Tag: encrypted email

[mh_key_takeaways]

Sending an encrypted email used to require certificates, keys, and a shared setup between sender and recipient. Native email clients now include options that skip most of that friction, and dedicated services handle it entirely on the server side.

The right method depends on the account you send from, the recipient software, and whether the message contains regulated data like protected health information. Practices and developers who need a HIPAA-safe path can look at a secure email service that sits behind Gmail or Microsoft 365 without extra client software.

This guide walks through the native encryption steps for Gmail, Outlook, iPhone Mail, and code, and shows where each option fits. It also covers the recipient experience, which is the part that most often decides whether an encryption workflow gets used or ignored.

Gmail confidential mode is a starting point, not full encryption

Gmail confidential mode is available on every account, including free personal Gmail. Composing a message and clicking the padlock-and-clock icon at the bottom of the window opens the confidential mode panel.

Confidential mode sets an expiration date, blocks recipients from forwarding, copying, printing, or downloading the message, and can require an SMS passcode. Google stores the message on its own servers and delivers the recipient a link rather than the full body.

The message body itself is not encrypted end-to-end. Google can read it, and confidential mode alone does not satisfy HIPAA requirements because Google does not sign a business associate agreement for free consumer Gmail.

For paid Google Workspace tenants, S/MIME is available on the Enterprise Plus, Education Standard, and Education Plus plans. The admin enables hosted S/MIME in the Google Admin console, uploads a certificate for each user, and the compose window then shows a lock icon that toggles between signed, encrypted, and both.

External S/MIME requires the recipient to hold a matching certificate, which limits the practical scope to organizations that have already exchanged certificates. For patient communication, most practices use a portal-based service instead.

Outlook uses the Encrypt button on Business Premium and higher

Microsoft 365 Business Premium, Apps for Enterprise, and the E3 and E5 tiers include Microsoft Purview Message Encryption. In new Outlook and Outlook on the web, the Encrypt button appears in the Options ribbon and offers two presets.

The first preset is Encrypt, which locks the message so only recipients with valid credentials can open it. The second is Do Not Forward, which encrypts the message and additionally blocks forwarding, printing, and copying by the original recipients.

External recipients receive a link and open the message in a browser portal after signing in with Microsoft, Google, Yahoo, or a one-time passcode. The workflow is documented in the Microsoft Purview Message Encryption reference.

For a tenant on Business Basic or Business Standard, the Encrypt button does not appear. Options are to upgrade the affected mailboxes, add Azure Information Protection as a per-user license, or layer a third-party encrypted email service on top of the existing account.

Purview also requires the tenant to have signed a business associate agreement with Microsoft before it can be considered HIPAA-covered. That agreement is available at no extra cost on eligible plans but must be requested through the Service Trust Portal.

iPhone Mail supports S/MIME with a configuration profile

Apple Mail on iOS 17 and later supports S/MIME on iCloud, Exchange, and IMAP accounts. Enabling it requires a personal certificate installed through a configuration profile, either from the organization mobile device management console or a signed .mobileconfig file.

Once the certificate is trusted, the account Advanced settings screen exposes a Sign and an Encrypt toggle under S/MIME. Enabling Encrypt tells Mail to attempt encryption on every outbound message from that account.

The compose screen shows a lock icon next to the recipient. A closed lock means Mail has the recipient public certificate and will encrypt the message. An open lock means the certificate is missing and the message will go out unencrypted.

For clinical staff sending patient information from a phone, S/MIME on iOS works but depends on prior certificate exchange with every recipient. That is often unrealistic for patient-facing mail.

A hosted encrypted email service accessed through the mobile browser or a light native app removes the certificate management step. The same account works from desktop, web, and phone.

C# applications can encrypt mail with System.Security.Cryptography.Pkcs

The .NET standard library ships with S/MIME primitives in the System.Security.Cryptography.Pkcs namespace. The developer loads the recipient X.509 certificate, wraps the message body in an EnvelopedCms container, and encrypts it using the certificate public key.

The resulting binary is packaged into a MIME message with the application/pkcs7-mime content type, then sent through SMTP with SmtpClient or MailKit. Recipients open it in an S/MIME-aware mail client, which decrypts it with the matching private key.

The MimeKit library adds a higher-level Multipart/Signed and Multipart/Encrypted wrapper that handles most of the MIME assembly automatically. MimeKit also supports PGP through the BouncyCastle backend for teams that prefer that path.

For applications that send protected health information, calling a secure email API that encrypts every outbound message server-side is usually faster than building and maintaining certificate code. The BAA is signed at the vendor level and covers every message the application sends.

SSIS packages that need to send encrypted mail from a scheduled data flow can call a script task that runs the same .NET code, or shell out to a PowerShell step that uses the Send-MailMessage cmdlet against a hardened SMTP relay.

[mh_example]

PGP is powerful but rarely the right fit for everyday practice mail

PGP encrypts the message body with the recipient public key and signs it with the sender private key. It has been the standard for security-conscious technical users since the 1990s.

The friction is real. Both sides must generate keys, publish public keys somewhere the other side can find them, and use a mail client with PGP support such as Thunderbird with the built-in OpenPGP module or GPG Suite on macOS.

Web-based Gmail and Outlook require browser extensions like Mailvelope to handle PGP, which adds another moving part and a browser-side keyring the user must protect and back up.

For patient-facing communication, PGP is impractical because most patients do not have keys and will not create them. Portal-based systems bypass the key exchange problem entirely and are easier to explain to non-technical recipients.

For sending encrypted messages between two developers or two security teams, PGP remains an efficient choice, and the OpenPGP working group standard is documented at the IETF.

HIPAA-safe encrypted email needs a signed business associate agreement

HIPAA requires covered entities and their business associates to sign a business associate agreement before sharing protected health information. That agreement must be in place before any email service can be considered HIPAA-safe for patient data.

Google Workspace and Microsoft 365 both offer a BAA on eligible paid plans, but the practice must request and sign it. Free consumer accounts are never covered, regardless of how the mail is encrypted.

The HHS HIPAA guidance explains which providers count as covered entities and when a BAA is required. Any vendor that touches, stores, or transmits PHI on the covered entity behalf falls under the rule.

A dedicated encrypted email service such as Mailhippo includes the BAA in the base plan, so every message sent through the account is covered without a separate request or license upgrade. That removes one of the more common compliance gaps found in small-practice audits.

For practices that want the convenience without changing their existing mail platform, see how to send encrypted emails from any account without adding client software.

The recipient experience decides whether the workflow gets used

The most secure encryption method fails if the recipient cannot open the message. Every method above has a different recipient experience, and matching that experience to the audience matters as much as the underlying cryptography.

S/MIME and PGP require the recipient to have keys or certificates already set up. Purview and Workspace portal messages require the recipient to sign in or use a one-time passcode.

Portal-based encrypted email services typically deliver a link that opens in a browser, with a passcode sent to the recipient inbox or phone. Patients open it, read the message, and reply through the same secure channel without any account setup.

Front-desk staff, billing, and referring providers each have different tolerance for portal login steps. Testing the full round-trip with a real recipient before rolling the workflow out avoids the most common cause of failed encryption programs, which is that nobody actually opens the encrypted messages.

Practices building a full patient communication stack should also think about the surrounding website. Guidance on security features for healthcare websites covers form handling, SSL, and portal integration alongside encrypted email.

Attachments carry the same encryption rules as the message body

Attachments are the most common source of PHI exposure because staff often paste a scanned document or a lab report into a message without thinking about the transport. The same encryption rules apply to attachments as to the body.

Purview and Google Workspace S/MIME encrypt attachments along with the body when the encryption toggle is on. Confidential mode in free Gmail applies expiration and forwarding limits but does not encrypt the attachment end-to-end.

File size limits are a separate consideration. Gmail caps attachments at 25 MB, Outlook at 20 MB on most tiers, and many portal-based encrypted services support larger files by hosting the attachment on their own storage and delivering a link.

For large medical imaging files, a dedicated secure file transfer service alongside encrypted email is often the right pattern. A single encrypted message can then reference the file link and include the passcode.

Verifying that attachments actually arrive encrypted is worth doing during initial rollout. Sending a test message to a personal address on a different provider surfaces any downgrade to plain text.

[mh_protip]

Automation and shared inboxes need a different setup

Scheduled reports, appointment reminders, and billing notifications sent from an application or a shared inbox cannot rely on a human clicking Encrypt in the ribbon. They need a policy or an API that encrypts every outbound message automatically.

Microsoft Purview supports mail flow rules that apply encryption based on the sender, recipient, subject, or content. A rule can encrypt every message going to a specific insurance carrier or every message from a specific mailbox.

Google Workspace has similar content compliance rules under Apps, Google Workspace, Gmail, Compliance in the Admin console. Rules can trigger S/MIME encryption or route the message through a third-party gateway.

For custom applications, a secure email API removes the rule complexity by encrypting every message at the transport layer. The application calls a single endpoint and the vendor handles the compliance mechanics.

Common patterns worth automating include appointment reminders with clinic name and date only in the plain-text body and the full detail behind a secure link, and billing statements delivered through a portal link rather than a raw PDF attachment.

Auditing what you actually send matters more than the theory

Every encrypted email program should include a periodic audit of the sent folder against the encryption logs. The point is to confirm that messages containing PHI actually went out encrypted, not that the option was available.

Microsoft Purview reports show which messages triggered the Encrypt policy and which recipients opened them. Google Workspace audit logs show S/MIME activity and portal opens.

A monthly review that samples a handful of outbound messages catches the common failure modes early. Common findings include messages sent from a mobile client that skipped the encryption step, messages CC-ed to personal addresses, and forwarded threads that dropped the encryption header.

The NIST SP 800-177 Rev. 1 Trustworthy Email guidance covers the technical controls that support this kind of audit, including DKIM, DMARC, and TLS reporting.

Practices that want a shorter path can use encrypted email as a single-vendor service that logs every message, portal open, and reply against the account, which shortens the audit to a single report.

Picking a method comes down to the recipients and the volume

For internal mail between employees on the same tenant, S/MIME or Purview Do Not Forward is the low-friction path because everyone already has the required setup.

For mail to patients, referring providers, and insurance carriers, portal-based encryption avoids the certificate exchange problem. Recipients get a link and read the message without installing anything.

For high volume automated mail from an application, a secure email API is the right layer because it applies encryption once at the transport rather than in every application code path.

Sole practitioners and small practices sending occasional patient mail from a mixed set of devices, including iPhones, get the least friction from a dedicated encrypted email service that includes the BAA and works with any existing Gmail or Microsoft 365 account.

Whichever method fits, the first test is always the same. Send a message to a real recipient outside your organization, confirm they can open it, and confirm they can reply through the same encrypted channel. If any step fails, patient mail will fall back to plain text within days.

[mh_faqs]