The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →U.S. hospitals can use email to communicate electronic protected health information (ePHI), but no single product or setting makes that use HIPAA-compliant. The hospital should base safeguards on a documented, organization-specific risk analysis, then combine recipient checks, limited disclosure, appropriate access and transmission protections, staff training, monitoring, and incident response. For a cloud provider handling ePHI on the hospital’s behalf, assess the service and put an appropriate business associate agreement (BAA) in place.
Does HIPAA allow hospitals to send patient information by email?
Yes. HIPAA does not categorically prohibit email for ePHI. HHS Office for Civil Rights (OCR) says the Security Rule allows ePHI to be sent over an open electronic network when it is adequately protected. That email FAQ was last reviewed July 26, 2013, so it is useful guidance but not a product approval or a substitute for assessing current requirements and the hospital’s own environment. Read HHS OCR’s email and Security Rule FAQ.
As an Amazon Associate I earn from qualifying purchases.
The Privacy Rule also permits providers to communicate electronically with patients when they apply reasonable safeguards. HHS’s patient-email FAQ, also last reviewed July 26, 2013, gives checking an address and limiting the amount or type of information in unencrypted email as examples. Patients may request reasonable alternative means or locations for confidential communications. See HHS OCR’s patient email guidance.
In practice, “Is hospital email HIPAA compliant?” is not a yes-or-no question about an email brand. The hospital must evaluate the actual service, configurations, people, workflows, contracts, and risks. A patient’s willingness to receive an email does not by itself remove the hospital’s Security Rule duties.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Start with the hospital’s risk analysis
Before selecting controls, identify where ePHI enters, travels, is stored, and can be accessed through email and connected systems. HHS describes risk analysis as foundational to the Security Rule and calls for an accurate and thorough assessment of risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Suitable methods depend on the organization and its environment; the hospital should document both its assessment and the reasons for its protection choices. HHS OCR’s risk analysis guidance explains the assessment, while its risk analysis and risk management FAQ distinguishes identifying risk from acting to reduce it.
Include the hospital’s own mail servers or cloud service, mobile devices, user roles, integrations, message archives, and outside recipients. Consider human errors such as inadvertent data entry, network attacks, malware, unauthorized access, and relevant natural or environmental threats. HHS lists examples in its threats FAQ. Findings should lead to a risk-management plan, assigned responsibilities, and periodic review when systems, threats, or workflows change.
Rank #2
- FIDO2 Certified Passkey Authentication: Officially FIDO2 certified for secure, passwordless login on supported platforms. Use modern passkeys with hardware-backed protection. Please verify your intended service supports FIDO2 hardware keys before purchase.
- Precision Fingerprint Sensor: Built-in high-accuracy biometric fingerprint sensor ensures fast, convenient authentication while preventing unauthorized access. No PIN reuse, no shared secrets—only your fingerprint unlocks the key.
- Strong Hardware 2FA/MFA Security: Enhances account protection with physical-presence and biometric verification, helping defend against phishing, credential theft, and account takeovers.
- USB-C Wired Compatibility (No NFC): Designed for stable USB-C authentication on desktops and laptops, including Windows, macOS, and Linux systems. Ideal for users and enterprises that prefer wired-only security keys.
- Durable Aluminum Shield, Portable Design: Features the same precision aluminum protective shield for long-term durability. Compact, lightweight, battery-free, and network-free-built for everyday carry and professional environments.
Choose the right communication path for the message
How hospitals can send patient information securely by email depends on who needs it, what is necessary for the task, and what safeguards the channel supports. Use ordinary email with appropriate safeguards only when the assessed risks and workflow support it; consider a secure-message workflow or another channel where those options better control access or reduce address-error risk.
Recommended Free Tools
| Decision factor | What to assess |
|---|---|
| Patient preference | Whether the patient has requested a reasonable alternative means or location for confidential communication, and how staff will honor that preference. |
| Recipient and authentication | How recipients are verified, how the message is protected from address errors, and whether a recipient must authenticate before viewing sensitive content. |
| Confidentiality and integrity | Protection while messages travel and while they are stored, plus safeguards against unauthorized access or alteration. |
| Workflow and usability | Whether clinicians and staff can use the channel reliably without creating unsafe workarounds or delays in appropriate care communication. |
| Auditability and response | What activity can be logged and reviewed, and whether investigators can establish who accessed or sent a message during an incident. |
| System integration | How the channel interacts with clinical systems, identity controls, archiving, and the hospital’s recovery processes. |
| Vendor and contract terms | Provider access, BAA scope, retention, security responsibilities, data return, disclosure limits, availability, and backup arrangements. |
| Operational burden | The cost and administration required to configure, support, train for, and monitor the option. |
These are practical comparison criteria, not an HHS ranking of products or channels. The appropriate choice follows from the hospital’s risk analysis and the needs of the communication.
Rank #3
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
Build safeguards into sending and access workflows
Verify the recipient and limit unnecessary details
- Check the complete address before sending, especially when autocomplete suggests a contact or when a message has multiple recipients.
- Use an address-confirmation step for patient communications when appropriate, and maintain a reliable way to record communication preferences.
- Include only the information needed for the communication. Where unencrypted email is used, assess whether reducing the amount or type of information is a reasonable privacy safeguard.
- Review recipients, attachments, reply-all lists, and subject lines for unintended disclosure before sending.
Restrict access and protect message integrity
Use access controls that limit email and message data to authorized users and roles. Assess how accounts are authenticated, how access is removed when roles change, and how the hospital prevents or detects unauthorized access. Consider integrity protections so that ePHI is not improperly altered in transit or storage. Configure audit controls to record and review relevant activity; logs are useful only when the hospital has defined who reviews them and how concerning activity is escalated.
Assess transmission protections, including encryption
Evaluate the protection available for messages moving across internal and external networks, including open networks, and document why selected transmission controls are reasonable and appropriate for the identified risks. Encryption may be an important safeguard, but it is one part of a broader control program; the word “encrypted” on a product is not proof that every HIPAA obligation has been met.
Rank #4
- Fingerprint reader with Windows Hello: Built-in biometric sensor enables you to log in, access sensitive data, or authorize transactions in just 0.05 seconds with 360-degree all-round detection, supporting up to 10 registered fingerprint IDs for multiple users
- AES-256 encrypted biometric security: Protects stored fingerprint data using matching on chip technology with AES-256, SHA-256, ECC-256, and TRNG protocols, achieving a false acceptance rate of less than 1 in 100,000 and a false rejection rate under 1.8 percent
- Low-profile membrane keys for all-day comfort: Slim, streamlined key design provides a quiet and smooth typing experience that requires minimal pressing force, reducing finger fatigue during extended typing sessions at home or in the office
- 12 dedicated shortcut hotkeys: Includes 5 internet hotkeys for Homepage, Email, Back, Forward, and Search plus 7 multimedia hotkeys for Play/Pause, Stop, Previous Track, Next Track, Volume Down, Volume Up, and Mute for quick access
- USB-C connection with USB-A adapter included: Full-size 104-key US layout keyboard connects via USB-C and comes with a USB-C to USB-A adapter for broad compatibility with Windows 11 and Windows 10 systems, measuring 18.3 x 6.5 x 1.3 inches and weighing just 1.5 pounds
HHS breach guidance treats ePHI as rendered unusable, unreadable, or indecipherable to unauthorized individuals under specified guidance when it is encrypted using qualifying processes and the keys or processes needed to decrypt it have not also been breached. That has a role in breach analysis; it does not automatically determine whether an incident is reportable or establish that the email system complies with every HIPAA requirement. See HHS guidance on rendering PHI unusable, unreadable, or indecipherable.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsTrain staff and make incidents reportable
Technical settings cannot prevent every mistaken recipient or compromised account. Train clinicians and staff on the hospital’s approved communication paths, recipient checks, handling of attachments, patient preferences, and how to report suspected misdirection, phishing, account compromise, or other unusual activity. Make the reporting route easy to find and ensure reports reach the privacy and security teams promptly.
Best Value
- FIDO2 CERTIFIED: FIDO Alliance Certified FIDO2 v2.1 and CTAP Level 1 for 2FA and MFA on Google Microsoft Apple GitHub login.gov AGOV SwissID and any WebAuthn service
- PASSKEY READY: Works as a hardware passkey for passwordless sign-in where the service enables it and as a U2F and WebAuthn security key everywhere else
- CERTIFIED SECURITY: NXP JCOP 4.5 secure element rated Common Criteria EAL6+ (augmented)
- TAP OR INSERT: Dual NFC ISO 14443 and contact ISO 7816 interface in an ID-1 format smart card that is passive and battery-free
- BUILT TO LAST: Passive smart card made in Switzerland designed by Swiss company Cryptnox and backed by a 2 year manufacturer warranty
Pair training with operational safeguards: role-based access, account lifecycle controls, audit review, backup and recovery, and a defined incident-response process. HHS identifies these types of protections among broader Security Rule safeguards; they work together rather than serving as alternatives to one another. HHS’s health-information safeguards overview discusses training, access, audit, incident response, backup and recovery, and encryption where reasonable and appropriate.
Govern cloud email and other service providers
If a cloud provider creates, receives, maintains, or transmits ePHI on the hospital’s behalf, determine what the specific service does with that information and assess the associated risks. HHS says a covered entity or business associate using a cloud service to handle ePHI needs an appropriate BAA with the provider. The hospital remains responsible for understanding its own obligations and evaluating its risks; outsourcing email does not outsource that responsibility. See HHS OCR’s cloud-service FAQ, last reviewed January 9, 2023.
Review the actual service and contract terms, not just a provider’s general security statement. Confirm that service-level terms do not conflict with the BAA or HIPAA duties, and address responsibilities for security, availability, backups, retention, disclosure limitations, and return of data when service ends. Include vendor access and the service’s role in incident notification and investigation in the hospital’s risk assessment.
Respond to suspected email exposure
When staff suspect a message was misdirected, an account was compromised, or ePHI was otherwise exposed, they should report it immediately under institutional procedures. The privacy and security teams should preserve relevant evidence, investigate access and disclosure, contain ongoing exposure, and assess applicable breach-notification duties with appropriate legal or compliance support. Do not infer that an incident is harmless or reportable solely from whether a message was encrypted; assess the facts and applicable requirements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
