🔑 Key Takeaways
- Encryption tools split four ways: client plug-ins, SMTP relays, enterprise gateways, or native.
- Plug-ins add an Encrypt button but rely on user action, which risks forgotten sends of PHI.
- SMTP relays enforce encryption on every outbound message with no button and no user memory step.
- Enterprise gateways scan for SSNs and MRNs, then encrypt automatically based on content rules.
- Judge software on enforcement, workflow fit, and BAA coverage rather than long feature lists.
Email encryption software falls into four categories. Client-side plug-ins, SMTP relays, enterprise gateways, and native platform features. Each fits a specific team size and compliance requirement.
Choosing email encryption software starts with the mail platform already in use, the number of users, the volume of regulated content, and the recipient technical setup.
This guide walks through each category and the practical criteria for choosing between them.
Client-Side Plug-Ins Add Encryption Inside the Mail Client
Client-side plug-ins install inside Outlook, Gmail, or Apple Mail and add encryption to the compose interface. Mailvelope adds PGP to browsers. Virtru and similar third-party plug-ins add portal-based encryption to Gmail and Outlook.
Native S/MIME support in Outlook and Apple Mail also functions as a client-side plug-in path when combined with an installed certificate. The user clicks Sign or Encrypt on a per-message basis.
Plug-ins suit small teams that want encryption without changing the mail platform. Deployment installs on each user machine or account. Training is per-user because encryption depends on user action.
The tradeoff is that plug-ins require user action for every sensitive send. A forgotten click means an unencrypted send with regulated content, which is a documented HIPAA breach cause.
SMTP Relays Intercept Mail at the Transport Layer
SMTP-relay services sit between the sender mail client and the recipient mail server. The sender configures outbound SMTP to route through the relay. The relay applies encryption and forwards to the destination.
Purpose-built HIPAA-compliant services often use this model. Mailhippo works this way. The sender writes and sends from Gmail or Outlook as usual. The relay handles encryption, TLS delivery, and portal fallback when TLS is unavailable.
The advantage is enforcement. Every outbound message routes through the relay and gets encrypted. The user cannot forget because there is no per-message action to remember.
The tradeoff is that the relay must be trusted with plaintext during the encryption step. The vendor signs a BAA and provides access logs for audit, but plaintext transit through the service is part of the design.
Enterprise Gateways Inspect and Enforce at Scale
Enterprise email gateways from Cisco, Proofpoint, Barracuda, and Mimecast sit inline with the mail server. Every outbound and inbound message passes through the gateway for inspection.
Data loss prevention rules scan outbound content for regulated patterns like Social Security numbers, medical record numbers, or payment card numbers. Matching messages are encrypted or blocked according to policy.
Gateways suit hospital systems, large financial firms, and government agencies. Setup involves integration with the mail server, policy configuration, and ongoing tuning to reduce false positives. Administrator time is significant.
For small and mid-sized practices, gateway software is often more infrastructure than needed. A relay-based service delivers the enforcement benefit without the operational overhead.
Native Platform Encryption Depends on the Tier
Microsoft 365 and Google Workspace include native encryption features on specific tiers. Microsoft 365 Business Premium and higher include the Encrypt button and Microsoft Purview Message Encryption. Google Workspace Enterprise Plus includes S/MIME hosted encryption.
Lower tiers do not include these features. Microsoft 365 Business Basic and Business Standard rely on TLS transport and do not offer the Encrypt button. Google Workspace Business Standard and Business Plus rely on TLS and Confidential Mode.
Native platform encryption is often the lowest-cost path when the organization already pays for a qualifying tier. It removes the need for third-party software. The setup is contained within the existing platform administration.
According to Microsoft documentation, Purview Message Encryption meets HIPAA transmission requirements when paired with a signed BAA. The BAA is included with qualifying Microsoft 365 tiers.
A five-provider dermatology practice on Microsoft 365 Business Basic evaluates two paths. Upgrading eight seats to Business Premium adds roughly $80 per month for the Encrypt button, plus setup time. A purpose-built HIPAA SMTP relay at $10 per seat costs $50 per month, includes a signed BAA in the base plan, and enforces encryption on every outbound patient message with no user action. The practice picks the relay and completes DNS routing in one afternoon.
S/MIME Software Requires Certificate Management
S/MIME implementations run as native components of Outlook, Apple Mail, and Gmail on Workspace Enterprise. There is no separate S/MIME software to install beyond the certificate itself.
The certificate lifecycle is where the operational cost lives. Certificates come from a trusted authority such as DigiCert, Sectigo, or IdenTrust. They expire after one to three years and need renewal. Departing employees need their certificates revoked.
Enterprise deployments automate the certificate lifecycle through a managed public key infrastructure. Small practices typically manage certificates manually per user, which is manageable for a few users but scales poorly.
PGP Software Is Free but Requires Technical Users
PGP is open source. The GNU Privacy Guard command-line tool and its front ends including Gpg4win on Windows, GPG Suite on Mac, and Mailvelope for browsers are free to install and use.
PGP does not use a certificate authority. Users generate a public-private key pair, share the public key with correspondents, and encrypt with the recipient public key. There is no annual certificate cost.
The trade-off is user experience. PGP requires understanding key exchange, verifying key fingerprints, and managing a keyring. Non-technical users find the workflow confusing. This limits PGP to teams that can standardize on it.
HIPAA Software Requires a Signed BAA
For HIPAA, the software vendor must sign a business associate agreement covering the handling of protected health information. This is a legal requirement, not a technical one. Software with strong encryption but no BAA does not qualify for HIPAA-scoped transmissions.
Purpose-built HIPAA services include the BAA in the base plan. Microsoft and Google sign BAAs at qualifying tiers. Some plug-in vendors sign BAAs on higher tiers or by request. Free tools generally do not.
According to HHS guidance, the BAA must specify permitted uses and disclosures, safeguards required, and breach notification obligations. Standard BAAs from established vendors cover these terms without custom negotiation.
The vendor sales page always shows the sender screen. The recipient view is what actually decides adoption. Send a test message from the demo tenant to a personal Yahoo address, a personal Gmail address, and a corporate Outlook address. Time each open. Any path that takes more than 90 seconds or requires account creation will kill open rates on patient mail. Match the recipient friction to the population you actually send to.
Integration Points Determine Deployment Time
The deployment time for encryption software depends on the integration point. Native platform features are already integrated; enabling takes minutes. SMTP-relay services require an outbound SMTP configuration change, typically completing in an hour. Client-side plug-ins install per user, so time scales with user count.
Enterprise gateways require the most setup. Integration with the mail server, policy design, testing, and rollout typically take weeks. Small teams almost never justify this scope.
- Native platform features: minutes to enable, no user-side setup.
- SMTP-relay services: hours to configure, no user-side setup.
- Client-side plug-ins: minutes per user, scales with user count.
- Enterprise gateways: weeks to deploy, requires ongoing policy tuning.
For small practices switching to encrypted email for the first time, the SMTP-relay path is typically the fastest to production with the fewest ongoing surprises.
Recipient Experience Shapes Adoption
The best encryption software fails if recipients cannot open the messages. Recipient friction is often the deciding factor between two otherwise comparable products.
S/MIME and PGP require the recipient to have keys installed and a supported client. Portal-based services require a click, a passcode, and a browser. Native platform encryption between users on the same platform requires no action.
For healthcare practices sending to patients, portal-based delivery is the standard. Patients cannot be expected to install S/MIME certificates or generate PGP keys. A one-click portal fits the workflow.
Test the recipient experience with a real recipient before choosing the software. Some corporate mail gateways strip portal links or block third-party domains. Testing surfaces those issues before deployment.
Choose Software That Matches the Existing Workflow
The final selection depends on user count, mail platform, compliance requirement, and recipient technical setup. The right software integrates with the platform already in use rather than requiring a switch.
- Team under 10 users, Gmail or Outlook, HIPAA scope, external patients: purpose-built SMTP-relay service.
- Team on Microsoft 365 Business Premium or higher, mixed recipients: native Encrypt button plus optional service for high-volume external.
- Enterprise with S/MIME infrastructure, internal certified users: native S/MIME on Outlook or Workspace Enterprise Plus.
- Large regulated organization, high message volume, DLP requirement: enterprise gateway with policy-based enforcement.
Sibling guides cover related considerations in what is the best email encryption software and HIPAA-compliant email software. For teams pairing email security with patient-facing infrastructure, resources on healthcare website security features add context.
The one-line summary is that the best email encryption software is the one that enforces encryption without breaking the workflow. Choose for enforcement, integration, and BAA coverage before feature lists.
Frequently Asked Questions
For most small practices, a purpose-built HIPAA-compliant SMTP-relay service is the practical choice. It works with the existing Gmail or Outlook account, includes a signed business associate agreement in the base plan, and requires no certificate management. Practices with two to five users typically find the monthly cost lower than upgrading Microsoft 365 or Google Workspace to a tier that includes native encryption. Deployment takes hours rather than weeks.
It depends on the software. Client-side plug-ins work with specific mail clients such as Outlook, Gmail, or Apple Mail. SMTP-relay services work with any provider that supports outbound SMTP configuration, which is most business mail platforms. Enterprise gateways sit inline with the mail server and support the mail platforms they are certified against. Verify compatibility with the specific mail provider before purchasing. Some services also offer a webmail interface for accounts that cannot be configured to route through the service.
Purpose-built HIPAA-compliant services typically price at around $10 per user per month with unlimited sends and a signed BAA included. Enterprise gateways from Cisco, Proofpoint, and Barracuda price higher, often several dollars per user per month plus a base infrastructure cost, and typically require a multi-year contract. Plug-in software varies from free open source PGP tools to per-user monthly fees for commercial encryption plug-ins. Total cost should include administrator time for setup and ongoing maintenance.
It depends on the tier and the compliance requirement. Microsoft 365 Business Premium and higher include the Encrypt button. Google Workspace Enterprise Plus includes S/MIME hosted encryption. Lower tiers do not include either feature. For HIPAA, a signed BAA is available at Business Standard and above for Microsoft 365 and at Business Standard and above for Google Workspace. If the tier has the feature and the BAA, adding software is often unnecessary. If it does not, purpose-built encryption software fills the gap.
Plug-ins run inside the mail client and depend on user action to trigger encryption per message. SMTP relays intercept outbound mail at the transport level and enforce encryption automatically for every send. Plug-ins are simpler to deploy for individual users and offer per-message flexibility. Relays scale better across teams and provide consistent enforcement across all senders. For regulated content where consistency matters more than per-message flexibility, relays are the more reliable model.
Free tools like Mailvelope for PGP or ProtonMail free accounts provide strong encryption but do not sign a business associate agreement covering HIPAA. HIPAA requires a signed BAA with every vendor handling protected health information, which free accounts do not offer. For HIPAA-scoped transmissions, a paid service that includes a BAA is the required path. Free tools can supplement for personal privacy or for correspondents outside the HIPAA scope.
Focus on five factors. Enforcement model, meaning whether encryption applies automatically or requires user action. Recipient experience, meaning how much friction the recipient sees. Business associate agreement, meaning whether the vendor includes a BAA in the base plan. Integration path, meaning how the software fits with the mail platform. Audit and reporting capability, meaning what evidence the software provides for compliance review. A vendor that scores well on all five is typically the safe choice.
