Protect ePHI
Regulated entities must use reasonable and appropriate administrative, physical, and technical safeguards for electronic protected health information.
HIPAA email security · updated August 2026
HIPAA compliant email starts with the whole workflow
HIPAA does not certify an email app with a single switch. A defensible workflow combines risk analysis, access controls, authentication, transmission security, vendor and BAA review, retention, workforce training, and correct use. This guide explains what to evaluate before electronic protected health information (ePHI) moves through email, messaging, files, or voice.
Primary HHS sourcesNo paid rankingsNo compliance shortcut claimsStatic & privacy-first
Security Rule mindset
SafeguardsBAAWorkflow
Use the checklist
ePHI safeguards
BAA review
Direct answer
Can healthcare providers use email under HIPAA?
Yes. HHS says covered healthcare providers may communicate electronically with patients when they apply reasonable safeguards. For ePHI, the Security Rule and the organization’s risk analysis still matter.
Verify access
Access control, audit controls, integrity, authentication, and transmission security are core technical areas in the Security Rule.
Review vendors
If a vendor creates, receives, maintains, or transmits ePHI on behalf of a regulated entity, Business Associate Agreement obligations may apply.
Start here
The HIPAA email evaluation path
Use the requirements page as the main checklist, then drill into the area that matches your actual workflow.
HIPAA email requirements
Risk analysis, access controls, authentication, transmission security, retention, training and incident response.
Business Associate Agreements
When vendor relationships may require a BAA—even when a cloud provider cannot decrypt the content it stores.
Email & messaging security
Encryption, keys, endpoints, authentication, metadata and operational controls.
Secure healthcare file sharing
Evaluate files, downloads, retention, endpoints and authorized access—not just attachment encryption.
Email vs secure messaging
Choose between a normal inbox workflow, secure portal, private messenger, or a combination.
Encrypted healthcare voice
Understand how private browser voice can complement written communication and what compliance questions remain.
Privacy-focused tools
Two separate tools for encrypted communication
These are product references, not HIPAA certifications. Verify your organization’s BAA and compliance requirements before using any service for ePHI.
AliasCloak
E2EE mail · chat · files
Browser-based private mailboxes and real-time chat with local private keys, encrypted files, generated identities, and optional annual custom aliases.
- End-to-end encrypted mailbox messages and chat
- Encrypted file transfer up to 4 GB
- TOTP-protected new sessions and encrypted backups
- Generated mailbox identities with optional annual custom aliases
Murmivo
E2EE voice · ephemeral side chat
Murmivo provides browser-based, audio-only private rooms using aliases. Voice and ephemeral room chat are application-layer end-to-end encrypted in the browser.
- No phone number required for guest calls
- Temporary rooms disappear after inactivity
- Host controls for room size and speakers
- Murmivo says it does not store call audio or room chat history
Practice-specific guides
Translate the rules into real workflows
Different workflows create different risks. These pages focus on common healthcare use cases without pretending one product fits every organization.
Therapists & private practice
Patient communication, intake documents, referrals, records and privacy boundaries.
Small healthcare practices
A practical checklist for small teams that still need rigorous access and vendor controls.
Anonymous encrypted mailbox
Understand AliasCloak’s privacy model, aliases and the difference between privacy features and compliance controls.
Primary sources
Read the HHS guidance behind the checklist
Healthcare security is a high-stakes topic. This site prioritizes HHS/OCR primary sources and flags product-specific claims separately.
- HHS — Summary of the HIPAA Security Rule
Administrative, physical and technical safeguards; access control, integrity, authentication and transmission security.Open ↗ - HHS — Email with patients
Reasonable safeguards and electronic communication under the Privacy Rule.Open ↗ - HHS — HIPAA and cloud computing
Cloud service provider responsibilities, risk analysis and BAAs.Open ↗ - HHS — Business associates
Who can be a business associate and what BAAs generally need to address.Open ↗
Build the workflow before choosing the tool
Start with the Security Rule and BAA checklist. Then evaluate the actual product, endpoints, people, retention and incident-response process.