HIPAA-compliant email, video and messaging for medical practices

Is email HIPAA compliant? The short answer

Yes, with conditions. HHS's FAQ on emailing patients (opens in a new tab) says providers may communicate with patients by email if they "apply reasonable safeguards when doing so." HHS's Security Rule FAQ (opens in a new tab) adds that the rule "does not expressly prohibit the use of email for sending e-PHI," as long as it is adequately protected.

Three conditions turn "allowed" into "compliant":

1. A BAA with the email provider, for the plan you actually use.
2. Protection in transit, assessed and documented.
3. The patient's preference respected, including a patient who asks for plain email.

Is Outlook HIPAA compliant? On a business plan, it can be. Microsoft's HIPAA page (opens in a new tab) lists Exchange Online, Microsoft's hosted business email, among in-scope services, and says its BAA "is available through the Microsoft Online Services Data Protection Addendum by default" to covered entities. Personal Outlook.com accounts aren't on the list. The full check is Microsoft 365 and HIPAA.

Dated verdicts for everyday tools

Each status below comes from the vendor's own documentation, checked in October 2026. Each linked page carries its own "last verified" date and the exact conditions.

The pattern repeats: the free and personal versions staff sign up for on their own are the ones without a BAA. Curious how your practice looks from the outside? A free marketing audit scores your website, listings and ads, and flags privacy risks such as tracking pixels on patient forms.

What HIPAA requires: BAAs, encryption, access

BAAs. HHS's cloud computing guidance (opens in a new tab) says a cloud provider that creates, receives, maintains or transmits PHI for you is a business associate and needs a BAA. That holds "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key." The conduit exception "is limited to transmission-only services," which rules out any email or file service that stores your data. The basics of what a BAA must say are in business associate agreements.

Encryption. The Security Rule's transmission security standard (opens in a new tab), 45 CFR 164.312(e), requires measures against unauthorized access to PHI in transit. Encryption is "addressable": implement it "whenever deemed appropriate," and HHS expects you to document the decision either way.

Access. The same section requires audit controls that "record and examine activity" in systems holding PHI. Practically: practice-owned accounts only, multifactor sign-in, and removing access the day someone leaves.

A BAA isn't the finish line. Asked whether its BAA ensures compliance, Microsoft answers "No." Your settings and habits finish the job. Marketing software, from CRMs to scheduling links, gets the same review in HIPAA checks for marketing software.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Emailing patients who ask for it

Patients often prefer email, and HIPAA lets them choose it.

• Patient-initiated email. HHS's email FAQ says that if a patient contacts you by email, you may assume email is acceptable unless they say otherwise. If you doubt they understand the risk, explain it and let them decide.
• Records by unencrypted email. HHS's right of access FAQs (opens in a new tab) say a patient can ask for records by email, and you must send them that way if they're readily producible. After warning them of the risk, you aren't responsible for a disclosure in transit.
• Alternative channels. Under 45 CFR 164.522(b) (opens in a new tab), you must accommodate reasonable requests to be contacted "by alternative means or at alternative locations," without asking why.

Write the answer in the chart. Promotional email to patients is a different question with different rules; see HIPAA email marketing rules.

Video visits and meetings

HHS's pandemic-era leniency for video apps is gone. The Federal Register notice (opens in a new tab) says the telehealth transition period expired "at 11:59 p.m. on August 9, 2023." Since then, a video visit needs a vendor that signs a BAA for the plan in use.

In the table above, Zoom, Google Meet and Microsoft Teams can be covered on paid or business plans; FaceTime can't. Telehealth-only platforms are the other route; Doxy.me and HIPAA checks one of the best known, plan by plan.

Whichever tool you pick, the same three settings decide most of the risk:

• A waiting room or lobby, so the clinician admits each patient.
• Recording off, unless a visit genuinely needs one.
• AI summaries and note-takers checked against the vendor's BAA before anyone switches them on.

Messaging and texting

Encryption is where messaging apps sound reassuring and where they mislead. WhatsApp, Signal and iMessage all encrypt messages end to end, and none offers a BAA we could find. The chats also sit on personal phones and in personal backups the practice doesn't control.

For patients, the safe channels are your patient portal, a secure messaging tool whose vendor signs a BAA, or plain-logistics texts the patient has agreed to. For staff, a covered workspace such as Slack on an Enterprise plan works, with patients kept out.

If your practice texts from a business phone or messaging platform, the dated checks for Google Voice (covered under Google Workspace for licensed, managed users), RingCentral and Twilio cover what each vendor's BAA includes.

File sharing and e-signatures

Sending an X-ray to a specialist or a signed consent back to a patient puts PHI in a file service. The rules are the same across vendors:

• A business account under the vendor's BAA, never a personal one.
• Share with a named person, not "anyone with the link."
• Links that expire, and no PHI in file or folder names.
• A monthly look at what's shared outside the practice.
• Access removed the day an employee leaves.

Personal cloud storage is the usual leak. Apple's iCloud terms (opens in a new tab) tell covered entities not to use iCloud "to create, receive, maintain or transmit" PHI; see iCloud and HIPAA for photos and backups on staff phones. Dropbox, Box and DocuSign are in the verdict table above.

Keep PHI out of email in the first place

The cheapest email risk to remove is the one you create yourself. Many practice websites email every form submission, with names, phone numbers and the reason for the visit, to a front-desk inbox, sometimes through a form plugin with no BAA.

1. List every website form and where its notifications go.
2. Ask each form vendor whether it signs a BAA.
3. Switch notifications to "new request, log in to view" where you can.
4. Move patient documents to your portal or EHR, and reserve email for logistics.

Medfy doesn't sell email, video, texting or file-sharing tools. What it changes is step one: Medfy's HIPAA-compliant website forms deliver requests into an encrypted patient CRM and inbox instead of sending patient details around by email. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada, with role-based permissions and an audit log. Medfy signs a BAA with every practice before any patient data flows, and ad platforms never receive patient data.

Read how Medfy handles patient data, or see what's included in Medfy pricing.

Frequently asked questions

Is regular email HIPAA compliant?

Email can be used, with conditions. HHS lets providers email patients with reasonable safeguards, and the Security Rule allows PHI over open networks if it's adequately protected. Your email provider must sign a BAA, your protection for messages in transit must be assessed and documented, and patients' preferences respected. A free consumer account fails the first test. Confirm your setup with your compliance officer or attorney.

Can a patient ask us to email them without encryption?

Yes. HHS says patients may receive copies of their records by unencrypted email if they ask, and once you've warned them of the risk, you aren't responsible for a disclosure in transit. You must still take reasonable care, such as checking the address. Record the warning and the patient's choice in the chart. Confirm your process with your compliance officer or attorney.

Is Outlook HIPAA compliant?

Outlook on a business Microsoft 365 plan can be. Microsoft's HIPAA page lists Exchange Online, Microsoft's hosted business email, among in-scope services, and its BAA comes through the Data Protection Addendum by default for covered entities. Personal Outlook.com accounts aren't on that list. Microsoft adds that the BAA alone doesn't make you compliant. Confirm your plan with your compliance officer or attorney.

Do we need a BAA with our email provider?

Yes, because a hosted email service stores your messages, and those include patient information. HHS's cloud guidance says a provider that maintains PHI is a business associate even if the data is encrypted and it holds no key, and the conduit exception covers only transmission-only services. Google and Microsoft offer BAAs on business plans. Confirm coverage with your compliance officer or attorney.

What's the safest way to send patient documents?

Through your patient portal or EHR, where the patient signs in and the vendor already works under your BAA. If you must use email or file sharing, use a BAA-covered business account, share with a named person instead of a public link, set links to expire and keep PHI out of file names. Ask first how the patient wants to receive it.