Posted on

How to Encrypt Email in Outlook (2026 Complete Guide)

how to encrypt email in outlook guide featured image

🔑 Key Takeaways

  • Outlook has three encryption paths: Purview Message Encryption, S/MIME, and Office Message Encrypt.
  • The Encrypt button only appears on Business Premium, E3, E5, or A3/A5. Basic and Standard hide it.
  • S/MIME needs X.509 certs on both sides plus yearly renewal. Peer clinics keep it, patients drop it.
  • External recipients open Purview mail through a portal link. Sign in with Microsoft, Google, or OTP.
  • HIPAA needs a signed BAA, training, audit logs, and policies. Encryption alone is not compliance.

Outlook offers built-in encryption on most business plans, but the button only appears when the license, tenant configuration, and client version all line up. Missing one piece leaves the sender clicking on a feature that does nothing.

This guide walks through every path for how to encrypt email in Outlook, from the Encrypt button on Microsoft 365 to S/MIME certificates and Office Message Encryption rules. Where a healthcare team needs a simpler alternative, a secure email service with a BAA in the base plan often removes the recipient-side portal friction entirely.

Each method below includes the exact ribbon path, the license requirement, and the recipient experience. Skip to the section that matches your Outlook version and plan.

Outlook Supports Three Different Encryption Methods

Outlook does not have one encryption feature. It has three, and they behave differently at the recipient end.

Microsoft Purview Message Encryption is the modern default. It sits behind the Encrypt button in the ribbon on Microsoft 365 Business Premium and higher. External recipients get a portal link.

S/MIME uses X.509 certificates installed on each sender and recipient. It works entirely inside the client and produces a message that opens directly in Outlook without a portal step. Setup and certificate maintenance limit its practical reach.

Office Message Encryption is the older brand name for what is now Purview Message Encryption. Exchange Online admins can trigger it through mail flow rules based on subject keywords, recipient domain, or content sensitivity labels.

Picking the wrong path is the top cause of failed encryption rollouts. Read the recipient experience before deciding.

License Requirements Determine Which Method You Can Use

The Encrypt button in Outlook only appears on tenants with a qualifying license. Cheaper plans block the feature at the tenant level.

Microsoft 365 Business Premium, Enterprise E3, Enterprise E5, A3, A5, and G3/G5 all include Purview Message Encryption. Business Basic and Business Standard do not. Personal and Outlook.com accounts have no access at all.

Admins verify entitlement in the Microsoft 365 admin center under Billing, then Licenses. The full breakdown lives in the Microsoft Purview Message Encryption documentation.

S/MIME has no Microsoft license gate. It works on any Outlook client, including consumer accounts, provided each user brings a valid certificate from a public or internal certificate authority.

Practices that need HIPAA-grade encryption and do not want to upgrade all seats to Business Premium often pair a lower-cost Microsoft plan with a dedicated encrypted email service.

how to encrypt email in outlook in article illustration one

The Encrypt Button in New Outlook and Outlook 365

The most common path is the Encrypt button on the ribbon of Outlook 365 and the New Outlook client.

Compose a new message. On the ribbon, click the Options tab. Click Encrypt. A dropdown offers Encrypt-Only, Do Not Forward, and any custom sensitivity labels the admin has published.

Pick Encrypt-Only for standard transmission protection. Pick Do Not Forward when you need to block forwarding, copying, and printing on the recipient side.

Add the recipient, subject, and message body. Attachments inherit the same protection. Click Send.

Internal recipients on the same tenant open the message directly in their Outlook client. External recipients receive a notification email with a portal link.

If the Encrypt button is grayed out, the license is missing or the client has not synced. Sign out and sign back in before opening a support ticket.

Encrypting Email in Classic Outlook 2016 and 2019

Classic Outlook 2016 and 2019 support Purview Message Encryption through the same ribbon path, with one extra permission menu.

In classic Outlook, the button lives under File, Properties, Security Settings while composing. On the ribbon, click Options, then Permission. Pick Encrypt-Only or Do Not Forward from the dropdown.

Older Outlook 2013 installs need a client update patch and Azure Rights Management activated on the tenant. Without the patch, the Permission button prompts for a rights management server that does not exist.

The rest of the workflow matches the new client. Recipient portal experience, attachment inheritance, and admin logging all behave identically across versions.

Teams on Outlook 2013 should plan a client upgrade. Microsoft ended mainstream support for Office 2013 in 2018 and extended support in 2023.

Example

A three-person dermatology practice on Microsoft 365 Business Standard tries to click Encrypt on a referral message and finds the button missing from the Options ribbon. The office manager verifies licenses in the admin center, upgrades one seat to Business Premium for the referral coordinator, waits 24 hours for the license to propagate, then signs out and back in. The Encrypt button appears. The coordinator picks Do Not Forward and sends the message. The specialist receives a portal link and reads it in the browser.

S/MIME Setup for Certificate-Based Encryption

S/MIME uses public-key cryptography. Each sender and recipient holds a certificate. The sender encrypts with the recipient public key. The recipient decrypts with their private key.

Obtain an X.509 certificate from a trusted CA or internal PKI. Import the certificate to the Windows certificate store under Personal. Match the certificate email address to the Outlook account email.

In Outlook, open File, Options, Trust Center, then Trust Center Settings, then Email Security. Click Settings under Encrypted email. Point Outlook to the installed certificate.

Before sending an encrypted message, exchange signed messages with each intended recipient. Each signed message carries the sender public key, which Outlook stores in the contact record for future encryption.

S/MIME certificates expire annually. Track expiration dates in a shared calendar. An expired certificate blocks all new encrypted sends until renewal.

how to encrypt email in outlook in article illustration two

Automatic Encryption Rules in Exchange Online

Manual clicking works for individual senders. Organizations that must encrypt every message matching a policy need mail flow rules.

An admin opens the Exchange Online admin center. Under Mail flow, then Rules, they create a new rule. Conditions can include subject contains PHI, recipient domain matches an external partner, or content contains a sensitive information type like Social Security number.

Action: Apply Office 365 Message Encryption and rights protection. Select Encrypt-Only or Do Not Forward. The rule fires server-side on every matching message without any sender action.

Rules cover the compliance gap when workforce members forget to click Encrypt. They also apply to messages sent from mobile clients that lack the ribbon.

Test the rule against a monitored test mailbox before pushing to production. False positives on internal messages create friction that pushes users to send from personal accounts.

Recipient Experience Determines Adoption

Encryption succeeds only when the recipient opens the message. Portal friction kills adoption.

Purview Message Encryption sends the external recipient a notification email. The email carries a link to the message portal. The recipient clicks, chooses a sign-in method, and reads the message.

Sign-in options include Microsoft account, Google account, or one-time passcode delivered to the same inbox. The passcode option adds thirty seconds and one extra click.

Elderly patients, referring physicians on legacy email systems, and vendor billing staff sometimes stall at the portal step. They call the practice for help. That call is the hidden cost of portal-based encryption.

Services like Mailhippo deliver encrypted email that opens like a normal message on the recipient side, which removes the support call entirely. Practices weighing tradeoffs should test both flows with a real referral partner.

💡Pro Tip: Verify the BAA before turning on Encrypt for PHI

The Encrypt button in Outlook satisfies the HIPAA transmission safeguard, but the practice is not compliant without a signed Business Associate Agreement with Microsoft on file. Sign the BAA through the Microsoft 365 admin center at no extra cost on eligible plans, then configure audit logging and document workforce training before staff start sending PHI. OCR audits routinely find the gap between working encryption and a missing BAA during breach investigations.

HIPAA Compliance Requires More Than Encryption

Purview Message Encryption satisfies the Security Rule transmission security safeguard. It does not make a practice HIPAA compliant on its own.

The covered entity must sign a business associate agreement with Microsoft. The BAA is available at no extra cost through the Service Trust Portal. Practices without a signed BAA on file are not compliant even when the encryption works correctly.

Additional requirements include audit logging on message access, workforce training records, sanction policies, and documented procedures for PHI email. The HHS Security Rule guidance covers each safeguard in detail.

Practices that build websites handling patient data face parallel obligations. A HIPAA-compliant intake form pairs with encrypted email. See healthcare website security features for the site-side controls.

Compliance is a program, not a checkbox. Encryption is one piece.

Common Errors and How to Fix Them

Three errors account for most encryption support tickets. Each has a specific fix.

  • Encrypt button missing after license upgrade. Sign out of Outlook, close the app, wait up to 24 hours for tenant propagation, sign back in.
  • Recipient cannot open the portal. Confirm the notification email did not land in spam. Ask the recipient to request a one-time passcode instead of Microsoft or Google sign-in.
  • Attachments download without protection. Convert Word and Excel files to PDF before attaching, or apply Do Not Forward instead of Encrypt-Only.
  • S/MIME send fails with a no valid certificate error. Verify the recipient sent a signed message first so their public key is in the address book.
  • Mail flow rule fires on internal messages. Add a sender is outside the organization is false exception or scope by recipient domain.

Run each fix in order. If the error persists, capture the message header and open a Microsoft support case. Include the tenant ID, the affected user UPN, and the exact error text.

Related guides in this series cover how to encrypt email across providers, how to encrypt an email in Outlook 365, and how to encrypt email in new Outlook.

When a Dedicated Encrypted Email Service Fits Better

Outlook encryption works well for organizations already standardized on Business Premium or higher with dedicated IT staff. It creates friction elsewhere.

Small practices on Business Basic or Business Standard face a cost jump per seat to unlock Purview. Multi-provider teams running Google Workspace and Microsoft 365 side by side hit sign-in friction on the recipient portal.

Mailhippo is a HIPAA-compliant email service that works with existing Gmail and Outlook accounts, includes a business associate agreement in the base plan, and delivers messages to recipients without a separate portal login. Client-side encryption plus TLS covers the transmission security safeguard without requiring per-recipient S/MIME certificates.

Practices running healthcare marketing sites often pair encrypted email with a compliant patient-facing web presence. See healthcare marketing services for the site-side counterpart.

Pick the tool that matches the workflow. Outlook Purview for standardized enterprise tenants. S/MIME for internal certificate-managed teams. A dedicated encrypted service for practices that want one-click send and one-click open across every recipient.

Frequently Asked Questions

Which Outlook plans include the Encrypt button? +

Microsoft 365 Business Premium, Enterprise E3, Enterprise E5, Apps for Enterprise with add-on, A3, A5, and Government G3 and G5 all include Microsoft Purview Message Encryption. Business Basic, Business Standard, and Apps for Business do not include it and cannot use the Encrypt button without an add-on license. Personal plans and Outlook.com free accounts do not include Purview at all. The Encrypt button will appear grayed out or missing in the ribbon on plans that lack the entitlement.

Can I send an encrypted email to a Gmail address from Outlook? +

Yes. When you click Encrypt in Outlook and send to a Gmail address, the recipient gets a notification email with a link to a Microsoft-hosted portal. They open the portal, sign in with their Google account or request a one-time passcode, and read the message. Replies from the portal return encrypted. The recipient never needs an Outlook or Microsoft 365 account. The experience adds one click compared to a normal email but keeps the content protected end to end.

What is the difference between Encrypt and Encrypt-Only in the Outlook ribbon? +

Encrypt applies default protection, which prevents forwarding by unauthorized users and enforces sign-in for external recipients. Encrypt-Only allows the message to be forwarded by the recipient but keeps the content encrypted in transit and at rest inside the recipient mailbox. Do Not Forward is a stricter option that blocks forward, copy, and print. Practices sending PHI typically pick Do Not Forward for records requests and Encrypt-Only for routine coordination.

Does Outlook encrypt attachments the same way as the message body? +

Attachments inherit the same encryption applied to the message when Purview Message Encryption is active. Word, Excel, PowerPoint, and PDF files stay protected inside the recipient portal and cannot be downloaded outside it when Do Not Forward is selected. Other file types download with the protection removed, so senders should convert sensitive spreadsheets or notes to PDF before attaching. Attachment size still follows the standard 25 MB Exchange Online limit unless SharePoint delivery is triggered.

How do I set up S/MIME in Outlook for internal team encryption? +

The admin obtains X.509 certificates from a trusted certificate authority or an internal PKI and deploys them to each user Windows certificate store. Each user opens File, Options, Trust Center, Trust Center Settings, then Email Security, and points Outlook to their certificate. Before the first encrypted send, users exchange signed messages so public keys populate the address book. From that point, the Sign and Encrypt buttons in the message ribbon apply S/MIME per message.

Is Microsoft 365 encryption enough for HIPAA compliance? +

The encryption meets the HIPAA Security Rule technical safeguard for transmission security, but compliance requires more. The practice signs a business associate agreement with Microsoft, configures audit logging, trains workforce members on PHI handling, and documents policies. Administrative safeguards like access controls and workforce sanctions still belong to the practice. A practice that clicks Encrypt but skips the BAA or leaves auditing off is not compliant. A signed BAA is available through the Microsoft 365 admin center at no extra cost on eligible plans.

What if the Encrypt button is missing after I upgraded my license? +

Sign out of Outlook completely, close the application, and reopen it. If the button still does not appear, wait up to 24 hours for the license to propagate across the tenant. Confirm the license assignment under Users, Active Users in the admin center. Verify Azure Rights Management is activated under Settings, Org settings, Microsoft Azure Information Protection. On the desktop client, run Get-IRMConfiguration in Exchange Online PowerShell to confirm InternalLicensingEnabled is true.

Posted on

S/MIME Email Encryption Explained for Business and Healthcare

s mime email encryption guide featured image

🔑 Key Takeaways

  • S/MIME uses X.509 certs from a trusted CA. Both sides must exchange public keys before a first send.
  • Signing proves sender identity. Encryption scrambles the body. Two separate steps in the client.
  • Lost private keys make every prior encrypted message unreadable. Back the PKCS 12 file to a vault.
  • S/MIME meets HIPAA transit rules only when both sides hold certs. Pair with a portal for patients.
  • Microsoft 365 and Google Workspace Enterprise run S/MIME natively. Apple Mail reads the keychain.

S/MIME email encryption is one of the two dominant standards for message-level email security. It uses X.509 certificates issued by a trusted certificate authority to sign and encrypt mail directly in Outlook, Apple Mail, and Google Workspace Gmail.

This guide covers how S/MIME works, where it fits in a business or healthcare workflow, and where it fails in practice. It also shows when a portal-based encrypted email service is the better operational choice.

S/MIME is documented in IETF RFC 8551. It has been in wide use since the late 1990s. The standard is stable, but real-world adoption depends on how each mail client handles certificates.

S/MIME Uses X.509 Certificates for Sign and Encrypt

Every S/MIME user holds a keypair. The public key sits inside an X.509 certificate issued by a certificate authority. The private key stays on the user device.

Signing works like this. The sender client computes a hash of the message and encrypts that hash with the sender private key. The recipient client decrypts the signature with the sender public key and verifies the hash matches the received message.

Encryption works the reverse way. The sender client encrypts the message body with the recipient public key. Only the recipient private key can decrypt the body.

Signing proves identity. Encryption protects content. A message can be signed only, encrypted only, or both. Most business setups sign every outbound message and encrypt only when the content warrants the extra step.

How S/MIME Email Encryption Works End to End

The sender writes a message and clicks encrypt. The mail client looks up the recipient certificate in its address book. If the certificate is not present, encryption fails and the client prompts for a public key.

Once the recipient certificate is available, the client generates a random symmetric session key. It encrypts the message body with that session key. It then encrypts the session key with the recipient public key.

Both the encrypted session key and the encrypted body are packaged into a MIME container and sent. The mail servers see only an encrypted blob. They cannot inspect content, run keyword rules, or scan for malware inside the encrypted portion.

The recipient client decrypts the session key with the recipient private key. It then decrypts the body with the session key. This hybrid approach uses public key cryptography only for the small session key, which is much faster than encrypting the whole body asymmetrically.

s mime email encryption in article illustration one

Certificate Acquisition and Installation Are the First Hurdle

A user needs a valid S/MIME certificate before they can send or receive encrypted mail. Certificates come from public CAs, corporate PKI systems, or free personal issuers.

Public CA options include Sectigo, DigiCert, GlobalSign, and Actalis. Prices range from free personal certificates to $200 per user per year for higher assurance levels. The email address in the certificate must match the address the user sends from.

Corporate deployments use Active Directory Certificate Services on Windows Server or a hosted PKI service. Certificates issue automatically to domain-joined machines through group policy. This is the workflow at hospitals and large insurance carriers.

Installation involves importing the PKCS 12 file into the mail client certificate store. The private key must be marked non-exportable in enterprise deployments to prevent theft. Backup happens through key escrow held by IT.

Outlook Supports S/MIME on Microsoft 365 Business Standard and Above

Outlook on Windows, Mac, and Outlook on the web all support S/MIME. The user installs a certificate, opens Options, and selects Trust Center, then Email Security.

Under Encrypted email, the user picks a certificate for signing and a certificate for encryption. These are often the same certificate. The user chooses whether to sign or encrypt outgoing messages by default.

Once configured, a new lock icon and signature icon appear in the compose window. The user toggles them per message. Address book entries for recipients cache public certificates as they arrive on signed messages.

Microsoft published detailed S/MIME configuration guidance for Exchange Online and Outlook. Admins deploying S/MIME across a tenant should follow that guidance rather than a per-user manual install path.

Example

A cardiology group and a partner imaging center exchange 40 patient referrals a week. Both run Microsoft 365 Business Standard with Outlook. Each provider buys a Sectigo personal S/MIME certificate for $60 a year, installs it through Trust Center under Email Security, and sends a signed introductory message to the counterparts. Public keys populate the address book automatically. From that point, every referral goes out encrypted with one click of the encrypt icon in the compose ribbon. Patient records reach the imaging center encrypted at rest inside each recipient mailbox.

Gmail Supports Hosted S/MIME on Enterprise and Education Tiers

Google Workspace supports S/MIME on Enterprise Standard, Enterprise Plus, Education Standard, and Education Plus. Personal Gmail and Business Starter, Standard, and Plus do not support S/MIME.

The admin uploads root and intermediate CA certificates in the Google Admin console. They then enable S/MIME for the organizational unit. Individual users upload their personal certificate through Gmail settings under Accounts.

Once uploaded, a lock icon appears next to the recipient field in the Gmail compose window. Green means an encrypted message is possible because the recipient certificate is on file. Gray means encryption is not available for that recipient.

Google documents the setup at the Google Workspace admin help center. Practices considering the Enterprise upgrade for S/MIME should weigh the per-user cost difference against a gateway alternative that works on Business Standard and Plus.

s mime email encryption in article illustration two

S/MIME and HIPAA Compliance Have Real Alignment

HIPAA requires the covered entity to implement technical safeguards for PHI in transit and at rest. S/MIME provides encryption at the message level, which covers both transit and storage on the recipient side.

A signed BAA with the mail provider handles the business associate relationship. Microsoft 365 and Google Workspace on Business Standard and above both offer a BAA. The CA that issues S/MIME certificates is usually not a business associate because it never handles PHI content.

Where S/MIME clears HIPAA is peer-to-peer clinical email between certificate-holding parties. Where it fails is patient-facing mail, because patients do not hold certificates. Practices sending PHI to patients need a portal service or a secure messaging platform. See the general framing on healthcare website security features for context on how email fits inside the wider stack.

Documentation matters. HIPAA auditors want to see certificate lifecycle records, key backup procedures, and workforce training on encryption use. A policy document that describes when to sign and when to encrypt is required for a defensible S/MIME program.

Common S/MIME Failure Modes and Their Fixes

Certificate expiration is the top cause of S/MIME failures. Certificates typically renew every one to three years. A missed renewal breaks all signing and encryption on the day of expiry.

Address mismatch is the second most common problem. If the certificate email address does not exactly match the sender From address, the recipient client shows a security warning and sometimes blocks the message. Aliases and shared mailboxes trigger this often.

Common S/MIME failure modes include:

  • Expired sender or recipient certificate
  • Missing intermediate CA in the recipient trust store
  • Sender From address does not match certificate email
  • Recipient never exchanged a signed message, so no public key is cached
  • Private key lost during mailbox migration or device replacement
  • Mobile client without certificate provisioning receives content as an unopenable attachment

Related linked topic: email encryption software for a broader look at tools that address these failure modes automatically.

💡Pro Tip: Back up the S/MIME private key before you use it

The single most common S/MIME failure is a lost private key during a device replacement or mailbox migration. Every message previously encrypted to that key becomes unreadable with no recovery path. Export the private key from the certificate store to a PKCS 12 file, store it in an encrypted vault or hardware token, and record the location in a policy document. Corporate deployments use key escrow through an internal PKI so IT can restore access when a user leaves.

S/MIME Versus PGP for Business Use

S/MIME and PGP solve the same problem with different trust models. S/MIME uses centralized certificate authorities. PGP uses a web of trust where users sign each other public keys.

For business use, S/MIME wins on native client support. Outlook, Apple Mail, and enterprise Gmail all handle S/MIME without plugins. PGP requires a plugin like GPG Suite for Apple Mail or Mailvelope for Gmail.

PGP wins on cost and independence. There is no CA to pay, and no gatekeeper to trust. That makes PGP popular with journalists and open source projects but rare in regulated business workflows where auditability is required.

Related context: email encryption as a broader category, and email encryption service for hosted options that hide the S/MIME versus PGP choice behind a portal.

S/MIME Comparison With Other Encryption Methods

The table below sets S/MIME against the other common methods a business considers.

Method Trust Model Native Client Support Recipient Setup Required Fit for HIPAA
S/MIME X.509 CA Outlook, Apple Mail, Gmail Enterprise Certificate install Peer to peer only
PGP Web of trust Plugins in most clients Keyring install Rare in healthcare
TLS only Server certificate All modern clients None In transit only
Portal gateway Vendor account Any browser Password or one-time code Patient and peer both work

Most healthcare practices end up with a mix. S/MIME for peer clinics that hold certificates and a portal for patients and one-off external contacts. See related coverage in secure email encryption service and encryption for email.

When to Use S/MIME and When to Use a Gateway

Use S/MIME when the organization already runs on Microsoft 365 Business Standard or higher, or Google Workspace Enterprise, and the recipient set is stable and technical. Peer clinics, insurance carriers, and referring specialists fit this pattern.

Use a gateway when recipients are variable, include patients, or refuse to install certificates. Portal-based services handle any recipient with any browser. The tradeoff is the extra click on the recipient side.

Mailhippo is a portal gateway that sits on top of Gmail or Outlook, includes a BAA in the base plan, and requires no per-user certificate management. It complements an S/MIME deployment rather than replacing it. Peer traffic can still run over S/MIME. Patient traffic runs through the gateway.

Practices building a compliant public-facing site alongside their email strategy often pair encryption planning with HIPAA-conscious website design so intake, contact, and email flows all stay inside the same compliance boundary.

Frequently Asked Questions

What does S/MIME stand for? +

S/MIME stands for Secure/Multipurpose Internet Mail Extensions. It is an IETF standard defined in RFC 8551 that specifies how X.509 public key certificates sign and encrypt MIME email content. The standard has been in wide use since the late 1990s and is supported by every major mail client on desktop and mobile. S/MIME is separate from PGP, which uses a web of trust model rather than certificate authorities. The two standards are not interoperable at the protocol level.

How does S/MIME email encryption differ from TLS? +

TLS encrypts the network connection between two mail servers. Once the message reaches the recipient mail server, TLS ends and the plaintext sits on that server. S/MIME encrypts the message body itself. The encrypted content survives across every server hop and stays encrypted at rest in the recipient mailbox until decrypted with the recipient private key. TLS is server to server. S/MIME is user to user. Both can run at the same time in a defense-in-depth setup.

Is S/MIME email encryption free? +

The S/MIME standard is free. Certificates are sometimes free from a personal CA like Actalis or a corporate CA a company operates itself. Commercial S/MIME certificates from public CAs cost between $20 and $200 per user per year. Enterprise plans on Microsoft 365 include the option to issue internal S/MIME certificates through Active Directory Certificate Services. Google Workspace on Enterprise tiers supports upload of externally issued S/MIME certificates. Cost adds up quickly for a growing team of external contacts.

Can I use S/MIME email encryption in Gmail? +

Yes on Google Workspace Enterprise Standard, Enterprise Plus, Education Standard, and Education Plus. The admin uploads root and intermediate certificates and enables S/MIME in the Google Admin console. Individual users then upload their personal certificate through Gmail settings. Free personal Gmail accounts do not support S/MIME. Recipients on unsupported tiers see the encrypted MIME content as an attachment they cannot open. Setup instructions are documented on Google Workspace support pages under hosted S/MIME.

What happens if I lose my S/MIME private key? +

Every message previously encrypted to that key becomes unreadable. There is no recovery path unless the private key was backed up before it was lost. Corporate S/MIME deployments use a key escrow model where an internal PKI holds a copy of each private key so IT can restore access when a user leaves or a device is wiped. Personal S/MIME users must back up the private key to a hardware token or an encrypted vault. Losing the key is the single most common S/MIME failure mode.

Does S/MIME work on iPhone and Android? +

iPhone Mail supports S/MIME natively when a certificate is installed in the iOS keychain through a configuration profile or a manual PKCS 12 file. Android Gmail supports S/MIME when the account is a Google Workspace account with hosted S/MIME enabled, and the certificate is provisioned through the admin console. Third-party mail apps on Android like BlueMail and Nine also support S/MIME with per-app certificate import. Certificate installation on mobile is less user-friendly than on desktop, which slows adoption.

When should I use S/MIME versus a HIPAA email service? +

Use S/MIME when both sender and recipient are on managed mail platforms, hold certificates, and communicate repeatedly. A referring physician network or an insurance carrier are good fits. Use a HIPAA email service like Mailhippo when recipients vary, include patients, and cannot reasonably install certificates. Portal-based services deliver an encrypted link that any recipient can open in a browser. Many organizations run both. S/MIME for peer-to-peer and a gateway for one-off external recipients handles the full range of contact types.

Posted on

Encryption and Email Security in a Layered Stack

encryption and email guide featured image

🔑 Key Takeaways

  • The stack is filtering, DLP, outbound encryption, archiving, and identity. One layer alone has gaps.
  • Encryption failures leak content in transit. Filtering failures let phishing walk in the front door.
  • A VPN protects the sender network segment. Email encryption protects the body across mail servers.
  • HIPAA, SOX, FINRA, and GDPR require retention. Some archivers bundle encryption, others do not.
  • Every vendor touching PHI needs its own BAA. Consolidated platforms put filtering plus archive as 1.

Encryption is a checkbox item on most email security procurement forms. It sits next to inbound filtering, DLP, archiving, and identity controls. Buyers who focus on one checkbox at a time miss how the layers depend on each other.

This guide covers how encryption and email security fit together in a working stack. Where a healthcare team needs the outbound layer without integrating four vendors, a dedicated secure email service with a BAA in the base plan often solves the immediate compliance gap.

Read the sections in order. Each layer covers a different threat and a different auditor concern.

The Email Security Stack Has Five Layers

A complete email security posture combines five functional layers. Each addresses a different risk.

  • Inbound filtering removes phishing, malware, and business email compromise before delivery.
  • Identity controls including MFA and conditional access stop credential theft at the mailbox.
  • DLP scans outbound messages for sensitive content and enforces policy actions.
  • Outbound encryption protects message content in transit and at rest for regulated data.
  • Archiving preserves all inbound and outbound mail in tamper-evident storage for compliance.

Skipping any layer creates a gap. Filtering without encryption leaves outbound leakage. Encryption without filtering leaves the inbox exposed to the phishing that steals the credentials that bypass the encryption.

Buyers evaluating a single feature should confirm what covers the other four.

encryption and email in article illustration one

Encryption Handles Outbound Confidentiality

Email encryption operates on outbound messages. It transforms the body and attachments into ciphertext readable only by the intended recipient.

TLS handles server-to-server transport encryption. S/MIME or hosted portal services handle content encryption end to end. Both layers combine to protect messages from interception and unauthorized access.

Related guide: email encryption covers the methods and standards in depth. See also encryption for email and files.

Encryption does not protect against outbound errors. A workforce member emailing PHI to the wrong recipient still commits a HIPAA breach even when the message is encrypted correctly to that wrong address.

The DLP layer catches that case. Encryption alone does not.

Inbound Filtering Blocks Threats Before Delivery

Inbound filtering scans every incoming message against spam signatures, malware analysis, URL reputation, and behavioral indicators of business email compromise.

Microsoft Defender for Office 365 and Google Workspace Security Sandbox both bundle inbound filtering with their mail platforms. Third-party vendors like Proofpoint, Mimecast, and Barracuda offer specialized inbound protection.

Filtering catches most commodity threats. Sophisticated targeted attacks still get through occasionally. That is why the layer above it, identity controls, matters.

The CISA guidance on phishing and ransomware covers the current threat landscape that inbound filtering has to handle.

Healthcare senders face specific targeting because PHI has direct resale value. Filtering configuration for healthcare typically runs stricter than for general business.

Example

A twelve-provider multispecialty group builds a layered stack. Microsoft Defender for Office 365 handles inbound filtering under the Microsoft 365 E3 tier. Purview DLP rules match PHI patterns and auto-apply Encrypt-Only on outbound. A dedicated gateway service delivers encrypted mail to patients without a portal step. Mimecast archives every inbound and outbound message for the six-year HIPAA retention requirement. Entra ID enforces MFA plus conditional access on every mailbox. Four vendor BAAs live in the compliance folder, one per business associate.

DLP Enforces Policy on Sensitive Content

Data loss prevention scans outbound content for defined patterns and enforces automatic policy actions.

Common patterns include Social Security numbers, credit card numbers, medical record numbers, ICD-10 codes, and custom keyword lists specific to the organization.

Policy actions include block and notify the sender, quarantine for admin review, redirect to a manager, or apply encryption automatically. That last option closes the gap between manual encryption decisions and consistent compliance.

Microsoft Purview DLP and Google Workspace Data Loss Prevention both include predefined content types. Custom rules cover organization-specific patterns.

Test DLP rules against a monitored test mailbox before pushing to production. False positives on internal messages create friction that pushes users toward personal accounts.

encryption and email in article illustration two

VPNs Add a Network Layer That Overlaps Partially

A VPN encrypts the network path between a client device and the VPN provider. It matters when workforce members send email from public Wi-Fi or shared networks.

The VPN protects the traffic from the coffee shop to the VPN endpoint. From there, the traffic exits to the mail server as normal internet traffic protected by the mail platform TLS.

Once the message leaves the sender mail server and travels to the recipient mail server, the VPN provides no protection. The message needs TLS between the mail servers and content encryption for the body itself.

A VPN is not a substitute for email encryption. It protects the first mile only. HIPAA-regulated content still requires end-to-end encryption on the message itself.

Practices deploying VPNs should still deploy email encryption. The layers cover different segments of the message journey.

Archiving Preserves Compliance Evidence

Archiving captures every inbound and outbound message at the gateway and stores it in tamper-evident form for defined retention periods.

HIPAA calls for six-year retention of documentation supporting security policies, which includes evidence of PHI communications. SOX requires seven years of financial records. FINRA requires three years of broker communications with clients.

The archive protects against message tampering after delivery, which matters during litigation and audit. Users cannot delete archived copies from their mailbox to hide activity.

Some vendors bundle archiving with encryption in one product. Others sell them separately. Buyers should confirm which vendor covers each function to avoid gaps or duplicate contracts.

The archive itself must also be encrypted at rest. Vendors typically use AES-256 with keys managed by the customer or the vendor per contract.

💡Pro Tip: Deploy identity controls before adding more expensive encryption products

Compromised mailbox credentials bypass encryption and filtering entirely because the attacker holds legitimate access. Multi-factor authentication and conditional access are the cheapest layer with the highest breach-cost prevention. Enforce MFA on every workforce member with mailbox access through Microsoft Entra ID or Google Workspace identity. Add conditional access rules that restrict logins to known devices or geographies. This stops most business email compromise attacks before any encryption or filtering product has to work.

Identity Controls Guard the Mailbox Access Point

Encryption and filtering both fail when an attacker holds the legitimate mailbox credentials. Identity controls prevent that scenario.

Multi-factor authentication blocks most credential theft attacks. Conditional access rules restrict logins to known devices, networks, or geographies. Session timeout controls limit exposure when devices are left unattended.

Microsoft Entra ID and Google Workspace identity both include MFA and conditional access as core features. Enforce MFA for every workforce member with mailbox access.

Compromised mailbox credentials are the entry point for most business email compromise attacks. See the Microsoft business email compromise guidance for attack patterns and defenses.

Identity controls are cheap compared to the breach cost they prevent. Deploy them before adding more expensive encryption or filtering products.

HIPAA Requires the Full Stack for Covered Entities

HIPAA covered entities need every layer of the stack for the Security Rule and Privacy Rule requirements.

Encryption meets the transmission security safeguard. Inbound filtering supports the malicious software safeguard. DLP supports the administrative safeguard against workforce error. Archiving supports the six-year documentation retention requirement.

Each vendor that touches PHI signs a business associate agreement. Consolidated platforms simplify BAA management by putting encryption, filtering, and archiving under one contract. Specialized services require separate BAAs.

The HHS Security Rule guidance lists every safeguard the covered entity must implement.

Practices running patient-facing websites face parallel obligations. See healthcare website security features for the site-side controls that pair with the email stack.

Choosing Between Consolidated and Best-of-Breed Vendors

Buyers face a decision between one platform that covers every layer and multiple specialized vendors that each cover one layer well.

Consolidated platforms from Microsoft, Google, or major security vendors deliver encryption, filtering, DLP, and archiving through one console. Reporting is unified. One contract covers everything. Small practices favor this model for administrative simplicity.

Specialized vendors focus on one layer and often deliver a better recipient experience or specific compliance feature. Larger organizations mix a consolidated inbound filter with a specialized outbound encryption service like Mailhippo that delivers encrypted email without portal friction.

Related guides: email encryption solutions comparison, email encryption solutions for Outlook and Gmail, and HIPAA compliant texting and email.

Match the vendor mix to the operational team size. A one-person IT department cannot maintain four separate consoles. A dedicated security team can extract value from specialized products that a consolidated platform cannot match.

Neither approach is wrong. The wrong choice is buying encryption in isolation and ignoring the other four layers.

Frequently Asked Questions

How do encryption and email security work together? +

Encryption protects the content of individual messages during transit and at rest. Email security is the broader program that also filters inbound threats, prevents outbound data loss, archives messages for compliance, and controls mailbox access through authentication. Encryption alone cannot stop a phishing message from entering the inbox or catch a workforce member emailing PHI to the wrong recipient. Email security alone cannot prevent an outsider from reading intercepted messages if the content is unencrypted. Both layers are required for a complete posture.

Does a VPN encrypt email? +

A VPN encrypts the network connection between the client device and the VPN provider. If the mail client uses TLS to reach the mail server, the VPN adds an outer encryption layer during that first leg. Once the message leaves the VPN endpoint and travels to the recipient mail server, the VPN provides no protection. The message itself still needs TLS transport encryption and, for regulated content, S/MIME or hosted portal encryption to protect the body between mail servers and at rest.

What is the difference between email encryption and email filtering? +

Encryption transforms outgoing message content into ciphertext so only the recipient can read it. Filtering analyzes incoming messages for spam, phishing, malware, and business email compromise indicators before delivery. They operate on opposite directions of the mail flow and address different threats. Encryption defends confidentiality on the outbound side. Filtering defends the inbox on the inbound side. HIPAA and PCI compliance require both, plus additional controls like DLP, archiving, and access management.

Do I need archiving if I already have email encryption? +

Yes, if regulations require retained records of communications. HIPAA calls for six-year retention of documentation supporting security policies. SOX and FINRA require multi-year retention of email evidence. GDPR requires the ability to produce specific messages on request. Encryption protects the content but does not preserve it after the mailbox owner deletes the message. Archiving captures every message at the gateway and stores it in tamper-evident form. Some vendors bundle encryption and archiving in one product, and others sell them separately.

How do encryption and DLP interact? +

Data loss prevention scans outbound messages for sensitive content patterns like Social Security numbers, credit card numbers, medical record numbers, and custom keywords. When DLP detects a match, it can block the message, quarantine it for review, or apply automatic encryption. That last option is the most common integration. A workforce member who forgets to click Encrypt on a message containing PHI triggers the DLP rule, which encrypts the message server-side before delivery. This removes the compliance risk of relying on manual encryption decisions.

What compliance frameworks require email encryption? +

HIPAA treats encryption of PHI in transit as an addressable specification and treats unencrypted PHI transmission as a compliance failure in practice. PCI DSS requires encryption of cardholder data when transmitted over public networks. GLBA requires financial institutions to protect customer information in transit. GDPR requires appropriate technical measures for personal data, and encryption is treated as evidence of due diligence. State laws like California CCPA and New York SHIELD Act also incentivize encryption through breach notification safe harbors that exclude encrypted data.

Should encryption and email security come from the same vendor? +

The tradeoff is between integration and specialization. Consolidated platforms from Microsoft, Google, or major security vendors handle encryption, filtering, and archiving under one console with unified reporting and one contract. Specialized vendors focus on one layer and often deliver a better recipient experience or specific compliance feature. Small practices favor consolidated platforms for administrative simplicity. Larger organizations often mix a consolidated inbound filter with a specialized outbound encryption service that pairs better with their workforce workflow.

Posted on

How Do I Send an Encrypted Email in Outlook, Gmail, and Yahoo

how do i send an encrypted email guide featured image

🔑 Key Takeaways

  • Outlook on Microsoft 365 Business Standard uses the Encrypt button in Options ribbon via Purview.
  • Gmail has Confidential Mode (weak) and hosted S/MIME on Enterprise. Personal Gmail has no real E2E.
  • Yahoo has no native encryption and no BAA. Regulated senders must migrate off or wrap in a gateway.
  • Apple Mail on macOS and iOS reads S/MIME from the keychain and shows a lock icon in the compose bar.
  • Gateways sit on top of any provider, add a trigger word or button, and ship a BAA in the base plan.

Sending an encrypted email looks different in every mail client. The button is in a different place in Outlook, Gmail, Yahoo, and Apple Mail. Some clients offer true end-to-end encryption while others offer a portal-based feature that looks similar but works differently.

This guide walks through the exact steps for each major provider. It also flags the HIPAA implications for practices sending PHI. For a gateway option that works across all of them, Mailhippo offers encrypted email as a portal service with a BAA in the base plan.

Start with the client you already use. Every section stands on its own with the buttons and menu paths named directly.

Sending Encrypted Email in Outlook 365

Outlook on Microsoft 365 Business Standard and above has an Encrypt button in the compose window. It uses Microsoft Purview Message Encryption underneath.

Open a new message. Click the Options tab in the ribbon. Click Encrypt. Choose Encrypt-Only or Do Not Forward from the dropdown menu that appears.

Write the message and click Send. The recipient receives an email with a link. They authenticate with Microsoft, Google, or a one-time passcode and read the message in a browser.

Business Basic and free personal Outlook.com do not have the Encrypt button. Upgrading to Business Standard or higher unlocks it. Related linked topic: how do you encrypt an email in outlook for the setup on older versions.

Sending Encrypted Email in Gmail With Confidential Mode

Gmail confidential mode is available on personal Gmail and every paid Google Workspace tier. Open a new message. Click the lock and clock icon at the bottom of the compose window.

Set an expiration date. Choose whether to require a passcode. Click Save. Write the message and click Send. The recipient receives a link and reads the message in a hosted view.

Confidential mode is not end-to-end encryption. Google holds the keys. The mode adds an extra step for the recipient and prevents forwarding, but the content is not sealed against the provider.

For a HIPAA workflow, confidential mode alone is not sufficient even with a BAA. Practices sending PHI need either hosted S/MIME on the Enterprise tier or a third-party gateway. See Google confidential mode documentation for the current feature list.

how do i send an encrypted email in article illustration one

Sending Encrypted Email in Gmail With Hosted S/MIME

Hosted S/MIME is the Gmail path to true end-to-end encryption. It requires Google Workspace Enterprise Standard, Enterprise Plus, Education Standard, or Education Plus.

The admin uploads root and intermediate CA certificates in the Google Admin console. They enable S/MIME for the organizational unit. Each user then uploads their personal certificate through Gmail settings under Accounts.

Once configured, a lock icon appears next to the recipient field in the compose window. Green means encryption is possible because the recipient certificate is cached. Gray means the recipient certificate is missing.

Recipients on personal Gmail, Business Standard, or Business Plus cannot receive hosted S/MIME encrypted messages. The encrypted content arrives as an unopenable attachment. This is the main operational limit of S/MIME in a mixed environment.

Sending Encrypted Email in Yahoo Mail

Yahoo Mail has no native encrypted email feature. There is no Encrypt button, no confidential mode, and no hosted S/MIME. Yahoo Mail Plus adds ad-free browsing and more storage but no encryption.

To send encrypted email from a Yahoo address, the practical options are limited. Connect the Yahoo account to Thunderbird by IMAP. Install an S/MIME certificate in Thunderbird. Send encrypted mail from Thunderbird using the Yahoo address as the From address.

The other option is a gateway service that authenticates against the Yahoo account and sends portal-delivered encrypted mail on its behalf. This is a workaround, not a supported feature.

Yahoo does not offer a Business Associate Agreement. Yahoo is not appropriate for HIPAA use. Practices on Yahoo should migrate to Google Workspace, Microsoft 365, or a dedicated healthcare mail provider before starting a real encryption program.

Example

A solo dermatologist on personal Yahoo Mail wants to send lab results to a referring internist. Yahoo has no Encrypt button, no confidential mode, no BAA. The dermatologist tries the workaround of connecting Yahoo to Thunderbird by IMAP and installing an Actalis S/MIME certificate, but the internist does not have S/MIME either. The practical resolution is migrating off Yahoo to Google Workspace Business Standard and adding a gateway service. The dermatologist then sends lab results with one click from a normal Gmail compose window.

Sending Encrypted Email in Apple Mail

Apple Mail on macOS and iOS supports S/MIME natively. The user installs an S/MIME certificate in the system keychain. Mail detects the certificate automatically.

On macOS, install the certificate through Keychain Access by opening the PKCS 12 file. On iOS, install through a configuration profile or by tapping the .p12 file in Files or Mail. Trust the certificate in Settings.

Once installed, a lock icon appears in the compose window when the recipient certificate is available. Click the lock to encrypt. A signed message from a recipient adds their public key to the local keychain automatically.

Apple Mail also opens Outlook Encrypt messages and portal-delivered messages from third-party gateways. Cross-platform S/MIME between Apple Mail and Outlook works reliably when both sides use the same certificate authority.

how do i send an encrypted email in article illustration two

Sending Encrypted Email With a Gateway Service

A gateway service sits between the sender mail client and the recipient. The sender writes the message in the normal client. A trigger word in the subject or a plugin button triggers encryption.

The service uploads the message to a hosted portal. The recipient receives a notification with a link. They authenticate with a passcode or SSO and read the message in a browser.

Gateway services work with any mail provider. They add a BAA when the underlying mail provider does not offer one. Setup takes minutes for a single user and hours for a full team.

Related linked topics: how to send an encrypted email for a broader walkthrough and how do I send encrypted email for cross-provider notes.

HIPAA Requirements for Encrypted Email Sending

Sending PHI over email requires a signed Business Associate Agreement with the mail provider and technical safeguards under the Security Rule. Encryption alone does not equal compliance.

Microsoft 365 Business Standard and above and Google Workspace Business Standard and above both offer BAAs. Personal Outlook.com, personal Gmail, personal Yahoo, and personal iCloud do not.

The HHS Security Rule requires access controls, audit logging, session timeouts, and workforce training in addition to encryption. Documentation of policies is required for a defensible program.

Verify recipient identity before sending PHI. A wrong email address is a HIPAA breach even when the message is encrypted. Related: security features for healthcare websites for how email fits inside the wider stack.

💡Pro Tip: Verify the recipient email address before every PHI send

Encryption protects content but does not correct a wrong address. Sending PHI to the wrong recipient is a HIPAA breach even when the message is perfectly encrypted. Confirm the recipient email through a separate channel before sending, especially for new contacts. Use address book contacts rather than typing addresses each time. Practices sending PHI attachments should also verify recipient identity by phone before releasing any password shared out of band with the encrypted file.

Encrypted Email Feature Comparison Across Providers

The table below summarizes what each major mail provider offers natively.

Provider Native Encryption Feature End-to-End BAA Available Free Tier Encrypted Send
Outlook 365 Business Standard+ Encrypt button, Purview No, portal-based Yes No
Gmail Workspace Business Confidential mode No Yes on Business Standard+ Confidential mode only
Gmail Workspace Enterprise Hosted S/MIME Yes Yes Not on personal
Yahoo Mail None native No No No
Apple Mail on iCloud+ Manual S/MIME Yes with certificate No Manual setup only
ProtonMail Business Password-protected portal Yes to Proton, portal to others Yes on Business Free tier has portal send

Common Sending Problems and Their Fixes

The Encrypt button is missing in Outlook. This happens on Business Basic or free personal Outlook.com. Upgrade to Business Standard or above, or use a gateway service.

The S/MIME lock icon is gray in Gmail. This means the recipient certificate is not cached. Ask the recipient to send you a signed message first. The certificate cache populates automatically from signed inbound mail.

The recipient cannot open the encrypted message. Common causes:

  • Recipient client does not support S/MIME (personal Gmail, Business Standard Workspace)
  • Notification email landed in spam
  • Recipient failed the passcode step
  • Certificate address mismatch on the sender side
  • Corporate firewall blocks the portal domain

Related linked topic: how do I open an encrypted email in outlook for recipient-side fixes.

Picking the Right Sending Path for Your Practice

Practices already on Microsoft 365 Business Standard or above should use the native Encrypt button for external mail. Setup is minutes. The BAA is already in place.

Practices on Google Workspace Business Standard should use confidential mode for casual privacy and add a gateway service for HIPAA-scoped mail. Upgrading to Enterprise for hosted S/MIME is often costlier than the gateway approach.

Practices on Yahoo, iCloud, or free personal accounts need to migrate to a business mail provider before starting a real encrypted email program. No workaround makes those tiers HIPAA-appropriate.

Mailhippo works as the gateway option across all of these providers. It sits alongside Gmail or Outlook, includes a BAA in the base plan, and requires no per-user certificate management. Practices building a compliant public site alongside their email program can pair this with HIPAA-conscious website design so the whole intake chain stays inside the same compliance boundary.

Frequently Asked Questions

How do I send an encrypted email in Outlook 365? +

Open a new message. Click the Options tab in the ribbon. Click Encrypt. Choose Encrypt-Only or Do Not Forward from the dropdown. Write the message and click Send. The external recipient receives a link. They authenticate with Microsoft, Google, or a one-time passcode and read the message in a browser. The Encrypt button appears on Microsoft 365 Business Standard, Business Premium, E3, E5, and Government plans. Free personal Outlook.com and Business Basic tiers do not have this feature.

How do I send an encrypted email in Gmail? +

Two options exist. For confidential mode, open a new message, click the lock icon at the bottom, set expiration and passcode, then send. Confidential mode is not end-to-end encryption. For true S/MIME encryption, the account must be on Google Workspace Enterprise Standard, Enterprise Plus, Education Standard, or Education Plus. The admin uploads CA certificates and enables S/MIME, then each user uploads their personal certificate. A lock icon then appears next to the recipient field when encryption is possible.

How do I send an encrypted email with Yahoo? +

Yahoo has no native encrypted email feature. To send encrypted mail from a Yahoo address, connect the Yahoo account to Thunderbird via IMAP and install an S/MIME certificate in Thunderbird. Or connect the Yahoo account to a gateway service that handles portal delivery. Yahoo does not offer a Business Associate Agreement and is not a HIPAA-appropriate mail provider even with a workaround in place. Yahoo Mail Plus does not add encryption features. Business users should move to a provider that offers a BAA.

How do I send an encrypted email in Outlook 2013? +

Outlook 2013 supports S/MIME natively but not Microsoft Purview Message Encryption. Install an S/MIME certificate in Windows through the personal certificate store. Open Outlook, go to File then Options then Trust Center then Trust Center Settings then Email Security. Under Encrypted email, click Settings and pick your certificate. Choose to sign or encrypt outgoing messages by default. To encrypt a specific message, click the Encrypt Message Contents and Attachments button in the compose ribbon before sending.

Can I send encrypted email without buying a service? +

Yes, with limits. Free options include manual S/MIME with a free personal certificate from Actalis in Outlook or Apple Mail, PGP with a plugin like FlowCrypt in Gmail, and a personal ProtonMail account for external portal delivery. All three require setup effort and none qualifies for HIPAA on the free tier. For regulated work, a paid service with a BAA is the only defensible path. For casual privacy, the free options work well after the initial setup.

Is Outlook confidential mode the same as encryption? +

Outlook does not use the term confidential mode. Gmail uses that term. In Outlook, the equivalent feature is Encrypt or Do Not Forward inside Microsoft Purview Message Encryption. Encrypt-Only prevents unauthorized reading. Do Not Forward adds restrictions against forwarding, copying, and printing. Both use portal-based delivery for external recipients. Neither is the same as S/MIME end-to-end encryption. Outlook also supports S/MIME separately for peer-to-peer certificate-based encryption between users who both hold certificates.

How do I send an encrypted email attachment? +

The attachment inherits the encryption of the message. Attach the file to a message you encrypt through Outlook Encrypt, Gmail S/MIME, Apple Mail S/MIME, or a portal gateway. The service encrypts the message body and attachment together. For separate protection, encrypt the file itself with a password using Adobe Acrobat for PDFs or 7-Zip for other files, then share the password out of band. Practices sending PHI attachments should verify recipient identity before releasing any password.

Posted on

Encrypted Email Guide for Business and HIPAA Workflows

encrypted email guide featured image

🔑 Key Takeaways

  • Encrypted email spans three layers: TLS in transit, S/MIME or PGP end to end, and portal delivery.
  • TLS 1.2 or 1.3 protects the wire between servers, but plaintext still sits readable at rest on both.
  • S/MIME and PGP need pre-exchanged keys, which breaks a first send to any patient on personal Gmail.
  • Portal encryption reaches any browser recipient, but replies stall outside the sender inbox thread.
  • HIPAA needs a signed BAA plus training and Security Rule safeguards, not just working encryption.

Encrypted email protects message content from anyone who is not the intended recipient. The term covers three separate technical layers, and they solve different problems. Getting the layer right is what separates a defensible deployment from a false sense of security.

This guide walks through each layer, the tools that implement it, and where each one fits a business or healthcare workflow. It closes with a practical view on when to combine layers and when a portal-based encrypted email service is the right choice.

The reader should come out with enough context to decide which encryption model matches the recipients they email most often and what the budget implications are.

Encrypted Email Covers Three Distinct Layers

The first layer is TLS in transit. It encrypts the network connection between two mail servers. The message body travels through a tunnel that a passive network snoop cannot read.

The second layer is end-to-end encryption at the message level. S/MIME and PGP encrypt the body with the recipient public key. The mail server sees only ciphertext.

The third layer is portal-based delivery. The sender uploads the message to a hosted portal. The recipient authenticates and reads it in a browser. The mail itself never leaves the portal.

Each layer defends against a different threat. TLS covers passive interception. End-to-end covers a compromised or subpoenaed provider. Portal covers recipients who cannot install client-side keys.

TLS Is the Baseline for All Modern Mail Providers

Gmail, Outlook, iCloud, and most business mail providers negotiate TLS 1.2 or 1.3 by default. The two servers exchange certificates, agree on a cipher, and encrypt the connection.

TLS ends when the message arrives at the recipient server. The mail sits at rest on that server in a form the provider can decrypt. A subpoena, a rogue admin, or a provider compromise exposes plaintext.

TLS also fails when the receiving server does not support it. Older on-premise Exchange systems still exist in the wild. Google publishes a delivery status for each domain the user emails, which can reveal these gaps.

MTA-STS and DANE are add-ons that force TLS on the sending side. NIST covers the technical baseline in Special Publication 800-177 Trustworthy Email. Every modern deployment should have MTA-STS enabled at a minimum.

encrypted email in article illustration one

End-to-End Encryption Uses Keys the Provider Cannot See

S/MIME and PGP are the two dominant end-to-end standards. Both work by encrypting the message body with the recipient public key on the sender client before the message leaves the device.

S/MIME uses X.509 certificates from a certificate authority. It is native in Outlook, Apple Mail, and Google Workspace Enterprise. Setup requires a certificate for each user.

PGP uses a web of trust model where users sign each other public keys. It runs on plugins in most mail clients. Setup requires a keypair and public key exchange with every contact.

Both models fail when the recipient has no client-side setup. A referring physician on personal Gmail without S/MIME cannot receive an S/MIME encrypted message. Related linked topic: should I consider encrypted email using ProtonMail as one example.

Portal-Based Encrypted Email Works With Any Recipient

Portal delivery is the practical choice when recipients are variable, include patients, or refuse to install certificates. The sender writes the message in a normal mail client or a web portal.

The service uploads the message to a hosted portal. The recipient receives a notification with a link. They click the link, authenticate with a passcode or SSO, and read the message in a browser.

Microsoft Purview Message Encryption uses this model. Google Workspace confidential mode uses a similar model. Third-party services like Mailhippo use the same model with a HIPAA-focused BAA in the base plan.

Portal delivery works with any recipient on any device. The tradeoff is friction. Replies happen in the portal, not the recipient normal inbox. Threading breaks for downstream record keeping.

Example

A mid-size clinic with a stable set of peer providers layers all three encryption models. TLS runs by default between Microsoft 365 mail servers and their peer clinic servers. S/MIME certificates issued from an internal PKI cover peer clinical mail between six known referring physicians. A portal gateway handles patient billing statements and one-off external contacts who cannot install certificates. DLP rules in Exchange Online auto-encrypt any message containing an MRN pattern. Audit logs retain for the six-year HIPAA administrative requirement.

HIPAA Requires More Than Encryption Alone

HIPAA compliance for email requires three things. A signed Business Associate Agreement with the mail provider. Technical safeguards under the Security Rule. Workforce training on encryption use.

Encryption is one technical safeguard. Access controls, audit logging, session timeouts, and secure key management are others. The HHS Security Rule spells out the full list.

A signed BAA is what makes the mail provider a business associate under 45 CFR 164.502(e). Without it, sending PHI through any encrypted service is still a HIPAA violation regardless of encryption strength.

Gmail on Google Workspace Business Standard and above and Outlook on Microsoft 365 Business Standard and above both offer BAAs. Free personal accounts do not. See related healthcare security context for how email fits inside the broader stack.

encrypted email in article illustration two

Common Encrypted Email Deployment Patterns

Small practices with a single mail provider usually run TLS plus a portal gateway. This covers passive interception and external recipient delivery in one setup.

Mid-size clinics with a stable set of peer providers add S/MIME on top for the peer traffic. TLS is baseline, S/MIME handles peer clinical mail, portal handles patients and one-off external contacts.

Larger hospitals with internal PKI use S/MIME across the entire clinical workforce. They still add a portal for patient communication. The two models coexist and are chosen per recipient by the mail client or by a policy rule.

Common encrypted email deployment components include:

  • TLS baseline with MTA-STS enforced on outbound
  • SPF, DKIM, and DMARC configured on the sending domain
  • S/MIME certificates issued to clinical users for peer traffic
  • Portal service for patient and external recipient traffic
  • DLP rules that auto-encrypt messages containing SSN, MRN, or PHI patterns
  • Audit logs retained per HIPAA six-year requirement

Free Encrypted Email Options and Their Limits

Free encrypted email exists but comes with real limits. Personal ProtonMail and Tutanota accounts offer zero-access encryption at rest and portal-based delivery for external recipients.

The catch is no BAA. Free tiers do not qualify for HIPAA use regardless of encryption strength. Storage caps and daily message limits also fail business use quickly.

Free personal S/MIME certificates from Actalis and similar issuers give real end-to-end encryption but require manual install and renewal. Time cost is often higher than a paid service.

For a solo user with occasional secure needs, free options are workable. For a practice with regulatory obligations, paid tiers with BAAs are the only defensible path. Related: free encrypted email for a fuller comparison.

💡Pro Tip: Enable MTA-STS before deploying any content encryption

TLS is the required baseline but fails silently when the receiving server does not support it or downgrades the connection. MTA-STS forces TLS on outbound mail and blocks delivery when the receiving side cannot negotiate a secure session. NIST Special Publication 800-177 covers the technical baseline. Deploy MTA-STS at the DNS layer before adding S/MIME or portal encryption, otherwise the transit layer stays exposed to downgrade attacks that content encryption cannot fix.

Encrypted Email Feature Comparison

The table below compares the main encrypted email models on the dimensions that matter most for a business buyer.

Model Encryption Level Recipient Setup HIPAA Fit Best For
TLS only Transit None Baseline only General business mail
S/MIME End-to-end Certificate install Peer traffic Clinic-to-clinic
PGP End-to-end Keyring install Rare in healthcare Technical users
Portal gateway End-to-end at rest Passcode or SSO All recipients Patient and external mail
Zero-access mailbox End-to-end at rest Account creation With BAA on paid tier Privacy-focused solo users

Encrypted Email Troubleshooting Basics

Delivery failures are the most common encrypted email problem. TLS failures show up as messages sitting in the outbound queue or arriving in plain form when the receiving server does not support TLS.

S/MIME failures usually trace to certificate expiration, address mismatch, or a missing intermediate CA. The recipient client shows a specific error that names the failing check.

Portal delivery failures often trace to the recipient marking the notification as spam. Adding the sender portal domain to a safe-sender list at the recipient side fixes this. See related linked topic: how to troubleshoot encrypted email.

Deliverability upstream matters too. A domain without SPF, DKIM, and DMARC lands portal notifications in spam even when the portal itself works. The Gmail sender guidelines apply to portal notification email the same way they apply to normal outbound mail.

Choosing an Encrypted Email Setup for Your Practice

The right choice depends on three questions. Who are you emailing most often. Are they technical enough to hold a certificate. Do you already run on Microsoft 365 or Google Workspace.

For a practice that emails patients daily and peer clinics occasionally, a portal gateway is the higher-value setup. Patients never install anything. Peer clinics can still receive the portal notification and open it in a browser.

For a practice that emails peer clinics daily and rarely emails patients, S/MIME across the peer network with a portal fallback for patients is the higher-value setup. Peer traffic runs at inbox speed with no extra clicks.

Mailhippo operates as a portal gateway on top of Gmail or Outlook, includes a BAA in the base plan, and requires no per-user certificate management. It fits practices that need patient-safe encryption without moving off their existing mail provider. Practices building a compliant public site alongside their email strategy can pair this with healthcare marketing support so intake, contact, and email flows stay inside the same compliance boundary.

Frequently Asked Questions

What is encrypted email? +

Encrypted email is any email where the message content is scrambled so only intended parties can read it. The term covers three separate layers. TLS encrypts the network connection between mail servers. S/MIME and PGP encrypt the message body at the client level. Portal services encrypt the stored content behind a login. Each layer defends against a different threat. Most business deployments use TLS as a baseline and add either message-level or portal-based encryption depending on how technical the recipients are.

Is Gmail encrypted email? +

Gmail uses TLS between mail servers when the other side supports it, and it encrypts stored mail at rest on Google servers with keys Google controls. Gmail is not end-to-end encrypted by default. Google can read stored mail because Google holds the keys. Google Workspace Enterprise and Education tiers add hosted S/MIME support, which adds true end-to-end encryption when both sides hold certificates. Confidential mode adds a passcode and expiration but does not add end-to-end encryption. See related coverage in how is email encrypted.

Is encrypted email HIPAA compliant? +

Encrypted email can meet HIPAA if the covered entity signs a Business Associate Agreement with the mail provider, configures technical safeguards under the Security Rule, and trains staff on encryption use. Encryption alone does not equal compliance. The BAA covers the legal relationship. The configuration covers the technical safeguards. Training covers workforce use. A free personal Gmail or Outlook account cannot meet HIPAA even with strong encryption because no BAA is available on those tiers.

What is the difference between encrypted email and secure email? +

Secure email is a broader term that covers encryption plus anti-phishing, anti-malware, DLP, and archiving. Encrypted email refers specifically to the encryption layer. A secure email service usually bundles multiple protections including encryption. A HIPAA-compliant secure email service adds a BAA and audit logging on top. For most business buyers, secure email is the product category and encrypted email is one required feature inside it.

Can I send encrypted email to any recipient? +

Not without setup on both sides for message-level encryption. S/MIME and PGP require both sender and recipient to hold keys or certificates. Portal-based encryption works with any recipient because the encryption stays on the sender-hosted portal and the recipient only needs a browser and a passcode. For practices that send PHI to patients, portal delivery is the only workable model. For peer clinical mail between known providers, S/MIME is often more efficient after the initial setup.

What is TLS encrypted email? +

TLS encrypted email uses Transport Layer Security to protect the network connection between two mail servers. When Gmail sends a message to Outlook, both servers negotiate a TLS session and the message body travels through an encrypted tunnel. TLS ends when the message arrives at the recipient server. The message sits at rest on that server in a form the provider can decrypt. TLS is the baseline for modern mail delivery but does not qualify as end-to-end encryption for regulated data.

Does encrypted email cost extra? +

TLS is free and built into every modern mail provider. S/MIME certificates cost $0 to $200 per user per year depending on issuer and assurance level. PGP is free but requires plugins. Portal-based services like Mailhippo charge a per-user monthly fee, usually less than $10 per user. Microsoft Purview Message Encryption is included in Microsoft 365 Business Premium and above. Total encrypted email cost depends more on which model the practice needs than on any single tool.

Posted on

How to Send Encrypted Email from Gmail

send encrypted email from gmail guide featured image

🔑 Key Takeaways

  • Free Gmail only has TLS in transit; Google still reads the stored copy in every mailbox.
  • Hosted S/MIME ships on Enterprise Plus and Education tiers; Business Starter and Standard skip it.
  • Confidential Mode blocks forwarding and prints but the body sits readable inside Google storage.
  • Cross-provider encryption needs shared keys or a portal service that both sides can open.
  • Google BAA covers storage and transport; a gateway BAA closes the recipient mailbox gap.

Gmail handles more than 1.8 billion active accounts, and a large share of small healthcare practices, therapists, and specialty clinics run their day-to-day communication through it. The default protection is TLS in transit, which is not the same as end-to-end message encryption.

To send encrypted email from Gmail in a way that satisfies HIPAA or protects sensitive content from mailbox breaches, you need to add a layer on top of the default setup. Google offers two native options, S/MIME on select Workspace tiers and Confidential Mode on all tiers, and a third-party route sits above both.

This guide walks through each option with the exact console clicks, the tier requirements, and the cases where each method fits. It also covers the cross-provider gap that catches most senders on the first try.

Gmail Uses TLS in Transit, Not Content Encryption

Standard Gmail encrypts the connection between Google and the receiving mail server using opportunistic TLS. If the receiving server accepts TLS, the message is protected on the wire. If the receiving server does not support TLS, the message drops to plaintext for that hop.

Once the message arrives at the destination mailbox, the TLS protection ends. The message body is stored in the recipient mailbox in a form the mail provider can read. The same applies to the copy in your Sent folder.

TLS in transit does not meet the HIPAA requirement for end-to-end protection of PHI. It also does not protect against a mailbox breach on either side. A stolen password or a compromised admin session exposes every message in the account.

For content-level encryption you have three native or near-native paths from Gmail. S/MIME through Workspace, Confidential Mode, or a third-party plugin or gateway. Each has a different security ceiling and a different setup cost.

S/MIME Requires a Supported Google Workspace Tier

Hosted S/MIME in Gmail is available on Google Workspace Enterprise Plus, Education Standard, and Education Plus. Business Starter, Business Standard, and Business Plus do not include it. Personal Gmail accounts do not include it either.

To enable it, an admin signs in to the Google Admin console, opens Apps, selects Google Workspace, then Gmail, then User settings. The S/MIME section allows the admin to enable the feature for specific organizational units.

Each user then needs a valid S/MIME certificate issued by a public certificate authority or a private CA integrated with the tenant. The certificate is uploaded to the user profile, either manually or through an API integration with the CA.

Once the certificate is in place, the Gmail composer shows a lock icon in the address field. The icon turns green when the recipient public certificate is known to Google. If the recipient has never sent an S/MIME message to your organization, the lock stays gray.

send encrypted email from gmail in article illustration one

Confidential Mode Is Access Control, Not Encryption

Confidential Mode sits in the Gmail composer next to the send button. Click the lock and clock icon, set an expiration date, and optionally require an SMS passcode. The recipient sees the message with forwarding, printing, and copy disabled.

The message content itself is not encrypted. It sits in Google storage in a form Google can read, and the recipient views it through a Google-hosted preview page. The expiration date deletes the preview link, but the underlying copy in Sent Mail remains in your account.

Confidential Mode is useful for reducing casual forwarding and setting a self-destruct on a routine message. It is not a substitute for encryption when PHI or regulated data is involved.

The Department of Health and Human Services has been consistent that HIPAA requires content-level protection of PHI at rest and in transit. Confidential Mode does not meet that bar on its own. Reference the HHS Security Rule guidance if you need the underlying text.

Google Signs a BAA for Paid Workspace Tiers Only

Google will sign a Business Associate Agreement for Business Starter, Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, Education Standard, and Education Plus. The BAA is opt-in through the Admin console under Account, then Legal and Compliance.

The BAA does not extend to personal Gmail accounts. Sending PHI from a free Gmail address is a HIPAA violation regardless of what encryption method you layer on top. The mail provider itself has to be under a BAA.

The Google BAA covers Google storage and transport. It does not cover the recipient mailbox, the recipient mail server, or any downstream forwarding by the recipient. Once the message leaves Google, the Google BAA no longer applies.

That is why message-level encryption matters. TLS protects the wire between Google and the next hop. Message-level encryption protects the content itself all the way through to the intended reader.

Example A five-therapist behavioral health group runs Google Workspace Business Standard at $14 per user per month. Upgrading every seat to Enterprise Plus for S/MIME would add roughly $150 per user per month, or $9,000 per year on top of the base plan. Instead the practice layers a portal-based gateway at $9 per user per month, keeps the existing Workspace BAA, and adds a second BAA with the gateway vendor. Patients read encrypted messages through a browser link with a passcode. Total encryption spend lands near $540 per year.

PGP Requires Key Exchange with the Recipient

PGP is a public-key encryption system that predates S/MIME by several years. It works well between two technical users who have exchanged public keys, and it works poorly at scale across a healthcare organization.

On Gmail, PGP is delivered through browser extensions like FlowCrypt or through a desktop client that syncs with Gmail over IMAP. The sender private key stays on the local device. The recipient needs the same tooling and needs to import your public key before decrypting.

Key management is the friction point. Every new recipient needs a public key exchange. Every device change needs the private key transferred securely. Lost private keys mean lost access to every previously encrypted message.

PGP is not a good fit for a clinical staff workflow where messages go to dozens of external patients, insurance carriers, and referral partners per week. It fits a small circle of technical users. It does not fit a front-desk workflow.

Cross-Provider Encryption Breaks Without a Shared Method

The hard case is sending an encrypted message from Gmail to a Yahoo, Outlook.com, or AOL account. None of those recipients typically has an S/MIME certificate on file. None of them typically has PGP tooling installed. A Confidential Mode message drops to a preview link the recipient may not trust.

The workable pattern for cross-provider encryption is a portal-based encrypted email service. The service intercepts the outbound message, encrypts the payload with a key held on its servers, and sends the recipient a link to a hosted decryption page.

The recipient clicks the link, authenticates with a passcode or email verification, and reads the message in a browser session. The message never lands in the recipient mailbox in decrypted form. Only the link and the metadata do.

This is the same pattern Microsoft uses with Purview Message Encryption for Outlook. It is provider-agnostic on the recipient side, which is why it works for cross-provider sending.

send encrypted email from gmail in article illustration two

Third-Party Services Work with Existing Gmail Accounts

A HIPAA-compliant encrypted email service usually plugs into Gmail one of two ways. The first is a Chrome extension that adds an encrypt button to the composer. The second is a routing configuration in Google Admin that sends outbound mail through the service gateway.

The extension approach fits solo practitioners and small teams. The user installs the extension, signs in to the service account, and gets a new send button next to the standard Gmail send button. The clinical staff experience stays inside Gmail.

The gateway approach fits larger practices with a Workspace admin. Outbound mail from designated accounts is routed through the service SMTP relay, which applies encryption based on the recipient domain or a keyword in the subject line.

Mailhippo uses this pattern. Users keep their existing Gmail account, the recipient gets a portal link, and Mailhippo signs a BAA that covers the encrypted mail path. No S/MIME certificates and no key exchange with the recipient.

Client-Side Encryption Keeps Keys Outside Google

Google Workspace Enterprise Plus offers client-side encryption, or CSE, for Gmail. Keys are held by an external key service that the customer controls, and Google never sees the plaintext of the message or the encryption key.

CSE is designed for regulated customers who need to prove that the mail provider cannot decrypt their messages even under legal request. Government agencies, defense contractors, and some large healthcare systems fit the profile.

The setup cost is significant. The admin has to stand up or contract with a Key Access Control List Service that speaks the Google CSE API, then configure each user account to use it. External recipients need matching CSE tooling, which limits interoperability.

CSE is the right choice for a small subset of Enterprise Plus customers with an existing key management infrastructure. It is not a first-move option for a typical outpatient clinic on Business Standard.

💡Pro Tip: Block outbound send when the S/MIME lock stays grayThe Gmail composer shows a gray lock when the recipient certificate is not on file, and the message goes out over TLS only. Staff assume the lock means safe and send PHI unencrypted. Set a tenant DLP rule in the Admin console that blocks outbound send from PHI-handling accounts when the S/MIME lock is not green. Route those messages to a portal-based gateway as a fallback. This removes the single most common failure mode in a Workspace S/MIME deployment.

Mobile Gmail Sends Encrypted Messages Through the Same Paths

The Gmail mobile app on iOS and Android supports Confidential Mode natively. Tap the three-dot menu in the composer and select Confidential Mode. The expiration and passcode options are the same as on desktop.

S/MIME on mobile requires a Workspace tier that supports it plus a certificate provisioned to the mobile device. iOS handles certificate installation through a configuration profile pushed by MDM. Android handles it through the enterprise container.

Third-party encryption services that offer a Chrome extension do not run on the Gmail mobile app. Their mobile support is usually a standalone iOS or Android app that composes an encrypted message and sends it through the service directly.

For a clinical staff workflow where phones and tablets are common, verify the mobile path before rolling out the desktop-first setup. A method that works on the browser but not on a phone will not survive contact with actual daily use.

Practical Setup Order for a Small Healthcare Practice

Start with the BAA. Confirm the Google Workspace tier and enable the BAA in the Admin console. A personal Gmail account is not a starting point for PHI. Move to Workspace first.

Second, decide on the encryption method based on tier. If the practice is on Enterprise Plus and has an existing PKI, S/MIME is a clean fit. If the practice is on Business Standard or Business Plus, a third-party service is the shorter path than upgrading every seat to Enterprise Plus.

Third, train the front desk on the send workflow. The most common failure mode is a staff member forgetting the encrypt button and sending PHI in cleartext. A gateway that encrypts based on recipient domain or subject keyword removes that human step.

For related work on other clients, see the send a encrypted email from outlook guide and the how to send encrypted email from yahoo account reference. For a mobile-first walkthrough, see how to send an encrypted email from phone. Practices building out the broader digital stack for patient trust often pair encrypted email with a locked-down healthcare website security posture and a HIPAA-aware healthcare website design.

Common Failure Modes and How to Avoid Them

The most common failure is treating Confidential Mode as encryption. Front-desk staff assume the lock icon means the message is safe. It reduces forwarding but leaves the body readable to Google. Document the difference in the staff handbook.

The second is sending PHI from a personal Gmail account. There is no BAA, so any PHI in the message is a breach the moment it is sent. Migrate every clinical account to Workspace and disable personal Gmail forwarding.

The third is assuming S/MIME works when the recipient public certificate is not on file. The lock icon stays gray and the message goes out with TLS only. Set the tenant policy to block outbound send on the gray-lock state for accounts that handle PHI.

See the NIST SP 800-177 Rev 1 guidance on trustworthy email for the underlying reasoning on why TLS alone is not sufficient. The HIPAA Journal encryption requirements page summarizes the practical bar for covered entities.

  • Confirm your Workspace tier before assuming S/MIME is available.
  • Sign the Google BAA in the Admin console under Account, Legal and Compliance.
  • Never send PHI from a personal Gmail account.
  • Use Confidential Mode as a policy control, not as encryption.
  • Verify the mobile path before rolling out the desktop workflow.
  • Test S/MIME by exchanging a signed message with the recipient first, then encrypt.
  • Set a tenant policy that blocks unencrypted send for accounts that handle PHI.
  • Route outbound PHI mail through a gateway with a recipient-domain rule.
  • Keep the encrypt button visible in the composer to reduce human error.
  • Audit sent-folder contents monthly for accidental unencrypted PHI.
Posted on

How to Encrypt Email Across Common Clients and Compliance Cases

encrypt email guide featured image

🔑 Key Takeaways

  • Encrypt email splits four ways: TLS transport, S/MIME, PGP keys, or portal-based delivery.
  • TLS drops to plaintext if the receiving server fails to negotiate, so it fails as a standalone.
  • S/MIME and PGP encrypt the message content but need certificates or keys installed on both sides.
  • Portal services skip recipient setup and fit patient mail because zero install runs on their end.
  • HIPAA needs a signed BAA plus encryption in transit and at rest, not just any single method.

Encrypt email covers four different technical methods that each solve a different problem. Transport Layer Security handles the connection layer. S/MIME and PGP handle the message content. Portal-based services handle the recipient experience for external contacts.

This guide covers how to encrypt email across the major clients and use cases. Each method has a specific fit. Match the tool to the sensitivity of the content and the recipient environment.

The right choice depends on plan level, staff count, and how often external recipients change. Read each section for the fit and decide based on the actual send flow.

TLS Is the Baseline Encryption Every Modern Mail Server Uses

Transport Layer Security protects the connection between two mail servers. When one server sends to another, both negotiate a TLS handshake and encrypt the traffic in flight. Any observer on the network path sees only ciphertext.

TLS is on by default in Gmail, Outlook, Apple Mail, Yahoo, and every other major provider. Users do not turn it on. Administrators do not configure it per message. It happens automatically when both servers support it.

The catch is opportunistic fallback. If the receiving server does not support TLS, the sending server delivers the message in plaintext by default. No warning, no error. The sender sees a padlock in the client and assumes encryption, but the message reached the recipient over an unencrypted link.

For regulated content, the fallback rules out TLS as a standalone protection. The NIST SP 800-45 guide on email security recommends verified end-to-end encryption for sensitive email, not opportunistic TLS.

S/MIME Encrypts Message Content in Outlook and Apple Mail

S/MIME uses X.509 certificates to encrypt the message content itself. Once encrypted, only the recipient with the matching private key can read the message. The mail provider stores ciphertext and cannot decrypt.

Outlook supports S/MIME on all plans that include the desktop apps. Apple Mail supports S/MIME natively on macOS and iOS. Gmail supports S/MIME on Workspace Enterprise Plus, Education Standard, and Education Plus.

Setup requires a certificate for the sender and a certificate for the recipient. Certificates come from a trusted authority like DigiCert, Sectigo, or IdenTrust. Public keys attach to signed messages, so correspondents build up a keyring by receiving signed mail from each other.

S/MIME works well between internal users and formal partner organizations with matching PKI. It does not work well for one-off external contacts because most personal accounts do not have S/MIME set up.

encrypt email in article illustration one

PGP Uses an Open-Source Key Model

PGP is the open-source alternative to S/MIME. It does the same job with a different key management model. Users generate a public and private key pair, share the public key with correspondents, and encrypt messages with the recipient public key.

Thunderbird has built-in PGP support. Mailvelope provides a browser plugin for Gmail. GPG Suite covers Apple Mail on macOS. Outlook needs a third-party add-in like Gpg4win.

PGP has stronger cryptographic flexibility than S/MIME but a steeper learning curve. Key generation, keyserver management, and web-of-trust verification all fall to the user. Recipients unfamiliar with the process will not decrypt a PGP message without help.

PGP fits technical users and organizations where security-conscious sender and recipient both know the tooling. It does not fit patient-facing healthcare communication because most patients cannot manage PGP keys.

Portal Services Handle the External Recipient Case

Portal-based encrypted email services solve the friction problem that S/MIME and PGP create for external recipients. The sender writes the message in the normal client. The service encrypts the message and delivers a notification email with a click-to-open link.

The recipient clicks the link, verifies with a one-time passcode or a portal password, and reads the message in a browser. No key management, no certificate exchange, no software install for the recipient.

This is the model most healthcare practices adopt for patient-facing PHI. It works for patients, external providers, and vendors on any mail platform. The recipient does not need to configure anything on their end.

The tradeoff is that the message content lives on the vendor server. Vendor selection matters because that server becomes part of the compliance boundary. Portal services with a signed BAA and audit logging fit HIPAA. Consumer messaging apps generally do not.

Example

A three-provider chiropractic office wants encrypted email for referrals. The office manager tests opportunistic TLS to a regional insurer, but the insurer server drops TLS on receipt and delivers cleartext. The manager then tests S/MIME, but the insurer contact has no certificate. Finally the manager routes the message through a portal-based HIPAA service. The insurer clicks the notification, enters a one-time passcode, and reads the referral in 45 seconds. The office standardizes on the portal path for external referrals.

Encrypting Attachments Follows the Whole-Message Method

Attachments encrypt through the same method as the message body when using Purview, S/MIME, PGP, or a portal service. The sender does not need to encrypt attachments separately. The whole message envelope carries the encryption to the recipient.

Practices that need a separate attachment method have three options:

  • Save the file as a password-protected PDF and share the password through a different channel
  • Place the file in an encrypted ZIP archive using 7-Zip or WinZip with AES-256
  • Use a HIPAA-compliant file transfer service for very large files that exceed mail size limits

The whole-message method is easier for recipients and less error-prone than juggling separate passwords. Password-protected PDFs and ZIP files also fail when the sender emails the password in the same conversation, which happens frequently.

Once a recipient decrypts and downloads an attachment, the local copy is no longer covered by the sender-side encryption. HIPAA rules on the local file remain in force. That is a downstream concern for the recipient environment.

encrypt email in article illustration two

HIPAA Requires More Than the Encrypt Button

HIPAA compliance for email transmission requires four things: a signed business associate agreement with the mail platform, verified encryption in transit and at rest, access logs for six years, and workforce training on when to send PHI over email.

The Encrypt button alone does not cover all four. It covers the transmission layer. The BAA, the logging, and the training all fall to the covered entity to configure and maintain.

Microsoft 365 and Google Workspace both include HIPAA-eligible configurations with signed BAAs. Administrators accept the BAA in the admin center. The BAA applies to the tenant from that point forward. The covered entity handles the rest.

Dedicated HIPAA email services like Mailhippo include the BAA in the base plan without requiring plan upgrades on the underlying mail platform. This matches practices that need HIPAA-safe email but do not want to reconfigure the whole tenant.

Mobile Clients Support the Same Methods

Encrypt email on mobile works through the same methods as desktop. Outlook mobile supports Microsoft Purview Encrypt-Only and Do Not Forward through the same Encrypt option in the compose menu. Recipients open messages in the browser tab or in the Outlook mobile app.

Apple Mail on iOS supports S/MIME natively. Certificates install through a Configuration Profile pushed by mobile device management. The Encrypt icon appears in the compose window once the certificate is available.

Gmail mobile supports Confidential Mode through the standard compose interface. Portal-based encrypted email services provide mobile apps or work through the mobile browser. Mailhippo, Proofpoint, and other vendors all support mobile recipient flows.

The mobile recipient experience matters for patient-facing mail. Many patients read email on a phone. The service should present a clean mobile view of the decrypted message with tap-friendly buttons.

💡Pro Tip: Match the encryption method to the recipient population

Portal services fit patients and one-off external contacts because zero setup is required on the recipient end. S/MIME fits internal staff or partner organizations with managed PKI where certificates already exist. PGP fits technical users only. TLS fits general business mail with no regulated content. Picking the wrong method for the recipient population is the fastest way to tank open rates and force staff back to unencrypted workarounds.

Cost Varies From Free to Enterprise Tier

Encrypted email cost ranges widely. TLS is free and included in every mail platform. Gmail Confidential Mode is free with any Gmail account. S/MIME certificates cost fifty to several hundred dollars per user per year depending on the authority and support level.

Microsoft Purview Message Encryption requires Business Premium at around twenty-two dollars per user per month, up from Business Basic at six dollars. That is a plan-wide upgrade, not a per-message cost. Dedicated HIPAA services typically run five to twenty dollars per user per month depending on plan tier.

Practices on Business Basic or Business Standard often find a dedicated HIPAA service costs less than upgrading every seat to Business Premium. The math depends on how many seats need to encrypt versus how many just handle general mail.

Compare total cost of ownership, not just per-seat rate. Setup time, training, and ongoing configuration also count. A simpler service with a higher per-seat rate can cost less overall.

The Recipient Experience Determines Adoption

The single largest factor in encrypted email adoption is the recipient experience. Every step the recipient has to take lowers the open rate on regulated messages. Every extra sign-in or password reset lowers it further.

The rough order from easiest to hardest recipient experience is:

  • TLS message that arrives inline with no extra step
  • Portal service with a one-click link and one-time passcode
  • Portal service with account registration and password
  • S/MIME message that requires certificate pre-install
  • PGP message that requires key pair generation

Practices should match the method to the recipient population. Patient-facing mail needs the simplest recipient path. Internal mail between staff can use a more complex path because the setup is done once during onboarding.

Measure the open rate on encrypted messages. If the rate drops significantly compared to regular mail, the recipient path is too long. Switch to a shorter path.

Mailhippo Handles the HIPAA Case With One-Click Recipient

Mailhippo secure email service works with existing Gmail or Outlook accounts and includes a signed BAA in the base plan. There are no PGP keys, no S/MIME certificates, and no license upgrades on the underlying mail platform.

The sender writes the message in a browser interface or through an add-in. Mailhippo encrypts the content and delivers a notification email to the recipient. The recipient clicks the link, enters a one-time passcode delivered to the same email address, and reads the message.

This is the shortest recipient path among common HIPAA options. Patients on any mail platform can open the message on desktop or mobile. Attachments open inline. Replies encrypt automatically back to the sender.

The broader compliance stack includes healthcare website security features, patient portal configuration, and internal access controls. Encrypted email is one layer. The full stack covers the practice end to end.

Frequently Asked Questions

How do I encrypt an email in Outlook? +

Open a new message in Outlook. Click Options in the ribbon, click Encrypt, and pick Encrypt-Only or Do Not Forward. Write the message and click Send. Microsoft Purview handles the encryption and delivery. External recipients receive a notification email with a Read the message button that opens the content in a browser tab. They sign in with a Microsoft or Google account or request a one-time passcode. The Encrypt button requires Microsoft 365 Business Premium or higher.

How do I encrypt an email in Gmail? +

Gmail Confidential Mode is the built-in encryption option. Click the padlock and clock icon in the compose window, set an expiration date, and optionally require SMS verification. Confidential Mode blocks forward, copy, download, and print. It is not end-to-end encrypted and does not meet HIPAA requirements on its own. For HIPAA, use Google Workspace with a signed BAA plus Google Workspace client-side encryption, or route messages through a dedicated HIPAA email service that includes the BAA in the base plan.

How do I encrypt an email attachment? +

The simplest method is to encrypt the whole message using Microsoft Purview, S/MIME, PGP, or a portal-based service. All four methods encrypt the message body and attachments together. To encrypt an attachment separately, save it as a password-protected PDF, or place it in an encrypted ZIP file using 7-Zip or WinZip with AES-256. Share the password through a separate channel. The whole-message method is easier for recipients and less error-prone than the separate password method.

What is the difference between S/MIME and PGP? +

S/MIME uses X.509 certificates issued by trusted certificate authorities. The user pays for a certificate, installs it in the mail client, and encrypts using recipient certificates. PGP uses an open-source key pair generated by the user. Public keys share on keyservers or through direct exchange. Both methods encrypt at the message level. S/MIME integrates with Outlook, Apple Mail, and Gmail Enterprise. PGP integrates with Thunderbird, Mailvelope, and GPG Suite. S/MIME is more common in corporate settings. PGP is more common among technical users.

Is TLS enough to encrypt email for HIPAA? +

No, TLS alone does not satisfy the HIPAA transmission security standard reliably. TLS is opportunistic. If the receiving mail server does not support TLS, the sending server delivers in plaintext without any warning. The sender assumes encryption but the message reaches the recipient over an unencrypted connection. HIPAA requires verified encryption for PHI transmission. Use a message-level method like Microsoft Purview, S/MIME, or a portal-based service that enforces encryption on every send with no plaintext fallback.

Can I encrypt email to any recipient? +

Yes, if you use the right method. TLS reaches any recipient but drops to plaintext if the receiving server does not support TLS. S/MIME and PGP only work if the recipient has a matching certificate or key. Portal-based services work for any recipient because the message decrypts in a browser after a one-time verification. Practices sending to patients and external contacts on mixed platforms usually choose a portal-based method for the widest compatibility.

Do encrypted emails stay encrypted after the recipient opens them? +

It depends on the method. S/MIME and PGP messages stay as encrypted ciphertext in the mail client and decrypt on demand each time the recipient views them. Portal-based services keep the message encrypted on the server and decrypt in the browser for viewing. Microsoft Purview messages stay encrypted at rest. Once a recipient downloads an attachment or copies content out of the encrypted view, the local copy is no longer covered by the sender-side encryption.

Posted on

O365 Email Encryption Explained for Admins

o365 email encryption guide featured image

🔑 Key Takeaways

  • O365 encryption bundles TLS, at-rest, Purview portal delivery, and templates like Do Not Forward.
  • Purview reaches any inbox via portal; S/MIME decrypts inline where PKI is already deployed.
  • Business Basic and Standard skip the Encrypt button; Business Premium and E3 unlock Purview access.
  • Setup runs PowerShell for Azure RMS, then mail flow rules trigger encryption on keywords or domains.
  • Known limits: no inline branding, S/MIME cert pre-exchange friction, and Outlook 2013 add-in needs.

O365 email encryption is a bundle of features under Microsoft Purview Message Encryption, formerly known as Office 365 Message Encryption. It covers transport encryption, at-rest encryption on Exchange Online, and message-level encryption through a portal delivery model.

This guide walks through the licensing, setup, and known limits. If your tenant needs a supplementary encrypted email path for specific recipient groups or vertical compliance requirements, the vendor-neutral overview is a useful reference.

The audience assumed here is an IT admin or Microsoft 365 tenant owner setting up encryption for the first time or reviewing an existing configuration.

What O365 email encryption covers by default

Every Microsoft 365 tenant gets some encryption automatically. Exchange Online encrypts mail in transit using TLS 1.2 or higher between mail servers when both sides support it. This is the baseline any modern mail provider offers.

Exchange Online also encrypts mail at rest using BitLocker on the underlying storage and per-message encryption keys. This protects mail on disk against a physical theft or storage-layer attack.

The piece that is not on by default is the end-user Encrypt button. On-demand message-level protection requires a licensed feature, either Purview Message Encryption or S/MIME. Both are available on qualifying subscription tiers.

Compliance-covered communication requires the message-level layer in addition to the automatic transport and at-rest layers. Practices sending patient email cannot rely on the default alone. The Encrypt button is what makes the outbound message protected from server to recipient.

Licensing tiers and encryption features

Licensing determines which encryption features are available. The mapping is not obvious from the marketing pages, and admins routinely encounter tenants where the Encrypt button is missing because the license is wrong.

  • Business Basic and Business Standard: TLS and at-rest encryption only, no Encrypt button
  • Business Premium: full Purview Message Encryption including the Encrypt button
  • Enterprise E3: full Purview Message Encryption including the Encrypt button
  • Enterprise E5: Purview plus Advanced Message Encryption for branding, expiration, and revocation
  • Standalone add-on: Azure Information Protection Plan 1 or 2 adds Purview to lower tiers
  • Government: GCC and GCC High tenants have equivalent tiers with same feature mapping

Adding Purview to a Business Basic tenant through Azure Information Protection is technically possible but administratively awkward. Most tenants upgrade to Business Premium instead.

Confirm current licensing through the Microsoft 365 admin center before enabling encryption rules. Microsoft publishes the current feature mapping in the Microsoft Purview Message Encryption documentation.

o365 email encryption in article illustration one

Enabling Purview Message Encryption on the tenant

Enabling Purview requires a few specific steps. On new tenants provisioned after February 2019, Azure Rights Management is enabled by default. On older tenants, an admin needs to enable it through Exchange Online PowerShell.

Connect to Exchange Online PowerShell as a global admin. Run Enable-AadrmService to activate Rights Management on the tenant. Verify the state with Get-AadrmConfiguration. Once active, Purview Message Encryption is available to eligible users.

Assign Azure Information Protection or Message Encryption licenses to users through the admin center. Users see the Encrypt button in the Options ribbon in Outlook the next time they compose a message. Outlook on the web shows the same button in the compose interface.

Test with a compose to an external Gmail or Yahoo address before rolling out to end users. The test verifies the notification email arrives, the portal login works, and the message body renders correctly on the recipient side.

Automating encryption with mail flow rules

Mail flow rules in the Exchange admin center apply encryption automatically based on conditions. This removes the per-message decision from the sender and prevents the plaintext accident.

Common conditions include keyword lists in the subject or body, sender group membership, recipient domain matching, and attachment content patterns. A healthcare practice might trigger encryption on any outbound message to a patient domain list or containing terms like DOB, MRN, or diagnosis.

Configure the rule under Mail flow in the Exchange admin center. Add a new rule. Select Apply Office 365 Message Encryption and rights protection to the message. Choose the encryption template such as Encrypt or Do Not Forward. Save.

Test the rule with a message that matches the condition. Confirm the message is delivered encrypted. Then move on to the next rule. Complex mail flow with many rules can produce order-of-evaluation issues, so keep the rule set small and documented.

Example

A 40-user regional accounting firm moved from Business Basic to Business Premium at $22 per user per month specifically to enable Purview Message Encryption for client tax documents. The admin enabled Azure Rights Management through PowerShell, built a mail flow rule matching outbound messages containing SSN patterns, and set the rule to preview mode for one week. The rule caught 340 messages, six of which were false matches on internal replies. The admin refined the keyword list, moved the rule to enforced mode, and rolled encryption to all client-facing staff.

Comparing Purview Message Encryption to S/MIME in O365

Both Purview and S/MIME are supported in O365. They solve different problems and are often deployed together in the same tenant for different use cases.

Attribute Purview Message Encryption S/MIME
Recipient prerequisites None, portal-based Public certificate installed
Setup complexity Tenant-side only Sender and recipient certificate exchange
Recipient experience Portal login Inline in mail client
Reach to any address Yes Only PKI-equipped recipients
Typical fit Business to consumer Government, defense, enterprise PKI
Branding Portal branded on Enterprise E5 No portal to brand

Purview is the modern default for reaching external recipients on any platform. S/MIME is the preferred path when both sides already run PKI and inline decryption is required by policy.

Practices comparing broader alternatives can review the email encryption category overview alongside the Purview and S/MIME options.

Signing and encrypting in the same message

Signing and encryption are separate operations. Some organizations require both on the same message. O365 supports this through S/MIME with certificates installed in Outlook Trust Center.

Signing uses the sender’s signing certificate to hash the message and encrypt the hash with the sender’s private key. The recipient uses the sender’s public certificate to verify the signature. This proves sender identity and message integrity.

Encryption uses the recipient’s public certificate to encrypt the message content. Only the recipient’s private key can decrypt. Applying both operations on the same message provides authenticity and confidentiality together.

Sign-only, encrypt-only, and sign-and-encrypt are all valid options. Government and financial services organizations often mandate sign-and-encrypt as the default. Healthcare practices sending patient email usually apply encryption without signing because recipients are not verifying certificate chains.

o365 email encryption in article illustration two

Branding the recipient portal experience

Advanced Message Encryption on Enterprise E5 supports portal branding. This changes what an external recipient sees when they open the portal to read the encrypted message.

Configure branding through Exchange Online PowerShell using Set-OMEConfiguration. Parameters include OMEConfiguration for logo URL, background color hex, disclaimer text, portal text, and email text. Multiple configurations can be created and mapped to different mail flow rules.

Branding appears when external recipients open the portal. It does not appear on messages viewed inline in Outlook by internal recipients on the same tenant. Branding does not change the encryption itself. It changes the recipient trust signal.

Practices with a website and consistent visual identity often extend the same branding to the encrypted portal. Redefine Web covers the underlying identity work in the overview of healthcare web design.

Encryption at rest and mailbox-level protection

At-rest encryption in Exchange Online uses BitLocker on the underlying storage. This is transparent to admins and users. Every stored mail item is encrypted at the storage layer.

Customer Key is an option on Enterprise E5 and Advanced Compliance add-ons. It allows the customer to provide their own encryption keys used alongside Microsoft-managed keys. Losing the customer key results in permanent data loss, so key management overhead is significant.

Customer Key is a control for regulated industries that require key custody separate from the platform provider. For most healthcare and business use cases, Microsoft-managed keys are sufficient and much easier to operate.

Microsoft publishes the at-rest encryption architecture in the Microsoft Purview encryption reference. The design is aligned with NIST cryptographic guidance in NIST SP 800-52 Rev. 2.

💡Pro Tip: Run every mail flow rule in preview mode for one week

New encryption rules routinely match more messages than admins expect, catching normal internal replies alongside intended sensitive content. Preview mode logs matches without applying encryption, giving the admin real data on false-positive rates before staff experience broken workflows. Review the message tracking log daily during the preview week. Refine keywords, sender groups, or recipient conditions based on actual matches. Move the rule to enforced mode only after false matches drop below 1 percent of total volume.

Known limitations and workarounds

Every encryption system has limits. Documenting them in advance saves helpdesk hours later.

  • Branding does not appear on messages viewed inline in Outlook, only in the portal view
  • External recipients occasionally lose the portal notification to spam filtering
  • Outlook 2013 requires patching and the Message Encryption add-in for the Protect button
  • S/MIME needs certificate pre-exchange, which is not practical for ad hoc external sends
  • Some compliance frameworks require signing in addition to encryption, doubling the setup work

Workarounds include publishing a short recipient guide, allowlisting the Microsoft notification domain on partner mail servers, and upgrading beyond Outlook 2013. Each mitigation is small individually and adds up to a smoother user experience.

Some organizations supplement O365 encryption with a dedicated email encryption service for specific use cases where the portal experience is not suitable. The two can coexist through mail flow rules that route matching messages through the vertical vendor.

Operational monitoring and audit trails

Encryption is only useful if it stays on. Operational monitoring catches drift, misconfiguration, and user error before they turn into compliance events.

Enable audit log retention for at least six years in the Microsoft Purview compliance portal. HIPAA record-keeping applies to policies and procedures, and the audit log is the evidence trail during any Office for Civil Rights inquiry.

Monitor the Encrypt button usage through Message Trace and Advanced Message Encryption reports. Users who never use the button after a rollout are either not sending sensitive mail or are bypassing the encryption workflow. Both cases warrant follow-up.

Review mail flow rule hits monthly. A rule that produced regular hits then stopped may indicate an upstream change that broke the trigger. Diagnosing early prevents a silent gap in encryption coverage.

Practical rollout plan for a new O365 encryption deployment

A first-time O365 encryption deployment can run in one afternoon for a small tenant or across two weeks for a larger organization. The key stages are the same.

Confirm licenses cover the target user population. Enable Azure Rights Management if not already active. Configure mail flow rules for the initial triggers, such as external mail with specific keywords. Assign encryption-eligible licenses to pilot users.

Pilot with five to ten users for two to three weeks. Collect feedback on the sender workflow and the recipient portal experience. Adjust mail flow rules and branding based on the pilot findings. Roll out to remaining users in staggered groups.

Publish a one-page recipient guide for external partners describing the portal login process. Practices with a broader compliance program should coordinate the rollout with related work such as healthcare website maintenance to keep the whole patient communication stack aligned.

Frequently Asked Questions

Is O365 email encrypted by default? +

Yes for transport and at rest, no for message-level. Exchange Online encrypts mail in transit using TLS between servers when both sides support it. Exchange Online encrypts stored mail at rest using BitLocker on the underlying storage and per-message encryption keys. The Encrypt button for on-demand message-level protection is a licensed feature available on Business Premium and Enterprise tiers, not the default across all Microsoft 365 subscriptions. Compliance-covered communication requires the message-level protection in addition to the automatic transport and at-rest encryption.

Which O365 license do I need for email encryption? +

The end-user Encrypt button requires Microsoft 365 Business Premium, Enterprise E3, Enterprise E5, or Microsoft 365 Apps for enterprise with an Azure Information Protection Plan 1 or 2 add-on. Enterprise E5 adds Advanced Message Encryption for portal branding, custom expiration, and message revocation. Lower tiers such as Business Basic, Business Standard, and Enterprise E1 include TLS and at-rest encryption but not the on-demand Encrypt button. Government tenants use GCC or GCC High equivalents of these tiers. Confirm current licensing through the Microsoft 365 admin center before enabling encryption rules.

How do I set up O365 email encryption in Outlook 2013? +

Outlook 2013 requires a specific patch level and the Message Encryption add-in to display the Protect button on the ribbon. Confirm Outlook is patched to the latest security update. Install the add-in through the Office 365 admin push or manual download. The Protect button then appears in the ribbon on new message composition. Choose Encrypt-Only or Do Not Forward from the dropdown. Modern Microsoft guidance recommends moving beyond Outlook 2013 because extended support ended April 2023. Practices still on Outlook 2013 should plan an upgrade.

How do I add signing to O365 email encryption? +

Signing and encryption are separate operations in Purview. To sign messages, use S/MIME with a signing certificate installed in Outlook Trust Center, Email Security. To encrypt with Purview, click the Encrypt button in the Options ribbon. Both can be applied to the same message. Signing verifies sender identity to the recipient. Encryption protects content confidentiality. Government and financial services organizations often mandate both. Small practices sending encrypted patient email usually only apply Purview encryption without signing because the recipient is not verifying sender identity through certificate chains.

How do I brand the O365 encrypted email recipient portal? +

Advanced Message Encryption on Enterprise E5 supports portal branding. Use Set-OMEConfiguration in Exchange Online PowerShell to configure logo URL, background color, disclaimer text, and portal title. Multiple configurations can be created and mapped to different mail flow rules for different sender groups. The branding appears when external recipients open the portal to read the message. It does not appear on messages viewed inline in Outlook by internal recipients. Branding does not change the encryption itself. It changes what the recipient sees at the sign-in screen.

Are there known flaws in O365 email encryption? +

Security researchers have published analyses of Purview Message Encryption over the years, and Microsoft has responded with updates. The most-discussed finding involved the use of Electronic Codebook mode in earlier implementations, which was replaced with more modern modes. Current Purview implementations use approved cipher modes and align with NIST guidance. No cryptographic system is guaranteed to be flaw-free, and administrators should apply Microsoft patches promptly and monitor Microsoft Security Response Center bulletins. For compliance-covered communication, layered defenses matter more than any single algorithm choice.

Posted on

Email Encryption Programs Explained for Small Practices and Solo Providers

email encryption programs guide featured image

🔑 Key Takeaways

  • Encryption programs split into three groups: native client features, plugins, and gateway services.
  • Free tools like Mailvelope skip the BAA, which 45 CFR 164.308(b) requires for any PHI vendor.
  • S/MIME and OpenPGP are protocols, not products; both leave the subject line fully unencrypted.
  • Gateway services host a portal so recipients skip keys entirely and audit logs come out clean.
  • Start selection with a risk assessment mapping who sends PHI and how often external parties reply.

Email encryption programs protect messages that carry protected health information, financial records, or legal documents as they travel between mail servers and inboxes. The category covers native features built into Outlook and Gmail, browser plugins, and dedicated gateway services that route mail through a policy layer.

Choosing between them looks simple until a practice tries to deploy one across a staff of ten and a rotating list of referral partners. This guide compares the real options, explains what each protocol actually does, and covers the HIPAA rules that shape the decision. For clinics sending patient data every day, a HIPAA-ready encrypted email service removes most of the friction.

The wrong program does not just leak data. It also produces a workflow so awkward that staff bypass it to finish the day. Below is what actually works.

Native client encryption is the starting point for most offices

Outlook, Apple Mail, and iOS Mail all support S/MIME natively. Once an IT team installs an X.509 certificate on the user device, the Encrypt button appears in the compose window and the mail app handles the cryptographic work.

Gmail supports S/MIME on Google Workspace Enterprise and Education plans. Confidential mode is a separate feature that adds expiration and passcode gating but is not true end-to-end encryption. The message still sits on Google servers in a form Google can read.

Microsoft 365 Business Premium and higher include Purview Message Encryption. Staff click Encrypt in the Options ribbon, pick a policy, and Outlook handles the rest. External recipients get a portal link and sign in with Microsoft, Google, or a one-time passcode.

Native features work when everyone uses the same platform. The moment referrals cross between Outlook, Gmail, and older Exchange servers, gaps appear. That is where dedicated encryption for email gateway tools earn their subscription cost.

Free email encryption programs have real limits for HIPAA workflows

Mailvelope, an OpenPGP browser extension, encrypts Gmail and Outlook Web messages from inside the browser. Enigmail forks and GnuPG add PGP to desktop clients like Thunderbird. Both are free and technically strong.

The problem is not the cryptography. It is the operational model. Every recipient needs a keypair, a way to publish the public key, and a habit of protecting the private key. Patients and small billing partners rarely meet any of those requirements.

Free tools also do not sign a Business Associate Agreement. HHS makes the BAA a hard requirement at 45 CFR 164.308(b) for any vendor that processes PHI. Without that document on file, a covered entity carries the compliance risk alone.

Practices that want a free email encryption service for personal correspondence can use these tools safely. For clinical email, the missing BAA rules them out. This is the single most common mistake in small-office HIPAA audits.

email encryption programs in article illustration one

S/MIME and OpenPGP handle key management differently

S/MIME relies on a hierarchy of certificate authorities. A trusted CA issues each user a certificate, mail clients verify certificates against a root store, and revocation lists let administrators kill a compromised key. The model matches how corporate IT already thinks about identity.

OpenPGP uses a decentralized web of trust. Users sign each other keys, publish public keys to a keyserver, and rely on personal verification rather than a central authority. It is powerful for technical users and painful for everyone else.

Neither protocol encrypts the subject line or the To and From headers. Metadata leaks through both. NIST covers key management requirements in Special Publication 800-175B, available at nist.gov/publications.

Practices adopting S/MIME need a plan for certificate renewal, mobile provisioning, and revocation. Practices adopting OpenPGP need a plan for user training. Both are legitimate paths, but neither is a low-effort choice.

Gateway encryption services remove the recipient key problem

A gateway service sits between the practice mail server and the wider internet. When the outbound message matches a policy, the gateway diverts it to a secure web portal and sends the recipient a notification with a link.

The recipient clicks the link, verifies identity through a one-time code or federated login, and reads the message in a browser. No plugin, no certificate, no keypair. This is the pattern behind Microsoft Purview, Google client-side encryption, and dedicated HIPAA services.

Gateway tools also produce audit logs that show when the recipient opened the message, when the link expired, and whether the message was forwarded. Those logs feed directly into the HIPAA risk analysis process.

For practices comparing options, the deciding question is usually recipient experience. If patients reply from phones, gateway wins. If all recipients are corporate IT-managed staff, native S/MIME works. A more detailed best free email encryption solution comparison can help narrow the shortlist.

Example

A billing company in Tampa processing 400 claims a day ran on Mailvelope for outbound mail to insurance carriers. The setup worked until three carrier staff rotated and the new hires had no PGP keys. Twelve claims sat undecrypted for four business days, delaying $86,000 in adjudication. The company migrated to a gateway service with portal delivery and a BAA in the base plan. Recipient staff opened messages in a browser with a one-time code, no keys required. Turnaround on future claims dropped from three days to same-day pickup within the first month.

Deployment paths differ across Outlook, Gmail, and Apple Mail

For Microsoft 365 Business Premium and Enterprise plans, administrators enable Purview Message Encryption in the Exchange admin center, publish rights management templates, and the Encrypt button appears in Outlook for every user. Microsoft documents the full path at learn.microsoft.com/purview.

For Google Workspace, S/MIME requires the Enterprise plan. Administrators upload each user certificate to the admin console, and Gmail activates the encrypt option in compose. Confidential mode works on all plans but is not a HIPAA control by itself.

For Apple Mail on macOS and iOS, users import certificates into the keychain and the Encrypt lock icon appears in the compose window. Mobile device management profiles can push certificates automatically to staff phones.

Deployment complexity grows with the mix of platforms. A practice on a single Microsoft tenant has the easiest path. A practice with staff on Gmail, Outlook, and personal iPhones needs either uniform S/MIME provisioning or a gateway service to bridge the gap.

Comparison of common email encryption programs

The table below shows how the three main categories compare on cost, recipient experience, and HIPAA fit. Practices should treat this as a starting point rather than a purchasing rule.

Program type Cost model Recipient experience BAA available
Native S/MIME (Outlook, Apple Mail) Included in Microsoft 365 Business Premium or Google Workspace Enterprise Requires recipient certificate Through Microsoft or Google BAA
OpenPGP plugin (Mailvelope, GnuPG) Free Requires recipient PGP keypair No
Gateway service (Microsoft Purview, dedicated HIPAA) Per user per month Portal login with one-time passcode Yes, included in HIPAA plans
Confidential mode (Gmail) Included in Google Workspace Passcode or in-Gmail preview Not sufficient alone

Cost per seat rarely tells the full story. Total cost also includes support tickets when recipients cannot open a message, certificate renewal work, and the compliance risk of a program that does not sign a BAA.

email encryption programs in article illustration two

HIPAA rules that shape the encryption program decision

The HIPAA Security Rule at 45 CFR 164.312(e)(1) treats transmission security as an addressable standard. Addressable does not mean optional. It means the practice must implement the safeguard or document why an equivalent alternative works.

HHS guidance points to NIST 800-52 Rev. 2 for TLS baselines and NIST 800-175B for cryptographic key management. Both documents are free at csrc.nist.gov/publications. Auditors expect to see specific citations in the practice policy documents.

The Business Associate Agreement requirement at 45 CFR 164.308(b) covers any vendor that creates, receives, maintains, or transmits PHI. That includes the email encryption vendor. A signed BAA on file before go-live is not negotiable.

Practices building a HIPAA-compliant patient communications program should also review healthcare website security features that carry the same rigor into the web layer where patient forms and portals live.

User training determines whether encryption actually gets used

Buying an encryption program is one line item. Getting staff to use it every time PHI leaves the office is a different project. Training programs that focus on when to encrypt work better than training that focuses on how.

Effective training covers the practical scenarios. A referral letter to another clinic, a claim to a billing partner, an intake form sent back to a patient, a lab report forwarded to a specialist. Each one is a moment where a staff member decides to encrypt.

Policy-based gateway services reduce the training burden by making the decision automatic. If the message contains a subject keyword, a policy trigger, or goes to a domain on the encryption list, the gateway encrypts without a manual click.

  • Train new hires in the first week, not the first month
  • Include encryption steps in the intake and referral workflows
  • Test the process quarterly with a live send to a personal address
  • Document exceptions where encryption was skipped and why
💡Pro Tip: Start with a mail-flow map before comparing programs

List every recipient type the practice mails, how often each replies, and which devices they use. A patient on a phone, a billing partner with rotating staff, and a specialist on hospital IT-managed Outlook each need a different encryption path. Vendor feature checklists tell you nothing if the mail flow map is missing. Once the map exists, compare programs against real recipient behavior, not marketing copy. A three-person clinic and a 30-person billing company almost never pick the same tool.

Cost breakdown across common encryption program tiers

Free tools cost nothing but time. Staff spend hours provisioning keypairs, and IT spends hours resolving recipient errors. For a two-person clinic that sends encrypted mail twice a week, that math might still work.

Microsoft 365 Business Premium runs about $22 per user per month and includes Purview Message Encryption. Google Workspace Enterprise Standard starts higher but includes S/MIME and client-side encryption controls.

Dedicated HIPAA email services typically price between $5 and $15 per user per month with the BAA included. That range covers the encryption itself, the portal, audit logs, and support. For a five-person office, the total sits around $50 to $75 a month.

Practices that also invest in HIPAA-compliant website design and encrypted email together get consistent controls across the patient-facing surface and the back-office communication layer.

Migration paths from a free tool to a HIPAA-ready service

Practices already using Mailvelope or a similar free tool can migrate in a phased plan. Start by identifying which mail flows carry PHI and which do not. Only the PHI flows need the paid service.

Next, run the new service in parallel for two weeks. Staff send a copy of each encrypted message through both tools and confirm the recipient can open it. This catches configuration errors before the free tool gets turned off.

After the parallel period, publish a written cutover date, decommission the free tool, and export any archived messages the practice needs to retain. HIPAA retention rules at 45 CFR 164.316(b)(2) require six years for policy documentation.

Services designed for healthcare use, including a HIPAA-compliant secure email service, plug into existing Gmail or Outlook accounts and remove the recipient key problem in a single onboarding step.

Ongoing controls that keep an encryption program compliant

Encryption controls decay over time. Certificates expire, staff turn over, recipient domains change hands, and vendors update their portals. A control that worked last year may not work this year.

NIST recommends quarterly verification of encryption controls as part of the risk analysis process. A simple test send to an external address, review of the message headers, and confirmation of the portal login flow catches most drift issues.

  • Review the BAA renewal date with each vendor annually
  • Rotate S/MIME certificates before expiration, not after
  • Audit access logs quarterly for portal-based services
  • Update the risk analysis document after any material change
  • Test disaster recovery for encrypted mail at least once a year

Practices that pair encryption controls with strong healthcare website maintenance keep the entire patient communications stack aligned. Encryption is one layer. The web layer, the endpoint layer, and the training layer all need the same maintenance rhythm to hold up under audit.

The HHS Office for Civil Rights publishes enforcement actions at hhs.gov/hipaa/enforcement. Reading the recent cases shows which encryption gaps trigger investigations. Almost every settlement includes a missing or outdated risk analysis.

Frequently Asked Questions

What counts as an email encryption program under HIPAA? +

HHS does not certify specific products. The rule requires that PHI in transit be protected against unauthorized access, and the guidance points to NIST 800-52 Rev. 2 for TLS and NIST 800-175B for cryptographic key management. Any program that meets those baselines, backs the deployment with a signed Business Associate Agreement, and produces retrievable audit logs meets the technical safeguards standard at 45 CFR 164.312(e)(1). Certification claims from vendors are marketing, not regulation.

Do free email encryption programs work for a small medical office? +

For personal use they work fine. For a practice sending PHI they usually do not. Free tools like Mailvelope or ProtonMail free tier lack a signed BAA, which HHS requires for any vendor that creates, receives, maintains, or transmits PHI on the covered entity behalf. A single missed BAA can turn a data incident into a reportable breach under the Breach Notification Rule at 45 CFR 164.400-414. Paid HIPAA services include the BAA in the base plan.

Is TLS encryption alone enough for HIPAA email? +

TLS protects mail while it moves between two servers that both support it. Opportunistic TLS drops to plaintext when the receiving server does not negotiate a session. For internal mail between two Google Workspace or Microsoft 365 tenants that both enforce TLS 1.2 or 1.3, this is usually fine. For mail leaving the practice to unknown recipients, opportunistic TLS is not sufficient, and the office needs a policy engine that forces encryption or diverts to a secure portal.

What is the difference between S/MIME and PGP for daily use? +

S/MIME uses certificates from a public certificate authority and works natively in Outlook, Apple Mail, and iOS Mail. IT teams can push certificates through a mobile device management profile. PGP uses a web of trust model where users exchange public keys directly or through a keyserver. PGP is more flexible for cross-platform use but requires more user training. Neither protocol encrypts the subject line, and both fail silently when a recipient key expires.

Can I use Outlook or Gmail encryption without buying anything extra? +

Outlook 365 Business Premium includes Microsoft Purview Message Encryption and the Encrypt button in the ribbon. Gmail confidential mode adds message expiration and passcode gating but is not end-to-end encrypted. Google Workspace Enterprise Plus offers true client-side encryption with customer-managed keys. Free consumer Gmail and Outlook.com accounts do not qualify for a Business Associate Agreement and cannot be used to send PHI regardless of whether a confidential mode toggle exists in the interface.

How do I test whether my encryption program is actually working? +

Send a test message to a personal address on a different mail provider, open the message headers, and look for the Authentication-Results and Received headers. TLS negotiation appears as TLS=version in the Received line. For portal-based encryption, the recipient should hit a login page rather than see the message body inline. NIST recommends quarterly verification of encryption controls as part of a broader risk analysis under 45 CFR 164.308(a)(1)(ii)(A).

What happens when a recipient cannot open an encrypted message? +

Portal services fall back to a one-time passcode sent to the recipient inbox, which the recipient enters on the portal to read the message. S/MIME and PGP have no fallback. The message either decrypts with the correct private key or shows as unreadable ciphertext. This is one of the biggest reasons small practices move from certificate-based encryption to gateway services. A single unreadable prescription authorization can delay patient care by a full day.

Posted on

Can I Encrypt an Email in Gmail (and Every Other Client)

can i encrypt an email in gmail guide featured image

🔑 Key Takeaways

  • Gmail offers three paths: Confidential Mode, native S/MIME, or a third-party portal extension.
  • Confidential Mode is not real encryption; Google reads the body and it fails HIPAA audits.
  • Native S/MIME needs Enterprise Plus and the recipient public cert, which patients rarely have.
  • Outlook 365 Business Premium unlocks the Encrypt button; Outlook Desktop S/MIME works on any plan.
  • GoDaddy Professional Email offers no BAA; healthcare needs Microsoft 365 Business Premium or higher.

Encrypting an email should be a one-click operation. In practice it depends on which client, which plan, and which recipient the sender is dealing with.

The core question, can I encrypt an email in Gmail, has three answers. So does the same question for Outlook and GoDaddy. This guide walks through each path, when to use it, and when a hosted encrypted email service is the simpler choice.

The setup order matters. Check the client, check the plan, then choose the encryption method that matches the recipient. A method that works for a colleague on the same tenant may not work for a patient on a free consumer account.

Gmail Confidential Mode is not encryption

Confidential Mode appears in the Gmail compose window as a lock icon at the bottom of the toolbar. Clicking it opens a dialog for expiration and passcode settings.

The message body is not encrypted. Google servers store the message in the same format as any other Gmail message. The controls are behavioral, meaning they restrict what the recipient can do in the Gmail interface.

The recipient can still screenshot the message, retype it, or print the screen. The expiration setting removes access from the Gmail viewer, but any content already read is out of the sender’s control.

For casual privacy, Confidential Mode is useful. For HIPAA or any regulated data, it is not sufficient. The Security Rule requires actual encryption of the transmitted content.

Native S/MIME in Gmail requires Enterprise Plus

Google Workspace supports hosted S/MIME on Enterprise Plus, Education Standard, and Education Plus. Business Starter, Standard, Plus, and Enterprise Standard do not include native S/MIME.

To enable S/MIME, an administrator uploads each user’s S/MIME certificate through the Admin console and configures the S/MIME setting under Apps, Google Workspace, Gmail, User settings.

Sending an encrypted message to an external recipient requires the recipient’s public certificate. If Gmail does not have the certificate on file, the compose window shows the message as signed but not encrypted.

The certificate exchange problem is the reason most practices skip S/MIME even when the plan supports it. Patients and external contacts rarely have S/MIME certificates.

can i encrypt an email in gmail in article illustration one

Third-party extensions add encryption to any Gmail plan

Browser extensions like Mailhippo, Virtru, and FlowCrypt add an encryption toggle to the Gmail compose window. When the toggle is on, the extension encrypts the message before it leaves the browser.

External recipients receive a link and open the message in a portal. They authenticate with a Google, Microsoft, or email-verified passcode, depending on the extension.

The advantage over S/MIME is that recipients need no configuration. The advantage over Confidential Mode is that the encryption is real. The trade-off is a per-user monthly fee.

For healthcare senders, the extension has to come with a signed BAA. Mailhippo, Virtru, and Paubox all offer BAAs. FlowCrypt does not, which rules it out for HIPAA use. Practices weighing which extension to install often compare notes across how can i encrypt my emails and similar decision guides.

Outlook 365 has an Encrypt button that triggers Purview

Can I encrypt an email in Outlook? Yes. On Microsoft 365 Business Premium or higher, the Encrypt button appears on the Options ribbon in Outlook Desktop and in the Actions menu in Outlook on the web.

Clicking Encrypt applies Microsoft Purview Message Encryption. The message body and attachments are encrypted, and external recipients receive a portal link that they open after authenticating with Microsoft, Google, or a one-time passcode.

The Encrypt button only appears if Azure Rights Management is active on the tenant. If a super administrator has never enabled it, the button is invisible even on the correct license.

On Business Basic or Business Standard, the Encrypt button is not available. Practices on those plans need to upgrade to Business Premium or use a third-party gateway.

Example

A family law attorney on GoDaddy Professional Email started sending confidential settlement drafts to opposing counsel and clients. She assumed the padlock icon in her webmail meant messages were encrypted end-to-end. Her paralegal researched the plan and discovered GoDaddy Professional Email uses TLS in transit only, with no message-level encryption and no BAA. The firm migrated the 4 mailboxes to Microsoft 365 Business Premium through GoDaddy at $88 per month total, activated the Encrypt button, and set a mail flow rule requiring encryption on all outbound client mail.

Outlook Desktop supports S/MIME on any plan

Outlook Desktop has supported S/MIME for over 20 years. The setup runs through File, Options, Trust Center, Trust Center Settings, Email Security.

A user imports an S/MIME certificate from a certificate authority into the Windows certificate store, then binds it to their Outlook profile. Digital signing and encryption become available on the compose window.

To send an encrypted message to an external recipient, the sender needs the recipient’s public certificate. Outlook stores public certificates from previously received signed messages, which is how the exchange usually happens.

Outlook on the web has more limited S/MIME support and requires the S/MIME control installed through the browser. Outlook Mobile does not support S/MIME send at all on most versions.

can i encrypt an email in gmail in article illustration two

Consumer Outlook.com has free encryption between Microsoft accounts

Outlook.com consumer accounts include free encryption for messages between Microsoft accounts. The shield icon in the compose window toggles encryption on.

The recipient experience depends on what account they use. Other Outlook.com or Microsoft 365 users see the decrypted message natively. External recipients on Gmail, Yahoo, or similar receive a portal link.

The free encryption tier does not include a BAA. Microsoft signs BAAs on Microsoft 365 business plans, not on consumer Outlook.com. Healthcare users on Outlook.com are not compliant.

For a personal user who wants to send an encrypted message once in a while, Outlook.com’s built-in encryption is a fine free option. For a practice, it is not.

GoDaddy email splits into two products with different encryption options

GoDaddy sells two email products under two brand names. Professional Email is GoDaddy’s own product, and Microsoft 365 from GoDaddy is a rebranded Microsoft 365 tenant.

On Professional Email, transit encryption uses TLS whenever the receiving server supports it. There is no built-in body encryption. Users who need it install a third-party extension or upgrade.

On Microsoft 365 from GoDaddy, encryption works exactly like any Microsoft 365 tenant. Business Premium and higher get the Encrypt button. Lower tiers do not.

GoDaddy does not sign a BAA for its consumer-tier products. Healthcare senders on GoDaddy need to be on the Microsoft 365 Business Premium tier, activate the BAA through the Microsoft admin center, and use Purview or a third-party service for encryption.

💡Pro Tip: Confirm the BAA is signed before trusting any padlock icon

Every email vendor displays some security indicator, and users routinely interpret padlock icons as evidence of HIPAA compliance. The icon usually indicates only TLS-in-transit, not message-level encryption or business associate coverage. Before sending PHI through any account, verify the BAA is signed and covers the specific service in use. Google Workspace Admin console records the acceptance under Legal and compliance. Microsoft 365 records it in the Service Trust Portal. GoDaddy Professional Email offers no BAA at all.

Comparison of encryption methods across common clients

The three main methods, TLS, S/MIME, and portal-based, each have trade-offs. TLS is automatic and covers most modern receivers, but the sender has no visibility into whether a specific message actually used TLS on delivery.

S/MIME is strong when both sides have certificates, but the certificate exchange kills the workflow for most external recipients. Portal-based services solve the certificate problem but add a step for the recipient.

Method Recipient effort HIPAA-ready Included in
TLS only None Only with signed BAA plus verified TLS enforcement Every provider
Gmail Confidential Mode Passcode entry No Every Gmail plan
S/MIME Certificate install Yes, if BAA in place Enterprise Plus, Outlook Desktop, Microsoft 365
Purview Message Encryption Portal login Yes, if BAA in place Microsoft 365 Business Premium+
Third-party portal service Portal login Yes, with signed BAA Mailhippo, Virtru, Paubox

The right column matters more than the others for a healthcare practice. If the encryption method is not paired with a signed BAA, it does not meet the Security Rule requirement regardless of how strong the cryptography is.

What to choose based on the sender’s situation

A solo practitioner on Gmail should install a hosted encryption service and skip the plan-tier gymnastics. The monthly fee is smaller than the friction of managing S/MIME certificates for every recipient.

A small group practice on Microsoft 365 Business Standard should upgrade to Business Premium, activate the Encrypt button, and train staff on when to use it. That is the shortest path to compliance for a Microsoft-first shop.

A larger clinic with mixed email systems benefits from a gateway service that sits in front of every outbound path. The gateway enforces encryption regardless of which client the user sends from.

Practices that want the marketing site and patient intake to match the email compliance posture should work with an agency familiar with HIPAA-compliant website design so the intake forms, the appointment reminders, and the outbound clinical mail all share the same encryption story.

Quick setup steps for the three most common configurations

For Google Workspace Business Standard with a hosted encryption service: sign up with the vendor, connect the Gmail account through OAuth, install the browser extension, and send a test message to a personal address on a non-compliant server. Confirm the recipient sees a portal link.

For Microsoft 365 Business Premium: activate Azure Rights Management under Settings, Org settings, Services, Microsoft Azure Information Protection. Confirm the Encrypt button appears in the Outlook ribbon. Send a test message.

For Outlook Desktop with S/MIME: purchase a certificate from a certificate authority, install it in the Windows certificate store, bind it under Trust Center, Email Security, and exchange a signed message with the intended recipient to swap public certificates.

The Google Confidential Mode help page and the Microsoft Purview documentation both walk through the client-side steps for reference.

  • Check the plan tier before choosing an encryption method.
  • Skip Confidential Mode for any regulated data.
  • Use a third-party hosted service if S/MIME certificate exchange is not practical.
  • Confirm a signed BAA is in place before sending PHI over any channel.
  • Test with a real external recipient before rolling out to staff.

Answering can i encrypt an email in gmail is the easy part. The harder question is which method fits the sender’s plan, the recipient’s setup, and the compliance requirements attached to the content. The right combination changes the moment any of those three factors change.

Frequently Asked Questions

Can I encrypt an email in Gmail without upgrading my plan? +

Yes. Confidential Mode is available on every Gmail plan, though it is not real encryption. For actual body encryption on a Business Starter, Standard, or Plus plan, install a third-party extension like Mailhippo, Virtru, or FlowCrypt. The extension encrypts the message before it leaves the browser and delivers external recipients a portal link. Native S/MIME requires Enterprise Plus. The extension route is the simplest way to add real encryption to a Gmail account without changing the plan tier.

How can I encrypt an email for free? +

Free options exist but each has a limit. ProtonMail encrypts messages to other ProtonMail users automatically and delivers messages to outside recipients through a password-protected portal. FlowCrypt adds free PGP encryption to Gmail through a browser extension. Outlook.com sends free encrypted messages between consumer Microsoft accounts. None of the free options include a business associate agreement, so they are unsuitable for healthcare use. Compliance-grade sending requires a paid service with a signed BAA.

Can I encrypt an email in Outlook? +

Yes. On Microsoft 365 Business Premium or higher, click the Encrypt button on the message ribbon to trigger Purview Message Encryption. On any plan with S/MIME certificates installed, click the security icon and choose Encrypt Message Contents. On Outlook.com consumer, click the shield icon in the compose window to send a message with Microsoft encryption. Each option produces a slightly different recipient experience, but all three encrypt the message body and support external delivery.

How can I easily encrypt an email from any client? +

The easiest path across every client is a third-party encryption service that connects to the existing account. Mailhippo works this way with Gmail, Outlook, and any IMAP or SMTP account. Send from the normal compose window, and the service encrypts the message automatically before it reaches the recipient. No certificates, no toggle, no compose window changes. The recipient gets a portal link or an encrypted TLS-delivered message depending on their provider’s support.

How does GoDaddy encrypt email on its Professional Email plan? +

GoDaddy Professional Email uses TLS for transit encryption whenever the receiving server supports it. There is no built-in body encryption on the standalone Professional Email product. Users who need message-level encryption on GoDaddy Professional Email have to install a third-party extension or upgrade to the Microsoft 365 tier sold through GoDaddy. GoDaddy does not sign a BAA for its consumer or small-business tiers, so healthcare senders need to be on a Microsoft 365 plan that qualifies for the Microsoft BAA.

Does encrypting an email guarantee the recipient can read it? +

No. If the recipient does not have S/MIME certificates configured and the encryption path used S/MIME, they cannot decrypt the message. Portal-based services solve this by delivering a link the recipient opens in a browser, which works on any email client. Before sending an encrypted message to a first-time recipient, most encryption services show a preview of what the recipient will see. That preview is useful for confirming the recipient will actually be able to open the message.

What is the difference between encryption and Confidential Mode in Gmail? +

Confidential Mode adds three controls to a message. The recipient cannot forward, copy, print, or download the message from the Gmail interface. The message expires on a schedule the sender sets. The recipient must enter a passcode sent by SMS to open it. None of those controls encrypt the message content. Google can still read the body, and a determined recipient can screenshot the content. Real encryption protects the body from anyone without the decryption key.