoices or draft contracts.

Do Not Forward encrypts the same content and adds usage rights. The recipient reads and replies, but the client blocks Forward, Copy, and Print actions. The portal viewer hides the download button.

Neither template can be changed after the message is sent. Recall works only for internal Microsoft 365 recipients, so external messages stay in the recipient inbox until the mailbox owner deletes them.

Custom templates built in the Microsoft 365 admin center support intermediate policies. A template can allow reply but block forward, or allow reply-all but block print. Setup takes 10 minutes in the Purview compliance portal.

Mail flow rules automate encryption for sensitive messages

Automatic encryption removes the burden from staff who forget to click Encrypt. Open the Exchange admin center, go to Mail flow, then Rules, and click Add rule.

Set the condition to match a keyword in the subject or body. Common patterns include patient ID, DOB, MRN, SSN, and the word confidential. Regex matching handles credit card and Social Security number patterns.

Add the action Apply Office 365 Message Encryption and rights protection. Pick Encrypt or Do Not Forward from the dropdown. Save the rule in preview mode first.

Review the message tracking log after a week. False matches on routine internal replies signal that the keyword list is too broad. Refine the list, then flip the rule to enforced mode.

outlook 365 encrypt email in article illustration two

External recipient experience depends on the recipient mail provider

Microsoft 365 and Outlook.com recipients read the message inline without a portal step. The reading pane shows the encrypted content, and Reply works normally.

Gmail recipients see a preview and click Read the message to open the Office 365 Message Encryption viewer. Signing in with a Google account skips the passcode step.

Every other provider, including Yahoo, AOL, and consumer ISP addresses, hits the branded portal and requests a one-time passcode. The code arrives at the same email address within seconds and stays valid for 15 minutes.

Branding the portal with practice logo, header text, and disclaimer content builds trust with first-time recipients. Setup takes two minutes under Microsoft 365 admin center, Settings, Org settings, Organization profile.

HIPAA compliance requires more than the Encrypt button

Purview Message Encryption meets the HIPAA Security Rule technical safeguard for encryption in transit and at rest. That single control is necessary but not sufficient for a compliant email workflow.

The covered entity must sign the Microsoft Business Associate Agreement through the Service Trust Portal. The BAA covers Microsoft 365, Azure, and Dynamics 365 at no extra cost.

Workforce training documents that staff know when to click Encrypt and how to explain the portal to a patient. The Security Rule administrative safeguards require annual training records.

Practices building a broader patient communication stack should also review the healthcare website security features that intake forms and patient portals should meet.

[mh_protip]

Related Microsoft encryption paths cover different scenarios

Purview Message Encryption is the modern default for outbound message encryption. Older tenants may still see references to Azure Information Protection, which is now merged into Purview.

S/MIME remains available for tenants that manage certificates and want end-to-end encryption where Microsoft servers cannot decrypt content. Setup takes hours per user and fits regulated industries that require certificate control.

The broader encrypt 365 email workflow spans licensing, sensitivity labels, mail flow rules, and DLP policies. Practices with a compliance officer often build the full stack, and small offices pick the two or three features that fit daily use.

For a step-by-step tour of the classic Encrypt button experience, the how to encrypt email in outlook 365 guide walks through the same flow with additional screenshots and troubleshooting tips.

Alternatives fit practices without Business Premium licensing

Practices on Business Standard or Business Basic face a real cost decision. Upgrading every seat to Business Premium runs about $22 per user per month, which adds up quickly for a 20-person practice.

The Microsoft 365 E5 Compliance add-on costs less per seat but still requires an existing Business or Enterprise base license. Both paths keep encryption inside the Microsoft ecosystem.

Dedicated encrypted email services layer on top of any Outlook or Gmail account with no licensing changes. A HIPAA-compliant secure email service like Mailhippo includes a BAA in the base plan and adds no portal step for common recipient providers.

The decision comes down to team size, existing licensing, and how often mail flows to Gmail and non-Microsoft recipients. Larger tenants with Business Premium already in place stay with Outlook encryption, and smaller offices often pick a dedicated service for simpler daily use.

Common pitfalls slow down early rollouts

The most common early problem is missing licensing. A staff member sees no Encrypt button, tickets IT, and IT confirms the seat is on Business Standard. Audit licensing before training rollout.

The second most common problem is recipient confusion during the first message. The portal step surprises patients and referring providers who expect inline mail. A short cover message explaining what to expect cuts support calls.

Mail flow rules that match too broadly encrypt normal internal replies. Staff read the encrypted format as a signal that something is confidential, which trains them to distrust routine mail. Refine keywords in preview mode.

Attachment size limits still apply. Purview encryption does not raise the 150 MB Exchange Online message ceiling. Large radiology or imaging files still need a separate transfer path with a signed BAA.

  • Confirm Business Premium, E3, E5, or E5 Compliance licensing on every seat that sends encrypted mail.
  • Brand the recipient portal with practice logo, header text, and support contact before the first external send.
  • Default clinical staff to Do Not Forward and administrative staff to Encrypt-Only, then adjust based on real use.
  • Test mail flow rules in preview mode for a full week before enforcing them tenant-wide.
  • Document workforce training records annually to meet the HIPAA Security Rule administrative safeguards.

The Outlook 365 encrypt email flow is production-ready for practices on the right licensing tier. Practices outside that tier have three real options, and the right pick depends on team size, mail volume, and how often sensitive messages cross into Gmail and consumer inboxes.

[mh_faqs]

Posted on

Barracuda Email Encryption Service Review for 2026

barracuda email encryption service guide featured image

[mh_key_takeaways]

Barracuda Email Encryption Service is one of the older cloud-based email encryption products in the market. Barracuda Networks launched the service in 2003 and has iterated the recipient portal, admin console, and pricing model steadily since then.

The service targets mid-market organizations that want encryption bundled with spam filtering and Advanced Threat Protection. Healthcare practices adopt Barracuda when they already run Microsoft 365 or Google Workspace and want an enterprise gateway that signs a BAA. Buyers evaluating a secure email encryption service often compare Barracuda against Cisco, Proofpoint, and lower-friction alternatives.

This review walks through what the service actually delivers, how the pricing tiers stack up, and where the recipient portal step becomes a workflow bottleneck.

What is Barracuda Email Encryption Service

Barracuda Email Encryption Service is a cloud-based encryption gateway. Messages that match a policy trigger route through Barracuda cloud servers before delivery to the recipient.

The service supports three trigger types. Subject line keywords like [encrypt] applied by the sender. Content policies that scan the message body for regulated patterns like credit card numbers or Social Security numbers. Sensitivity labels applied by a Purview or Google Workspace policy.

Barracuda encrypts triggered messages at rest with AES-256. Recipients get a notification email with a portal link. First-time recipients register an account. Returning recipients log in with the existing password.

The service integrates with Microsoft 365 and Google Workspace through connector configuration. The barracuda encrypted email guide walks through the connector setup on both platforms.

barracuda email encryption service in article illustration one

Barracuda Email Encryption Service cost breakdown

Barracuda sells encryption inside Email Protection bundles. Standalone encryption pricing is not published anymore because the modern purchase path always includes the broader spam and malware filtering stack.

The bundle tiers below reflect list pricing at the time of writing. Actual pricing from a Barracuda partner is often 10 to 20 percent below list, and multi-year commitments drop pricing further.

Barracuda tier Price per user per month Encryption included Best fit
Email Protection Essentials $4 Yes Basic spam and encryption
Email Protection Advanced $6 Yes plus link protection Small business phishing defense
Email Protection Premium $10 Yes plus ATP sandboxing Mid-market compliance
Total Email Protection $12 Yes plus backup and archiving Regulated industries with retention

Nonprofit and education customers get 20 to 40 percent below list on all four tiers. Confirm the current price with a Barracuda partner because published pricing shifts quarterly.

Barracuda Email Encryption Service login and portal experience

Recipients of a Barracuda-encrypted message get a notification email with a portal link. The notification email includes the sender name, subject line, and a call-to-action button that opens the portal.

First-time recipients click the button, land on the Barracuda portal, and register an account with an email address and a password. The registration step takes about 60 seconds if the recipient reads the on-screen instructions.

Returning recipients see the login page instead of the registration page. Login with the existing password unlocks every previous message from the same sender organization.

Password reset uses the standard email link flow. Recipients who forget the password click Reset, receive a new email, and set a new password. The reset flow works but adds another 90 seconds to the average message open time.

[mh_example]

Barracuda Email Encryption Service uptime and outage handling

Barracuda publishes a 99.999 percent SLA on Email Protection. In practice the service hits close to that number, with occasional short outages affecting the encryption or portal layer.

When users search for barracuda email encryption service down, they most often hit an outage that clears within an hour. Check status.barracuda.com for the current service state. Barracuda posts incident summaries after resolution.

Outbound messages queued for encryption pause during the outage. Depending on the connector configuration, messages either sit in the sender mail queue or route through a fallback path that skips encryption.

The fallback that skips encryption creates HIPAA exposure. Configure the connector to block delivery rather than skip encryption when the service is down. Document the outage protocol in the risk analysis.

barracuda email encryption service in article illustration two

Barracuda Email Encryption Service phishing and spam handling

Barracuda combines encryption with the broader Email Protection spam filtering stack. Inbound mail routes through Barracuda spam and malware filters before delivery to the mailbox.

Outbound mail routes through the encryption engine when the sender or a content policy triggers encryption. The two functions share the same admin console and message log. Configure the spam threshold in the admin console under Email Protection, Anti-Spam.

Attackers sometimes clone the Barracuda notification email template to send phishing messages that look like real encrypted mail. The cloned message points to a fake portal that steals credentials.

Train recipients to hover over the portal link and confirm the domain is barracudanetworks.com before entering credentials. Reference the CISA phishing advisories for the current threat patterns.

Barracuda Email Encryption Service legitimacy verification

Barracuda Networks is a publicly traded email security vendor headquartered in Campbell, California. The company has sold email encryption products since 2003.

Legitimate portal notifications come from a barracudanetworks.com domain. The portal itself lives at the same domain. Verify legitimacy by hovering over the link before clicking.

Barracuda publishes trust and compliance documentation at trust.barracuda.com. The documentation includes SOC 2 reports, HIPAA business associate agreement details, and the current security whitepaper.

Healthcare practices adopting the service should download the SOC 2 report and the HIPAA whitepaper as part of the vendor due diligence process. Store both documents in the compliance evidence folder.

[mh_protip]

Barracuda Email Encryption Service agentless variant

Barracuda offers an agentless email encryption variant that skips the client-side integration entirely. All encryption happens in the cloud gateway, so users do not install any extension in Outlook or Chrome.

The agentless model works well for organizations with many different mail clients and mobile users. There is nothing to install on iPhones, iPads, personal laptops, or bring-your-own devices.

The tradeoff is the sender loses the button-click encrypt option in Outlook. Encryption triggers only on subject line keywords or content policy matches. Senders who need explicit control per message add [encrypt] to the subject line.

See barracuda agentless email encryption for the full configuration walkthrough and connector setup. The agentless variant works with both Microsoft 365 and Google Workspace tenants.

Barracuda compared with Cisco and general email encryption alternatives

Barracuda competes head-to-head with Cisco Secure Email in the mid-market. Both use a portal-based delivery model, both bundle encryption with spam filtering, and both sign a BAA on healthcare accounts.

Cisco pricing runs higher per seat but includes deeper phishing analytics and stronger URL rewriting. Barracuda pricing runs lower per seat but relies more on the customer to train recipients on the portal flow. See secure email encryption service cisco for a detailed feature comparison.

Buyers looking at general email encryption service options should evaluate at least three vendors before signing. The email encryption service barracuda comparison guide covers Barracuda against Proofpoint and native Microsoft 365 encryption.

Key evaluation criteria:

  • Recipient portal experience and first-time registration friction
  • BAA inclusion in the base plan or as an add-on
  • Fallback behavior during a service outage
  • Admin console usability and message log depth
  • Nonprofit or education pricing availability
  • Multi-year commitment discount schedule

Barracuda Email Encryption Service fit for healthcare practices

Barracuda works well for mid-size healthcare practices with 50 to 500 seats. The bundle price at $10 to $12 per user per month competes with Cisco and Proofpoint, and the admin console handles most day-to-day operations without vendor support.

Small practices under 20 seats often find the bundle price too high for the volume of encrypted messages. A dedicated encryption service like Mailhippo priced per seat at the entry tier fits the small-practice case better.

Practices that also run a patient-facing website need matching safeguards on both channels. HIPAA compliant website design handles the web side while Barracuda or an alternative handles the mail side. See security features for healthcare websites for the aligned web guidance.

Recipient friction remains the primary reason practices switch away from Barracuda. If your patient population struggles with the portal step, evaluate a zero-step alternative before renewing. Mailhippo delivers encrypted messages directly to the recipient normal inbox, removing the portal registration and login entirely. Reference HIPAA Journal on compliant email and NIST SP 800-177 Trustworthy Email for the standards behind these decisions. See email encryption for the broader context.

[mh_faqs]

Posted on

How Do You Encrypt Emails in Outlook, Gmail, and Office 365

how do you encrypt emails guide featured image

[mh_key_takeaways]

Email encryption is not one process. It is a family of methods that apply differently depending on the sender client, the recipient client, and the license tier on both sides. The right method for a given message is the one that lands in a form the recipient can actually read.

This article walks through the three main encryption methods in production use today. Transport-layer TLS, client-level S/MIME, and portal-based encryption through services like Microsoft Purview or a HIPAA-compliant encrypted email service. Each has a role, and the trade-offs matter for healthcare senders in particular.

The three encryption methods you actually have

Every email encryption solution in production use is a variation on one of three methods. Transport Layer Security, client-side S/MIME or PGP, and portal-based encryption through a secure gateway.

Transport Layer Security encrypts the connection between two mail servers. When both servers support TLS 1.2 or higher and negotiate a session, the message content travels encrypted between them. TLS is invisible to the sender and recipient. It does not require any action to enable and does not require any client-side setup.

Client-side encryption using S/MIME or PGP encrypts the message body itself with a key that only the recipient can decrypt. The encrypted content is safe even if the mail server storing it is breached. S/MIME requires certificates on both sender and recipient devices. PGP requires key pairs.

Portal-based encryption uploads the message content to a secure gateway. The recipient receives a notification with a link to authenticate and view the content in a browser. This method removes the need for the recipient to have any specific client or certificate. It is the standard approach for external communications where the sender cannot control what the recipient uses.

how do you encrypt emails in article illustration one

How to encrypt an email in Outlook desktop

Outlook desktop on Microsoft 365 Business Premium and Enterprise E3 or higher includes the Encrypt button in the Options ribbon of a new message. Clicking it applies Microsoft Purview Message Encryption using the sender tenant as the authentication backend.

The steps in Outlook desktop:

  • Compose a new message and address it to the recipient
  • Click the Options tab in the ribbon
  • Click Encrypt in the Permission group
  • Choose Encrypt-Only, Do Not Forward, or a custom policy from the dropdown
  • Complete the message body and click Send

The recipient sees a notification with a Read the Message button. Clicking the button opens a browser session, prompts for sign-in with Microsoft, Google, or a one-time passcode, and displays the decrypted content on the Microsoft encryption portal.

Outlook desktop also supports S/MIME encryption for messages between recipients who have exchanged certificates in advance. The Sign and Encrypt buttons in the Message ribbon apply S/MIME. Certificate management is more complex than portal-based encryption and is typically used only for internal messages between employees on the same tenant.

How to encrypt an email in Outlook on the web

Outlook on the web at outlook.office.com supports the same Purview Message Encryption as the desktop client. The interface is different, but the underlying mechanism is identical.

The steps in Outlook on the web:

  • Compose a new message
  • Click the three-dot More menu at the top of the compose window
  • Select Encrypt from the menu
  • Choose the encryption level and any restrictions
  • Send the message normally

The recipient experience is identical to messages encrypted from the desktop client. The tenant license and Azure Rights Management configuration are the same underlying requirement.

Outlook on the web does not support S/MIME on all account types. Consumer Outlook.com accounts have no S/MIME. Enterprise accounts support S/MIME through a browser extension that must be installed separately. For most healthcare senders, portal-based encryption through Purview is the practical choice regardless of client.

[mh_example]

How to encrypt an email in Office 365 through the admin side

Office 365 administrators can configure mail flow rules that automatically encrypt outbound messages matching specific criteria. This removes the requirement for the sender to click Encrypt on each individual message.

Common auto-encryption triggers:

  • Subject line contains a keyword like Secure or Encrypt
  • Recipient domain matches a specified partner list
  • DLP scanner detects PHI patterns in the message body or attachments
  • Sender is a member of a specified group like clinical staff
  • Attachment contains a specific document classification tag

The rule is configured in the Exchange admin center under Mail flow, Rules. The action is Apply Office 365 Message Encryption and rights protection with a chosen template. Testing the rule in audit mode before enforcing it prevents unexpected encryption of messages that should have gone in plaintext.

The Microsoft Purview Message Encryption documentation is the canonical reference for rule syntax and configuration options.

how do you encrypt emails in article illustration two

How to encrypt an email in Gmail

Gmail encryption depends on the tier. Consumer Gmail at gmail.com uses TLS in transit for all outbound mail but does not support end-to-end encryption directly. Google Workspace Enterprise Plus and Education Plus support client-side S/MIME.

For Enterprise Plus S/MIME:

  • Ensure S/MIME is enabled at the admin console under Apps, Gmail, User Settings
  • Upload S/MIME certificates for users through the admin console or self-service
  • Compose a new message and address it to a recipient whose certificate is on file
  • Click the lock icon in the compose window to see the encryption status
  • Choose Enhanced Encryption from the options
  • Send the message normally

Business Starter, Standard, and Plus tiers do not include S/MIME support. Practices on those tiers that need to send encrypted PHI typically add a HIPAA email service on top of Gmail. Google Workspace signs a Business Associate Agreement on Business Starter and higher, but the BAA alone does not provide the encryption. Sibling coverage of the Gmail-specific workflow is available at how to send encrypted email Gmail.

Confidential Mode is not encryption. It is a Google-specific feature that adds expiration dates and forwarding restrictions to messages, but the message content itself is not encrypted end to end. HHS has not endorsed Confidential Mode as satisfying HIPAA transmission security requirements.

How to encrypt an email on iPhone Mail

Apple Mail on iPhone supports S/MIME encryption once a personal certificate is installed as a configuration profile. Portal-based encryption from Purview or a HIPAA email service works with no iPhone-specific setup.

For S/MIME on iPhone:

  • Email the .p12 certificate file to yourself or obtain it through your organization MDM
  • Install the profile through Settings, General, VPN and Device Management
  • Enter the certificate password when prompted
  • Open Settings, Mail, Accounts, select the account, Advanced
  • Enable S/MIME and select the installed certificate under Sign and Encrypt by Default

Once configured, Apple Mail shows a lock icon on any composition to a recipient whose certificate is on file. The lock indicates encryption is active. Tap the icon to see certificate details or to disable encryption for a specific message.

For portal-based encryption, no iPhone-specific setup is required. The sender initiates encryption at the desktop or in the Outlook mobile app, and the recipient receives the standard notification that works on iPhone as on any other device.

[mh_protip]

Choosing between S/MIME, TLS, and portal encryption

The choice depends on the recipient. Internal messages between employees on the same tenant benefit from S/MIME or tenant-native encryption because certificates are managed centrally and no external portal is needed. External messages to business partners on Microsoft 365 or Google Workspace can use enforced TLS if the receiving domain is known and configured.

External messages to consumer email addresses require portal-based encryption. Patients on gmail.com, yahoo.com, aol.com, and icloud.com will not install S/MIME certificates, and enforced TLS to those providers is not fully reliable across all message paths.

The HHS Security Rule guidance and the NIST SP 800-45 email security guidelines provide the compliance framework for evaluating any specific configuration.

When native encryption is not enough for healthcare

Native encryption in Outlook, Gmail, and iPhone Mail works well for many use cases but leaves gaps for regular PHI transmission. Purview Message Encryption requires a Business Premium or Enterprise license, which is more expensive than most small practices need. Gmail S/MIME requires Enterprise Plus, which is not economical at practice scale. iPhone S/MIME requires certificate management the practice has to run for every clinician.

A dedicated HIPAA email service consolidates the encryption, BAA, audit logging, and archiving into one product that works with the existing Gmail or Outlook mailbox. A HIPAA-compliant secure email service that includes the BAA in the base plan removes the license-tier problem and the certificate-management problem at once. This mention concludes the product context for this article.

Recipient experience is the deciding factor in most healthcare deployments. A patient who cannot easily open the message will call the practice for help, and staff time on password resets and portal walkthroughs adds up. Portal-based encryption with federated sign-in through Microsoft, Google, or a one-time passcode is the pattern that produces the fewest support tickets. Sibling coverage on how do you open an encrypted email in Outlook covers the recipient side.

Related healthcare marketing coverage is available at Redefine Web healthcare website security features and at the healthcare marketing hub for practices coordinating email compliance with website and patient acquisition.

[mh_faqs]

Posted on

Email Encryption Solutions Compared for HIPAA and Business Use

email encryption solutions guide featured image

[mh_key_takeaways]

Email encryption solutions fall into three architectural buckets, and the right pick depends on team size, HIPAA scope, and recipient mix. Native platform encryption, portal-based services, and gateway suites each solve the same problem with different trade-offs.

This guide compares the three approaches, walks through the leading vendors in each category, and lays out a decision framework for practices choosing an encrypted email service in 2026. The comparison focuses on real recipient experience and admin cost rather than marketing feature lists.

Healthcare teams that need HIPAA scope should also review the broader stack of controls around patient communication, including intake forms, portals, and website security. The healthcare marketing agency team at Redefine Web sees encryption gaps most often on smaller practices without dedicated IT.

Three architectures cover the entire market

Native platform encryption ships inside Microsoft 365 Business Premium, Enterprise plans, and Google Workspace with the S/MIME add-on. It relies on tenant licensing and integrates directly with the mail client.

Portal-based services accept plain mail from the sender, encrypt it in transit, and store it behind a secure viewer. The recipient clicks a link and signs in or enters a passcode to read the content.

Gateway and client-side services sit between the sender mail server and the receiving mail server. They negotiate TLS with the recipient server when possible and fall back to a portal only when TLS fails.

All three architectures use AES-256 for at-rest encryption and TLS 1.2 or higher in transit. The differences show up in recipient experience, admin overhead, and price.

Recipient experience decides adoption more than cryptography

Recipients rarely care about the underlying encryption protocol. They care about how many clicks separate them from the message and how often a portal step interrupts a normal reply thread.

Native platform encryption reads inline when both parties use the same platform. Cross-platform mail, Microsoft to Gmail or the reverse, forces a portal step for the recipient.

Portal services always route through a viewer, even when both parties use compatible platforms. The consistency helps admins but frustrates recipients who exchange many messages per day.

Gateway services deliver inline in most cases and fall back to a portal for the small percentage of recipients whose mail servers reject modern TLS. The best gateway architectures produce the smoothest recipient experience overall.

email encryption solutions in article illustration one

HIPAA scope requires a signed Business Associate Agreement

Every HIPAA-scoped email flow needs a BAA between the covered entity and the encryption vendor. The BAA defines breach notification timelines, subcontractor rules, and audit access rights.

Microsoft and Google sign a BAA at no extra cost on Business and Enterprise plans through the Service Trust Portal or the Google Cloud console. That BAA covers Purview Message Encryption and Workspace S/MIME.

Personal Gmail, Business Standard without the Compliance add-on, and free Outlook.com accounts do not qualify for a BAA. Practices sending PHI through those accounts sit outside HIPAA scope regardless of technical encryption.

Dedicated encrypted email services usually include the BAA in the base plan without an upgrade or per-seat premium. This makes them a simpler compliance path for practices without existing Business Premium licensing.

Comparison table of the leading email encryption solutions

The table below compares the three architectural approaches on the criteria that matter most to healthcare and small business practices. Individual vendor names appear in each category to anchor the trade-offs.

Approach Example vendors Recipient experience BAA in base plan Admin overhead Best for
Native platform Microsoft Purview, Google Workspace S/MIME Inline for same platform, portal for others Yes on Business Premium and above Medium to high Practices already on Business Premium with IT lead
Portal-based service Mailhippo, Barracuda Cloud Email Portal for every recipient Yes on standard plans Low Small practices under 50 seats without dedicated IT
Gateway suite Cisco Secure Email, Proofpoint Inline via TLS, portal fallback Yes on healthcare tier High Hospital systems above 200 seats with compliance officer
S/MIME direct Sectigo, DigiCert Inline for both parties Certificate vendor separate from BAA Very high Regulated industries requiring certificate control

The right pick rarely matches the sticker price. Total cost of ownership includes license fees, IT hours, workforce training time, and helpdesk load for recipient confusion.

[mh_example]

Native Microsoft 365 encryption fits Business Premium tenants

Microsoft Purview Message Encryption ships with Business Premium, E3, E5, and equivalent education, nonprofit, and government plans. The Encrypt button lives in the Outlook Options ribbon.

Setup takes an hour for a basic deployment. Mail flow rules under the Exchange admin center automate encryption based on keywords, sensitivity labels, or recipient domains. Training staff on when to click Encrypt takes longer.

Business Standard tenants face a decision. Upgrading every seat to Business Premium adds meaningful monthly cost, and the E5 Compliance add-on requires an existing Business or Enterprise base license.

The full detail of the Outlook workflow lives in the outlook 365 encrypt email guide, which walks through the Encrypt button, mail flow rule setup, and licensing decisions.

Google Workspace S/MIME fits Enterprise tenants with certificate control

Google Workspace Enterprise plans support hosted S/MIME, which encrypts messages with certificates issued to individual users. The receiving mail server decrypts inline when it holds the matching public certificate.

S/MIME does not fall back to a portal for external recipients without certificates. Messages sent to Gmail personal accounts, Yahoo, or non-S/MIME organizations arrive as plain text unless a separate encryption layer intervenes.

The certificate management overhead scales poorly. Practices with 20 staff and 500 external contacts spend hundreds of hours per year issuing, renewing, and revoking certificates. Most healthcare teams pick a different approach.

The broader network solutions email encryption question spans S/MIME, PGP, and hybrid architectures. Enterprise IT teams sometimes deploy multiple layers to cover different recipient categories.

email encryption solutions in article illustration two

Portal-based services fit small practices without dedicated IT

Portal-based services deploy in an afternoon and require no certificate management, no MX record changes, and no mail flow rules. The service intercepts outbound messages that hit a defined trigger and routes them to a secure viewer.

The BAA typically ships in the base plan. Mailhippo, Virtru business tier, and Barracuda Cloud Email cover the BAA at no extra cost for healthcare customers. Pricing lands around a few dollars per user per month.

Portal fatigue is the main drawback. Recipients who exchange multiple messages per week with the practice eventually complain about the login step. A branded portal with practice logo and disclaimer reduces the friction.

Practices under 50 seats without a dedicated IT lead usually pick this category. The hipaa complaitn email solutions guide compares three portal services in more detail.

Gateway suites fit enterprise environments with archiving needs

Cisco Secure Email, Proofpoint Essentials, and Barracuda Advanced Threat Protection sit at the network edge and inspect every message. They handle inbound spam, outbound encryption, and DLP under a single admin console.

The gateway architecture delivers inline when the receiving mail server supports TLS 1.2 or higher. Modern Gmail, Outlook, and major hosted providers all negotiate TLS, so most recipients read the message without a portal step.

Deployment requires MX record changes, TLS certificate rotation, and DKIM and DMARC alignment. Small teams that lack a dedicated mail admin should budget several weeks for a clean rollout.

Enterprise gateway pricing runs a few hundred dollars per user per year and often includes archiving, DLP, and threat intelligence. The enterprise email encryption solutions guide covers the deployment path in detail.

DLP integration matters more as PHI scope grows

Data loss prevention scans outbound mail for patterns that match sensitive information. Common patterns include Social Security numbers, medical record numbers, credit card numbers, and named entity matches for patient data.

DLP paired with encryption removes the burden on staff who forget to click Encrypt. When DLP finds a match, the mail server applies encryption automatically or blocks the message for admin review.

Enterprise gateway suites include DLP in the base plan. Portal-based services offer it as an add-on. Native Microsoft 365 encryption requires the E5 Compliance license or Business Premium with Purview DLP policies.

Small practices with fewer than 20 seats often skip DLP and rely on staff training. The NIST Cybersecurity Framework recommends DLP for any organization handling regulated data at any scale, but implementation cost stays a real barrier.

[mh_protip]

Total cost of ownership rewards honest math

Sticker price rarely tells the full story. A portal service at five dollars per user per month looks cheaper than Business Premium until the practice adds the cost of the Microsoft license the staff already needed.

Add IT hours for deployment, maintenance, and troubleshooting. Native platform encryption requires certificate rotation and mail flow rule tuning. Portal services need a one-time DNS check. Gateway suites need ongoing tuning of DLP and spam rules.

Add workforce training. Every solution requires training staff on when to encrypt, how to explain the recipient experience, and what to do if a message bounces. Budget an hour per staff member per year.

Add helpdesk load for recipient portal confusion. First-time recipients ask questions. A branded portal, a clear cover message, and a support contact reduce the volume but do not eliminate it.

A decision framework built on team size and mail patterns

Practices under 20 seats without dedicated IT usually pick a portal-based service. The BAA ships in the base plan, deployment takes an afternoon, and the recipient experience stays consistent across every provider.

Practices between 20 and 100 seats with an internal IT lead face the widest set of choices. Native Microsoft 365 fits if the tenant already runs Business Premium. Otherwise a portal service still wins on total cost.

Enterprise systems above 200 seats with a compliance officer usually pick a gateway suite. The DLP, archiving, and threat intelligence integration justify the higher per-seat cost when the alternative is buying three separate tools.

Regulated environments requiring certificate control, such as federal contractors and specialty lab networks, layer S/MIME on top of a portal or gateway service. The email encryption guide covers the layering pattern in detail.

Migration paths keep the switch low risk

Switching encryption vendors rarely requires a mail server migration. Portal services layer on top of the existing account, gateway services swap the MX record, and native platform encryption changes only the internal admin console configuration.

Test the new service with a small internal group for two weeks. Send messages to Gmail, Outlook, Yahoo, and a consumer ISP address. Confirm the recipient experience matches expectations and the audit log captures the events.

Roll out to the full team after the test group signs off. Keep the old service running for a week in case a rule needs adjustment. Cancel the old contract only after the audit log for the new service covers a full month.

Document the change in the HIPAA Security Rule risk analysis and update workforce training records. Practices that skip this step create audit gaps that the Office for Civil Rights investigators note during breach investigations.

  • Confirm the vendor signs a BAA covering the encryption service itself, not just the underlying platform.
  • Test the recipient experience across Gmail, Outlook, Yahoo, and a consumer ISP address before committing.
  • Budget IT hours, training time, and helpdesk load in addition to license fees when comparing solutions.
  • Document the encryption decision in the HIPAA Security Rule risk analysis for audit defensibility.
  • Review the choice annually as licensing changes and vendor pricing shifts often outpace initial expectations.

Choosing the right email encryption solution comes down to matching architecture to team size, HIPAA scope, and recipient mix. Every serious solution meets the technical safeguard for encryption, so the differences that matter show up in daily use rather than in the vendor pitch deck.

[mh_faqs]

Posted on

How Is Email Encrypted A Practical Guide for Healthcare and Business

how is email encrypted guide featured image

[mh_key_takeaways]

Most senders assume email encryption is a single technology. It is actually a stack of independent controls that operate at different points in the message journey. Transport encryption protects the connection between servers. Content encryption protects the message body itself.

Understanding how is email encrypted at each layer matters for anyone handling regulated data. A practice that assumes Gmail encrypts everything end to end may be storing PHI in a way that fails HIPAA audit. A HIPAA-focused encrypted email service handles both layers automatically.

This guide walks through the exact cryptography behind TLS, S/MIME, PGP, and portal-based encryption. It covers Gmail, Outlook, Apple Mail, iCloud, and the interoperability rules that govern messages between platforms.

Transport encryption protects the connection, not the message

Transport Layer Security, usually TLS 1.2 or 1.3, wraps the SMTP connection between mail servers in a cryptographic tunnel. Every packet that travels between the sending and receiving server is encrypted for the duration of the connection.

TLS negotiates through STARTTLS, an SMTP extension that upgrades a plaintext connection to an encrypted one. When both servers support it, the message travels encrypted. When one server does not, most systems fall back to plaintext SMTP by default.

The SMTP TLS Reporting standard from the IETF documents both the negotiation flow and the reporting mechanism. Modern platforms like Google Workspace and Microsoft 365 enforce TLS for connections to major providers.

Transport encryption ends when the message arrives at the receiving server. From that point, the message body sits decrypted on the receiving server storage unless content encryption was applied at the sender end.

how is email encrypted in article illustration one

Content encryption protects the message body itself

Content encryption wraps the message body, headers, and attachments in cryptography that only the intended recipient can unlock. The encrypted payload travels through the standard mail flow but stays unreadable to intermediate servers.

Three approaches dominate. S/MIME uses X.509 certificates issued to individual users. PGP uses per-user key pairs exchanged through key servers or manual transfer. Portal-based systems encrypt the content on the sender server and deliver a link that the recipient opens in a browser.

Each approach solves the same problem differently. S/MIME fits enterprise environments with a PKI. PGP fits technical users who exchange keys. Portal systems fit patient-facing healthcare workflows where recipient key management is impractical.

Content encryption survives any downstream server behavior. Even if the receiving mail server logs the message, indexes it for search, or backs it up to cold storage, the message body remains encrypted until the recipient decrypts it with their key.

Is Gmail email encrypted end to end

Gmail encrypts every message in transit with TLS 1.3 for outbound connections to servers that support it. Gmail also encrypts message storage at rest on Google infrastructure using AES with keys managed by Google.

Neither of those provides end-to-end encryption. Google can access message content for spam filtering, indexing, search, and legal disclosure. The user does not hold a key that keeps Google out of the message body.

Gmail S/MIME on Workspace Enterprise Plus adds certificate-based end-to-end encryption. Confidential Mode adds link expiration and SMS passcode delivery but does not encrypt the message body itself on Google servers.

For HIPAA use, Google Workspace signs a business associate agreement and provides the controls needed for compliance when properly configured. Practices should still verify TLS enforcement and layer content encryption for outbound PHI to non-Workspace recipients.

[mh_example]

Is Apple and iCloud email encrypted

Apple Mail and iCloud Mail encrypt messages in transit using TLS 1.2 or 1.3. Apple encrypts message storage at rest on iCloud servers, but the encryption keys sit with Apple, so Apple can decrypt content when legally required.

Advanced Data Protection, Apple end-to-end encryption feature for iCloud data, explicitly excludes iCloud Mail. Apple documents this exclusion in the Advanced Data Protection support article. The reason is IMAP compatibility.

Apple Mail supports S/MIME on macOS and iOS when a certificate is installed in Keychain Access. Users generate or import a certificate, and outbound messages sign and encrypt automatically to recipients with matching certificates.

For HIPAA use, iCloud Mail is not appropriate for PHI in its default configuration. Practices using Apple devices should route email through Google Workspace, Microsoft 365, or a dedicated HIPAA-compliant service that signs a BAA.

how is email encrypted in article illustration two

Is email encrypted between Gmail and Office 365

Messages between Gmail and Office 365 travel over TLS in nearly every modern deployment. Both platforms enforce STARTTLS for outbound connections to major providers, so the message travels encrypted in transit.

Neither platform provides end-to-end encryption for the message body between them by default. Google decrypts the message on receipt for spam scanning and storage. Microsoft does the same. Both providers can access content unless additional encryption was applied at the sender end.

For sender-controlled encryption between the two platforms, Google Workspace administrators enable S/MIME on Enterprise Plus, and Microsoft 365 administrators enable Purview Message Encryption or S/MIME. Both approaches require certificate exchange or portal delivery to non-encrypted recipients.

A simpler path for smaller practices is a shared HIPAA-compliant service that handles encryption on top of Gmail or Outlook without requiring PKI. That approach removes the certificate management burden entirely.

How to email encrypted files as attachments

Two paths deliver encrypted attachments. The first attaches a password-protected archive. The second wraps the whole message in content encryption that covers the attachment automatically.

Password-protected archives are the traditional fallback. Create a ZIP or 7z archive with a strong password, attach it to a normal email, and share the password through SMS, phone, or a separate secure channel.

The archive approach works with any recipient and any mail server. Its security depends entirely on password strength and out-of-band password delivery. Practices sending regulated files this way should use passwords of at least 16 characters generated from a password manager.

The content encryption approach uses S/MIME, PGP, or a portal-based service to encrypt the whole message including attachments. Recipients open the message with a key or a portal link. For PHI and other regulated content, this approach gives better auditability than password-protected archives.

[mh_protip]

Understand encrypted email file formats

Content-encrypted emails travel as MIME messages with cryptographic wrapping. The specific format depends on the encryption approach the sender used.

S/MIME messages carry a Content-Type of application/pkcs7-mime. The message body is a signed and encrypted PKCS#7 envelope. Recipients open the message in an S/MIME-capable client that decrypts the envelope with the recipient certificate.

PGP messages carry a Content-Type of multipart/encrypted with an OpenPGP application type. The message body is an OpenPGP-encrypted payload. Recipients decrypt with a PGP client that holds their private key.

Portal-based encryption delivers a wrapper message with a link to the encrypted content on the sender server. HPP files, an older legacy format, work similarly through a downloadable archive that opens in a proprietary reader. Modern portal services skip the HPP step by delivering the message directly to the recipient inbox.

Verify encryption end to end before sending PHI

Verification catches configuration gaps before they turn into HIPAA violations. Two checks matter for every regulated workflow.

First, verify TLS enforcement on both mail servers. NIST Special Publication 800-177 documents the recommended TLS configuration for email in the Trustworthy Email guide. Both sender and receiving servers should enforce TLS 1.2 or higher with strong cipher suites.

Second, verify content encryption reaches the recipient in a usable form. Send a test message with the exact encryption configuration used for real PHI, then confirm the recipient can open and reply to the message without error.

Practices building a compliant email stack also need healthcare website security features for the public-facing side. Encryption on email alone does not protect PHI on intake forms, patient portals, and appointment scheduling pages.

Choose an encryption stack that matches operational reality

Every encryption approach has an operational cost. S/MIME and PGP push key management onto the user or the IT team. Portal-based systems shift the friction to the recipient who has to click a link and sometimes create an account.

Practices with dedicated IT staff often run S/MIME with an internal PKI. Practices without dedicated IT often pick a HIPAA-focused service that handles the encryption behind the scenes. Both approaches meet compliance when configured correctly.

Mailhippo works alongside existing Gmail or Outlook accounts as a HIPAA-compliant secure email service. The base plan includes a business associate agreement and applies TLS with client-side encryption without requiring PGP keys or separate client software. Recipients open messages with one click.

Compare the options side by side. Look at email encrypted workflows, revisit whether is email encrypted for your specific stack, or review how to send email encrypted for one-off transfers. Pick based on how many messages you send per week and how much recipient friction the practice can absorb.

  • Transport encryption protects the connection, not the stored message.
  • Content encryption protects the message body across every server it touches.
  • iCloud Mail is not covered by Apple end-to-end encryption program.
  • Gmail and Office 365 encrypt in transit between each other by default.
  • PHI needs verified TLS and content encryption together.

[mh_faqs]

Posted on

How to Encrypt Email Across Every Major Provider

how to encrypt email guide featured image

[mh_key_takeaways]

Email encryption looks different in every mail client. The button lives in different menus. The recipient sees a different sign-in flow. The license required to unlock it changes by provider tier.

This guide covers how to encrypt email in Outlook, Gmail, Apple Mail, and Yahoo, plus S/MIME certificate setup and hosted alternatives. Where a healthcare team needs a simpler flow, a dedicated secure email service with a BAA in the base plan removes the license tier and portal steps entirely.

Read the sections in order. Each includes the exact click path, the recipient experience, and the license or certificate required to make it work.

The Three Practical Types of Email Encryption

Every encryption option in a mail client falls into one of three buckets. Knowing the bucket helps predict how the recipient will open the message.

TLS handles server-to-server transit. It runs automatically between providers that support it. The sender takes no action. The recipient sees a normal email in their inbox.

S/MIME and PGP encrypt the message body end to end using certificates or keys installed on each side. Setup is per user. Once configured, the flow is one click.

Portal-based encryption from Microsoft or Google routes the message through a hosted page. The recipient clicks a link and signs in or enters a one-time passcode. This adds friction but works with any recipient regardless of their client.

The right choice depends on who the recipient is and whether both parties can maintain certificates.

Encrypting Email in Outlook Step by Step

Outlook 365 and the New Outlook client both use Microsoft Purview Message Encryption behind the Encrypt button.

Compose a new message. On the ribbon, click the Options tab. Click Encrypt. Choose Encrypt-Only for standard protection or Do Not Forward to block forwarding, copying, and printing.

Add the recipient, subject, and body. Attachments inherit the same protection as the message. Click Send.

The Encrypt button requires Microsoft 365 Business Premium, E3, E5, A3, A5, or G3/G5. Business Basic and Business Standard do not include it. The Purview Message Encryption documentation lists every eligible plan.

External recipients receive a notification email with a portal link. They sign in with Microsoft, Google, or a one-time passcode. Related guide: how to encrypt email in Outlook.

how to encrypt email in article illustration one

Encrypting Email in Gmail and Google Workspace

Gmail offers two encryption paths, each tied to a different plan level.

Confidential Mode is available on all Google accounts, including personal Gmail. In the compose window, click the lock and clock icon at the bottom. Set an expiration date and optional SMS passcode.

Confidential Mode restricts forwarding, copying, and downloading. It does not encrypt the message end to end. Google can still read the content, so it does not meet HIPAA end-to-end requirements on its own.

Hosted S/MIME is available only on Google Workspace Enterprise Plus, Enterprise Standard with add-on, and Education Plus. Admins enable it in the Google Admin console under Apps, Google Workspace, Gmail, User settings.

With hosted S/MIME on, users see a padlock icon in the compose window. Green padlock means encryption is available for the recipient.

Encrypting Email in Apple Mail on macOS and iOS

Apple Mail supports S/MIME natively. Setup happens through Keychain Access.

On macOS, obtain an S/MIME certificate from a public CA or internal PKI. Double-click the .p12 file to import into Keychain. Restart Mail.

When composing a message to a recipient whose public key is in your contacts, a lock icon appears next to the subject line. Click it to toggle encryption on.

On iOS and iPadOS, install the certificate through a configuration profile pushed from an MDM provider or emailed as an attachment. Go to Settings, Mail, Accounts, select the account, then Advanced. Toggle S/MIME on.

Apple Mail S/MIME works only when the recipient also has a certificate installed and their public key is in the sender contact record. Cross-provider encryption to Gmail requires the Gmail recipient to have hosted S/MIME.

[mh_example]

S/MIME Certificate Setup and Exchange

S/MIME needs an X.509 certificate for each user. Certificates come from public CAs like DigiCert, GlobalSign, and Sectigo, or from an internal PKI.

Purchase a personal email certificate matching the user email address. Follow the CA verification steps, which typically involve a validation email and identity check. Download the .p12 or .pfx file.

Install the certificate to the local certificate store on Windows, Keychain on macOS, or the mail client store on mobile. Restart the mail client.

Before the first encrypted send, exchange signed messages with each recipient. Each signed message carries the sender public key, which the recipient client stores in the contact record.

Certificates typically expire after one year. Renewal happens through the CA portal. Expired certificates block new encrypted sends until reissued. Track expirations in a shared calendar.

how to encrypt email in article illustration two

PGP Encryption for Technical Users

PGP is the alternative to S/MIME. It uses key pairs generated locally instead of certificates issued by a CA. Journalists, security researchers, and open-source maintainers use it heavily.

Install GPG Suite on macOS, Gpg4win on Windows, or OpenKeychain on Android. Generate a key pair with a passphrase. Upload the public key to a keyserver like keys.openpgp.org or share it directly with recipients.

Configure the mail client extension. Enigmail for Thunderbird, GPG Mail for Apple Mail, and Mailvelope for browser-based Gmail all handle PGP encryption per message.

PGP has no central authority. Trust builds through key signing and web of trust models. The learning curve is steeper than S/MIME, which is why most business users skip it.

Healthcare senders rarely use PGP because recipients cannot install extensions on hospital systems. S/MIME or hosted encryption fits the workflow better.

What the Recipient Sees on Each Method

Recipient experience predicts adoption. If opening the message is hard, the sender gets a phone call instead of an acknowledgment.

  • TLS encrypted messages appear as normal emails in the inbox. No sign-in step. No portal.
  • S/MIME encrypted messages open directly in the recipient mail client provided their certificate is installed. Otherwise the client shows an encrypted attachment icon and refuses to display the body.
  • Microsoft Purview Message Encryption sends the recipient a notification email with a link. They sign in with Microsoft, Google, or a one-time passcode.
  • Gmail Confidential Mode sends a notification with a Google-hosted link. Non-Gmail recipients enter an SMS passcode if the sender enabled it.
  • A dedicated encrypted email service like Mailhippo delivers messages that open with one click, without portals or passcodes on the recipient side.

Practices whose recipients are older patients or busy referring physicians measure the friction cost carefully. One extra step per message compounds across a caseload.

[mh_protip]

Automatic Encryption Rules for Consistent Compliance

Manual clicking depends on staff remembering to encrypt. Rules take that decision out of the sender workflow.

Exchange Online admins create mail flow rules that trigger on subject keywords, sender group, recipient domain, or content matching a sensitive information type. The rule action applies Office 365 Message Encryption automatically.

Google Workspace admins configure content compliance rules under Apps, Google Workspace, Gmail, Compliance. Conditions include predefined data types for medical record numbers, Social Security numbers, and credit card numbers.

Rules cover the gap when workforce members forget to click Encrypt. They also apply to messages sent from mobile devices that lack a ribbon.

Test each rule against a monitored test mailbox before pushing to production. False positives on internal messages create friction that pushes users to send from personal accounts.

HIPAA Requirements Beyond the Encryption Click

Encryption satisfies one HIPAA Security Rule safeguard. Full compliance requires several more.

The practice signs a business associate agreement with the email provider. Microsoft and Google both offer BAAs on eligible plans. Sign it before sending PHI. The HHS Security Rule guidance covers each safeguard.

Additional obligations include workforce training on PHI handling, audit logging on message access, access controls with unique user IDs, sanction policies for violations, and incident response procedures.

A healthcare practice that clicks Encrypt but leaves the BAA unsigned is not compliant. OCR breach investigations routinely surface this gap.

Practices that also run patient-facing websites face parallel obligations. See HIPAA-compliant healthcare website design for the site-side controls that pair with encrypted email.

When a Dedicated Encrypted Email Service Makes Sense

Native encryption in Outlook and Gmail works well for organizations already on the qualifying license tier with dedicated IT staff. Elsewhere, cost and complexity push practices toward a dedicated service.

Small practices on Business Basic or a starter Workspace plan avoid the per-seat cost jump to unlock encryption. Multi-provider teams running Gmail and Outlook side by side avoid maintaining certificates in two ecosystems.

Mailhippo is a HIPAA-compliant email service that works with existing Gmail and Outlook accounts, includes a business associate agreement in the base plan, and delivers encrypted email to recipients without a portal sign-in. TLS plus client-side encryption cover the transmission safeguard without per-recipient S/MIME certificates.

Related guides: how to encrypt an email across clients, how to send encrypted email, and encrypt email for the terminology overview.

Match the method to the workflow. Native buttons for standardized enterprise tenants. S/MIME for internal certificate-managed teams. A dedicated service for practices that want one-click send and one-click open across every recipient.

[mh_faqs]

Posted on

HIPAA Compliant Email Platforms Compared for Healthcare Practices

hipaa compliant email platforms guide featured image

[mh_key_takeaways]

HIPAA compliant email platforms are mail services that support the required technical safeguards under the Security Rule and where the vendor signs a Business Associate Agreement with the covered entity. That combination is what makes an email service usable for protected health information.

The market includes major cloud providers, dedicated healthcare mail services, and gateway products that layer on top of Gmail or Outlook. This guide compares the practical options against the criteria a healthcare practice actually uses when choosing.

For a portal-based service that works on top of any existing mail provider and includes a BAA in the base plan, Mailhippo offers a HIPAA-focused secure email service designed for this use case.

What Makes an Email Platform HIPAA Compliant

Three components are required. A signed BAA with the vendor. Technical safeguards under the Security Rule. Administrative policies and workforce training.

Technical safeguards include encryption in transit and at rest, access controls, unique user identification, session timeouts, and audit logging. The HHS Security Rule lays out the full list.

Administrative safeguards include a security officer, workforce training, sanctions policy, incident response, and periodic risk assessment. These are practice-level responsibilities that no vendor covers.

Physical safeguards apply to on-premise components. Cloud-first practices with no on-premise servers meet most of these through the vendor data center. Practices with local backup drives or paper printouts still need physical safeguards for those items.

hipaa compliant email platforms in article illustration one

Google Workspace as a HIPAA Compliant Email Platform

Google Workspace supports HIPAA on Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, Education Standard, Education Plus, and Nonprofits.

The admin signs the BAA through the Admin console under Account Settings, Legal and Compliance. Core services covered by the BAA include Gmail, Drive, Calendar, Meet, and Chat. Marketplace add-ons are outside the BAA unless individually BAA-covered.

Confidential mode is not end-to-end encryption. Google holds the keys. For a HIPAA workflow, confidential mode alone is not sufficient. Practices need either hosted S/MIME on Enterprise or a portal gateway.

Hosted S/MIME is available on Enterprise Standard and above. See Google Workspace admin help for the current setup steps. Related linked topic: HIPAA compliant email Gmail.

Microsoft 365 as a HIPAA Compliant Email Platform

Microsoft 365 supports HIPAA on Business Standard, Business Premium, and every Enterprise tier. Business Basic also includes the BAA for covered services but does not include the Encrypt button.

The BAA is signed through the Volume Licensing or Products and Services agreement. Microsoft publishes the covered service list in the HIPAA Implementation Guidance document available in the Microsoft Trust Center.

Microsoft Purview Message Encryption provides the Encrypt button in Outlook. Business Standard and above include the base Purview features. Business Premium adds automatic DLP rules that trigger encryption on sensitive data patterns.

Enterprise E5 adds advanced audit, eDiscovery, and Customer Lockbox. These support the administrative safeguards for larger practices with more complex compliance requirements. Related linked: HIPAA compliant email for a general overview.

[mh_example]

Dedicated HIPAA Email Services

Dedicated HIPAA email services fall into two categories. Standalone mail providers that host the mailbox and deliver a full mail platform. Gateway services that layer on top of Gmail or Outlook.

Standalone providers include some healthcare-focused vendors that offer a hosted mailbox with a BAA. These require MX migration and usually cost more per user than Google Workspace or Microsoft 365.

Gateway services keep the existing mail provider. They add portal-based encrypted delivery for external recipients. Mailhippo is one example. The sender writes in Gmail or Outlook, and the service handles portal encryption when triggered.

Gateway services are the lower-friction choice when the practice does not want to migrate mailboxes. Related linked topic: HIPAA compliant email for therapists for a specialty-specific angle.

hipaa compliant email platforms in article illustration two

Providers That Are Not HIPAA Compliant

Several common providers do not sign BAAs and are not HIPAA-appropriate for PHI. This includes some that many practices assume are safe.

GoDaddy Professional Email does not sign a BAA. Yahoo Mail, personal Gmail, personal Outlook.com, personal iCloud, AOL, and most consumer-focused providers also do not.

Some hosting providers include email as a bundled service. Cheap shared hosting rarely includes a BAA. Practices should confirm the BAA in writing before storing or transmitting PHI on any bundled hosting mailbox.

Common non-compliant providers to watch for:

  • GoDaddy Professional Email
  • Yahoo Mail and Yahoo Mail Plus
  • Personal Gmail, Outlook.com, iCloud Mail
  • AOL Mail
  • Bundled email from shared web hosts
  • Free ProtonMail (paid Business tier does sign a BAA)

Cost of HIPAA Compliant Email Platforms

The cheapest paths start around $12 per user per month. Google Workspace Business Standard runs $12 per user per month with the BAA included. Microsoft 365 Business Standard runs $12.50 per user per month with the BAA included.

Business Premium tiers add automatic DLP encryption and more advanced audit. Google Workspace Business Plus runs about $18 per user per month. Microsoft 365 Business Premium runs about $22 per user per month.

Enterprise tiers add hosted S/MIME, advanced audit, and Customer Lockbox. Google Workspace Enterprise Standard runs about $23 per user per month. Microsoft 365 E5 runs about $57 per user per month.

Gateway services add roughly $5 to $10 per user per month on top of the base provider. For a five-user practice on Business Standard plus a gateway, the total is roughly $85 to $110 per month. Related linked: free HIPAA compliant email for a look at the limits of free options.

[mh_protip]

Feature Comparison Across the Main Platforms

The table below compares the platforms most practices consider.

Platform BAA Included Native Encryption S/MIME Automatic DLP Base Price
Google Workspace Business Standard Yes Confidential mode No No $12 per user per month
Google Workspace Enterprise Standard Yes Confidential mode plus S/MIME Yes Yes $23 per user per month
Microsoft 365 Business Standard Yes Purview Encrypt button Yes with certificate No $12.50 per user per month
Microsoft 365 Business Premium Yes Purview plus DLP Yes Yes $22 per user per month
Mailhippo gateway Yes in base plan Portal encryption Not required Trigger word or plugin Sits on top of existing mail
GoDaddy Professional Email No None No No Not for PHI

Migration Steps When Moving to a HIPAA Compliant Platform

Migration follows a standard sequence. Sign the BAA with the new provider first. This creates the legal cover before any PHI moves.

Configure the tenant. Add users. Set retention. Enable audit logging. Configure encryption defaults. Enable MFA on all accounts.

Migrate mail. Google Workspace has a Data Migration Service that pulls IMAP mail from the old provider. Microsoft 365 has a similar migration wizard in the Exchange admin center. Both take hours to days depending on volume.

Cut over MX records after the migration completes. Update transactional mail sources like the practice management system, EHR, and appointment reminder services. Train staff on the new client and the encryption workflow. Related: HIPAA-conscious website design for practices also refreshing their public site.

Choosing the Right Platform for Your Practice

The right platform depends on three inputs. Where the practice already runs. How technical the recipient set is. Whether hosted S/MIME is a real requirement.

Practices on Windows with Active Directory usually stay with Microsoft 365. Business Standard covers the base HIPAA use. Business Premium adds automatic DLP for the extra assurance that PHI never sends unencrypted.

Practices on Mac or with Chrome-heavy workflows usually stay with Google Workspace. Business Standard covers the base HIPAA use. Adding a gateway service is usually cheaper than upgrading to Enterprise Standard for hosted S/MIME.

Mailhippo operates as the gateway option across both Google Workspace and Microsoft 365. It includes a BAA in the base plan, requires no per-user certificate management, and works uniformly on desktop and mobile. Practices building a public site alongside their email program can pair this with healthcare web design so the whole intake, contact, and email chain stays inside the same compliance boundary. Related linked topics: best HIPAA compliant email and HIPAA compliant emails for further reading.

[mh_faqs]

Posted on

Secure Encrypted Email for Business and Compliance

secure encrypted email guide featured image

[mh_key_takeaways]

A secure encrypted email service does more than TLS. It applies message-level encryption, protects content at rest, provides audit-ready access controls, and, for healthcare and financial use, includes a signed business associate agreement.

The main options include native features in Gmail and Outlook, standalone privacy-focused providers, and purpose-built HIPAA-compliant services. Understanding secure encrypted email starts with the specific threat model and compliance context.

This guide covers the categories, the trade-offs, and the criteria for selecting a service that fits a specific workflow.

Secure Encrypted Email Combines Multiple Protections

A secure encrypted email service protects messages at three layers. Transport, using TLS to secure the connection between mail servers. Content, using message-level encryption so only the recipient can read the plaintext. Storage, using encryption at rest on the mail server.

Beyond encryption, a secure service includes strong authentication for the sender, audit logging for access to encrypted content, spam and phishing filtering to prevent fraudulent messages from reaching the inbox, and, for regulated use, a signed contract with the sender covering handling of protected data.

Some services bundle all of these. Others provide the encryption layer but leave authentication, filtering, and audit logging to the mail platform. Evaluate a service by the completeness of the protection stack, not by any single feature.

According to NIST SP 800-45, secure email systems should enforce authentication of sender identity, protect messages in transit and at rest, and maintain access logs for audit purposes.

Native Encryption in Gmail and Outlook Has Specific Limits

Gmail and Outlook include encryption features, but the availability depends on the plan tier. Gmail supports TLS on every account and S/MIME hosted encryption only on Workspace Enterprise. Outlook supports S/MIME on all desktop-enabled plans and Microsoft Purview Message Encryption on Business Premium and higher.

Neither provider enforces encryption by default. The sender must click Encrypt in Outlook or use Confidential Mode in Gmail to trigger message-level protection. A regular send goes over TLS if available, or plaintext if not.

For HIPAA, both providers offer a business associate agreement at qualifying plan tiers. Microsoft signs a BAA for Microsoft 365 Business Standard and higher. Google signs one for Workspace Business Standard and higher. The BAA covers the platform, but it does not automatically enforce encryption on every send.

secure encrypted email in article illustration one

Privacy-Focused Providers Offer End-to-End Encryption

ProtonMail, Tutanota, and Mailfence provide end-to-end encryption where the provider itself cannot read message content. Messages between users of the same service are encrypted automatically. Messages to external recipients can be sent through a password-protected link.

These services lead for personal privacy. They are the standard recommendation for journalists working with sources, activists in high-risk regions, and users who want encryption that even the service provider cannot bypass.

They are less common for HIPAA-scale healthcare deployments because their business focus is privacy rather than healthcare compliance. Business plans may include a BAA on higher tiers, but the integration with existing Gmail or Outlook accounts is limited.

Sibling coverage on this category is in ProtonMail encrypted email and related provider comparisons.

HIPAA-Focused Services Solve Healthcare Recipient Friction

Purpose-built HIPAA-compliant email services target healthcare and other regulated business use. They include a signed BAA in the base plan without negotiation. They enforce encryption on every send. They handle external recipients through a portal fallback.

Mailhippo is one of these services. It integrates with existing Gmail or Outlook accounts through SMTP relay or a plug-in. The sender writes and sends from their normal client. The service encrypts and delivers over TLS when supported or through a portal link when not.

The recipient experience is a single click on a notification email, a one-time passcode, and a browser view. No account creation, no key management, no software install. This suits patients, external providers, and vendors who cannot be expected to manage certificates.

[mh_example]

Service Category Comparison

Each service category fits a specific use case. The table summarizes the practical trade-offs across the main options for business users evaluating secure encrypted email.

Category End-to-End BAA in Base Plan Recipient Friction Best For
Gmail/Workspace Enterprise only Business Standard and up Low for internal, medium for external Organizations already on Workspace
Outlook/Microsoft 365 S/MIME and Purview Business Standard and up Low for tenant, medium for external portal Organizations already on Microsoft 365
Privacy providers Yes, within service Higher tiers only High for non-users Personal privacy, journalists
HIPAA-focused service Yes, portal-based Yes, base plan Low, click and passcode Healthcare, regulated business

The clearest divide is between platforms and purpose-built services. Platforms bundle encryption with a broader mail service. Purpose-built services focus on the encryption and compliance layer, integrating with an existing mail platform.

secure encrypted email in article illustration two

HIPAA-Compliance Requires More Than Encryption

Encryption is one required control under HIPAA, not the complete picture. HIPAA also requires a signed business associate agreement with any vendor handling PHI, audit logs of access to PHI for six years, access controls limiting who can read PHI, and a documented risk assessment covering the sender infrastructure.

A secure encrypted email service that is HIPAA-ready bundles most of these. The BAA is included. The audit logs are built in. The access controls include multi-factor authentication and role-based permissions. The provider provides documentation supporting the sender risk assessment.

For healthcare organizations that also handle patient acquisition, encrypted email pairs with HIPAA-compliant website design and healthcare website security features as part of the broader compliance stack.

According to the HHS Security Rule, transmission security is addressable, meaning the covered entity must document why any specific method meets the standard for the assessed risk.

Cost Considerations Vary by User Count and Plan

Purpose-built HIPAA-compliant email services typically price at around $10 per user per month for unlimited sends with a signed BAA. Costs scale with user count and vary by feature tier for administrator controls, archive retention, and integrations.

Microsoft 365 Business Premium, which unlocks the Encrypt button, costs around $22 per user per month at published pricing. For a small practice, adding a HIPAA-focused service to Business Standard at around $12.50 plus the service cost is often less than upgrading every seat to Business Premium.

Google Workspace Enterprise Plus, which includes S/MIME hosted encryption, prices significantly higher than Business Standard. Small teams typically add a HIPAA-focused service rather than upgrading the Workspace tier for encryption alone.

Cost decisions should weigh the license price against administrator time. Certificate management for S/MIME is real work. Portal-based services remove that overhead.

[mh_protip]

Enforced Encryption Removes Human Error

The single most impactful design choice in a secure encrypted email deployment is whether encryption is enforced or user-triggered. User-triggered encryption relies on the sender clicking a button before every sensitive send. Enforced encryption applies to every message regardless of user action.

User-triggered systems fail when a sender forgets. This is documented as one of the most common HIPAA breach causes. A sender types a message containing PHI, forgets to click Encrypt, and sends over plaintext or opportunistic TLS.

Enforced-encryption systems apply the protection at the SMTP relay or at the DLP layer, so every outbound message gets checked and encrypted before delivery. This removes the human-error path.

  • Purpose-built HIPAA services enforce encryption at the relay by design.
  • Microsoft Purview supports enforced encryption through a data loss prevention rule.
  • Gmail supports enforced encryption through Content Compliance rules in the Workspace Admin console.
  • Native S/MIME and PGP are user-triggered by default.

Verification and Audit Support the Compliance Case

A secure encrypted email deployment needs to prove it worked. Audit logs, delivery reports, and encryption-status tracking are the evidence a compliance reviewer looks for.

Microsoft 365 provides Message Trace and the Purview compliance portal. Google Workspace provides Email Log Search and BigQuery export. Purpose-built services provide their own admin portals with access logs, delivery status, and per-recipient audit trails.

For a HIPAA risk assessment, the reviewer will ask for evidence that encryption was applied consistently over the assessment period. The audit log is the answer to that question.

According to HIPAA Journal, audit-log gaps are one of the most common findings in Office for Civil Rights investigations.

Choose Based on Recipient, Volume, and Compliance Bar

The decision framework for selecting a secure encrypted email service reduces to a few practical questions. Who are the recipients? How many messages per week? What compliance framework applies? What is the tolerance for user error?

  • Recipients are internal certified users only: S/MIME with corporate certificates.
  • Recipients include external patients or vendors without technical setup, HIPAA scope: purpose-built service with portal fallback.
  • Recipients are on the same Microsoft 365 tenant: native Encrypt button plus a service for external mail.
  • High volume of regulated mail, low tolerance for human error: enforced encryption at the relay.

For healthcare organizations coordinating email security with the broader marketing and web stack, encrypted email deployment pairs with healthcare marketing services.

The final rule is that the cheapest secure encrypted email service is the one that fits the specific workflow. Match the service to the recipients, the volume, and the compliance requirement. Verify enforcement, log access, and review the audit trail on a set schedule.

[mh_faqs]

Posted on

Encrypting an Email Explained From Setup to Recipient View

encrypting an email guide featured image

[mh_key_takeaways]

Encrypting an email converts the message body and attachments into ciphertext that only an authorized recipient can read. The sending client, the mail server, or both handle the encryption depending on the method used.

This guide covers the current methods for encrypting an email across Outlook, Gmail, and HIPAA-focused services. It explains the setup, the sender steps, the recipient experience, and when a dedicated encrypted email service is a simpler fit.

Encryption is one layer in a broader security posture. The right method depends on plan level, recipient environment, and compliance requirements. Read each section to match the method to the use case.

Encryption Standards Fall Into Three Main Categories

Email encryption uses three main models: transport-level encryption, message-level encryption, and portal-based encryption. Each model protects a different segment of the delivery path.

Transport-level encryption uses TLS between the sending and receiving mail servers. TLS is the baseline. It protects the message during network transmission but leaves the content in cleartext on the mail servers at each end.

Message-level encryption uses S/MIME or PGP to encrypt the message body and attachments before they leave the sending client. Only the recipient key can decrypt the message. The mail servers see ciphertext.

Portal-based encryption stores the encrypted message on a server and delivers a link to the recipient. Microsoft Purview Message Encryption and most HIPAA email services use this model. The recipient authenticates and reads the message in a browser session.

Microsoft Purview Message Encryption Covers Most Outlook Users

Microsoft Purview Message Encryption is the default encryption path for Outlook users on Microsoft 365 Business Premium and higher. The sender clicks Options, then Encrypt, in the ribbon of a new message. Purview handles the encryption and delivery on the server side.

Two options appear: Encrypt-Only and Do Not Forward. Encrypt-Only encrypts the content and lets the recipient reply, forward, and print. Do Not Forward encrypts the content and blocks forward, print, and download.

External recipients on Gmail, Yahoo, or another provider receive a notification email with a Read the message button. The button opens outlook.office365.com in a browser. The recipient signs in with a Microsoft or Google account or requests a one-time passcode.

Detailed sender steps are in the Microsoft support guide for encrypted messages in Outlook. The setup on the tenant side is minimal if Azure Rights Management is already active.

encrypting an email in article illustration one

Gmail Users Rely on Confidential Mode or Client-Side Encryption

Gmail offers two encryption features. Confidential mode is available on every Gmail account, including personal Gmail and every Workspace plan. Client-side encryption is available only on Workspace Enterprise Plus and Education Plus.

Confidential mode sets an expiration date and disables forward, copy, print, and download. It does not encrypt the message body in a way that meets HIPAA transmission requirements on its own. Google can still access the content on its servers.

Client-side encryption encrypts the message content in the browser before it reaches Google servers. The encryption keys are managed by the customer through an external key service. Google cannot decrypt the message.

Standard Workspace plans that need encryption for HIPAA use a gateway or a dedicated HIPAA email service. The Gmail interface stays the same. The encryption happens at the outbound gateway or at the service layer.

S/MIME Provides End-to-End Encryption With Certificates

S/MIME is a message-level encryption standard supported by Outlook, Apple Mail, and most enterprise mail clients. It uses X.509 certificates issued by a trusted certificate authority such as DigiCert, Sectigo, or IdenTrust.

The sender installs a personal certificate in the mail client. The recipient must also have an S/MIME certificate available. Outlook stores recipient certificates from signed messages the user has previously received.

Once certificates are in place, the sender clicks Encrypt on a new message. The mail client uses the recipient public key to encrypt the content. The recipient decrypts with the private key stored in the recipient client.

S/MIME provides true end-to-end encryption because no server between the sender and recipient can decrypt the message. The trade-off is certificate management. Practices with dozens of external recipients need a workflow for exchanging certificates before the first encrypted message can go out.

[mh_example]

PGP Handles Encryption Between Technical Users

PGP, sometimes called OpenPGP or GPG, is a second message-level encryption standard. It relies on a web of trust rather than a centralized certificate authority. Users generate a key pair and publish the public key to a key server or exchange it directly.

PGP is common in security research, legal work, and technical communities where both parties are comfortable managing keys. Mainstream Outlook and Gmail do not include PGP out of the box. Third-party plugins add support.

The strengths of PGP are strong cryptography and no dependence on a central authority. The weaknesses are key management overhead and a recipient experience that assumes technical familiarity. A patient receiving a PGP message will not know how to decrypt it.

Healthcare practices sending PHI to patients almost never use PGP because the recipient experience is unrealistic. PGP fits internal or business-to-business scenarios where both sides run the same tooling.

TLS Alone Does Not Meet HIPAA Transmission Requirements

TLS encrypts the connection between mail servers. It is the baseline for any modern mail transmission. TLS 1.2 and TLS 1.3 are the current versions in use, according to NIST SP 800-52 Rev. 2.

Opportunistic TLS is the common default. If the receiving server supports TLS, the connection uses TLS. If the receiving server does not support TLS, the connection falls back to cleartext. A sender using opportunistic TLS cannot guarantee the message stayed encrypted end to end.

Forced TLS requires the receiving server to support TLS or the message does not go out. Forced TLS is safer but harder to configure across a large recipient list. Most Outlook and Gmail tenants use opportunistic TLS by default.

HHS guidance treats TLS as acceptable for transmission but recommends message-level encryption for high-risk PHI. See the HHS Security Rule guidance for the current position. Practices should assume TLS alone is not sufficient.

encrypting an email in article illustration two

Sensitivity Labels Automate Encryption at Scale

Sensitivity Labels in Microsoft 365 apply encryption automatically based on content classification. Administrators define labels in the Microsoft Purview compliance portal and set rules that trigger a label when the message contains specific patterns.

Patterns can include medical record numbers, Social Security numbers, credit card numbers, or custom regular expressions for practice-specific fields. A matching pattern applies the label and the encryption policy in one step.

The sender does not have to remember to click Encrypt. The system enforces encryption based on content. This removes human error from the encryption decision on routine mail.

Deployment requires Microsoft 365 E3 or E5 licensing and configuration of Purview Information Protection. Sensitivity Labels fit large practices and health systems that already run Microsoft 365 at the enterprise tier.

Attachments Are Encrypted Along With the Message Body

Every current message encryption method encrypts attachments as part of the message. S/MIME, PGP, Microsoft Purview, and Google client-side encryption all treat attachments and the body as a single encrypted unit.

The recipient sees one verification step. After the sign-in or key decryption, both the body and the attachments become readable. Do Not Forward rights in Microsoft Purview show attachments in the portal preview and block download.

Attachment size limits apply before encryption is added. Outlook and Gmail cap standard attachments at 20 to 25 megabytes. Very large files exceed the limit and get rejected before encryption is even attempted.

Practices sending large imaging files, video, or full record sets should use a HIPAA-compliant file transfer service instead of email attachments. The email carries the link. The file transfer service handles the payload.

Encryption Alone Does Not Equal HIPAA Compliance

HIPAA compliance includes administrative, physical, and technical safeguards. Encryption is one of the technical safeguards. The covered entity is responsible for the full set.

The covered entity needs a signed business associate agreement with the email provider, access logging, workforce training, an incident response plan, and configuration that enforces encryption on PHI. Microsoft 365 and Google Workspace include a BAA as part of the standard business terms.

Practices that outsource the full mail security posture use a HIPAA email service that includes the BAA, encryption, access logs, and audit trails in a single plan. Mailhippo is one option for practices that want a HIPAA-compliant secure email service that works with an existing Gmail or Outlook account without switching providers.

The choice between running encryption inside Microsoft 365 or Google Workspace and using a dedicated service comes down to IT capacity, license cost across all seats, and the sensitivity of the mail volume.

[mh_protip]

Practical Setup Checklist for a First-Time Sender

A first-time sender can get an encrypted message out today by picking one path and running through the setup. The choice depends on the mail platform already in use.

  • Confirm the license level of the Microsoft 365 or Google Workspace tenant.
  • Verify that a business associate agreement is in place with the mail provider if PHI is involved.
  • Enable the Encrypt button in Outlook or client-side encryption in Gmail if the license supports it.
  • Test with an external recipient on a different mail platform to see the actual recipient view.
  • Document the sender steps for staff who will send encrypted mail on a routine basis.

The test send matters. The sender view is not the recipient view. A practice sending encrypted PHI to a patient should see the exact browser experience the patient will see before sending real mail.

Practices building the wider HIPAA posture around the encryption method also need to cover the website, intake forms, and patient portals. See the guide on healthcare website security features for the site-side controls that pair with encrypted email.

Common Errors When Encrypting an Email

Several errors show up in the first weeks of a new encrypted email workflow. Most trace back to license mismatch, recipient environment, or a missing configuration step on the tenant.

  • The Encrypt button does not appear in Outlook because the license is Business Basic or Business Standard.
  • The recipient does not receive the notification because a corporate spam filter blocks the outlook.office365.com sender.
  • The S/MIME send fails because the recipient certificate is not in the Outlook contact record.
  • The one-time passcode does not arrive because the recipient inbox filters bulk mail into a folder the recipient does not check.
  • Attachments exceed the 25 megabyte limit and get rejected before encryption is applied.

Each of these errors has a fix. Licensing is a purchase or a switch to a service that bundles encryption. Recipient filters can be addressed by asking the recipient to allow the sender domain. Certificates can be exchanged through a first signed message.

Related reading covers practical steps for common platforms: to encrypt an email, encrypting email in Outlook, email encrypting workflows, and what does encrypting an email do in outlook. Each guide breaks down the sender view for a specific tool.

When a Dedicated Encrypted Email Service Fits Better

A dedicated encrypted email service fits practices that need HIPAA compliance without adding license overhead or IT complexity. The service handles the encryption, the BAA, the access logs, and the recipient portal.

The sender writes mail in the same Gmail or Outlook interface. Outbound mail routes through the service gateway. The recipient gets a portal link or a native decrypt depending on the service configuration.

Mailhippo is a HIPAA-compliant secure email service that works with existing Gmail and Outlook accounts. The BAA is included in the base plan. Encryption applies to every outbound message. Recipients open messages with one click, without creating a Microsoft or Google account.

Practices building the wider healthcare digital presence often pair encrypted email with a compliant site, intake, and portal setup. A healthcare marketing agency can coordinate the site and communication layer around the encryption service already in place.

[mh_faqs]

2637 E. Atlantic Blvd.
#1063 Pompano Beach, FL 33062

© 2026 MailHippo, Inc.

View our Privacy Policy or contact our Customer Service team.

Optometrist Marketing Agency – Web Design, SEO, PPC & Maintenance