Posted on

O365 Email Encryption Explained for Admins

o365 email encryption guide featured image

🔑 Key Takeaways

  • O365 encryption bundles TLS, at-rest, Purview portal delivery, and templates like Do Not Forward.
  • Purview reaches any inbox via portal; S/MIME decrypts inline where PKI is already deployed.
  • Business Basic and Standard skip the Encrypt button; Business Premium and E3 unlock Purview access.
  • Setup runs PowerShell for Azure RMS, then mail flow rules trigger encryption on keywords or domains.
  • Known limits: no inline branding, S/MIME cert pre-exchange friction, and Outlook 2013 add-in needs.

O365 email encryption is a bundle of features under Microsoft Purview Message Encryption, formerly known as Office 365 Message Encryption. It covers transport encryption, at-rest encryption on Exchange Online, and message-level encryption through a portal delivery model.

This guide walks through the licensing, setup, and known limits. If your tenant needs a supplementary encrypted email path for specific recipient groups or vertical compliance requirements, the vendor-neutral overview is a useful reference.

The audience assumed here is an IT admin or Microsoft 365 tenant owner setting up encryption for the first time or reviewing an existing configuration.

What O365 email encryption covers by default

Every Microsoft 365 tenant gets some encryption automatically. Exchange Online encrypts mail in transit using TLS 1.2 or higher between mail servers when both sides support it. This is the baseline any modern mail provider offers.

Exchange Online also encrypts mail at rest using BitLocker on the underlying storage and per-message encryption keys. This protects mail on disk against a physical theft or storage-layer attack.

The piece that is not on by default is the end-user Encrypt button. On-demand message-level protection requires a licensed feature, either Purview Message Encryption or S/MIME. Both are available on qualifying subscription tiers.

Compliance-covered communication requires the message-level layer in addition to the automatic transport and at-rest layers. Practices sending patient email cannot rely on the default alone. The Encrypt button is what makes the outbound message protected from server to recipient.

Licensing tiers and encryption features

Licensing determines which encryption features are available. The mapping is not obvious from the marketing pages, and admins routinely encounter tenants where the Encrypt button is missing because the license is wrong.

  • Business Basic and Business Standard: TLS and at-rest encryption only, no Encrypt button
  • Business Premium: full Purview Message Encryption including the Encrypt button
  • Enterprise E3: full Purview Message Encryption including the Encrypt button
  • Enterprise E5: Purview plus Advanced Message Encryption for branding, expiration, and revocation
  • Standalone add-on: Azure Information Protection Plan 1 or 2 adds Purview to lower tiers
  • Government: GCC and GCC High tenants have equivalent tiers with same feature mapping

Adding Purview to a Business Basic tenant through Azure Information Protection is technically possible but administratively awkward. Most tenants upgrade to Business Premium instead.

Confirm current licensing through the Microsoft 365 admin center before enabling encryption rules. Microsoft publishes the current feature mapping in the Microsoft Purview Message Encryption documentation.

o365 email encryption in article illustration one

Enabling Purview Message Encryption on the tenant

Enabling Purview requires a few specific steps. On new tenants provisioned after February 2019, Azure Rights Management is enabled by default. On older tenants, an admin needs to enable it through Exchange Online PowerShell.

Connect to Exchange Online PowerShell as a global admin. Run Enable-AadrmService to activate Rights Management on the tenant. Verify the state with Get-AadrmConfiguration. Once active, Purview Message Encryption is available to eligible users.

Assign Azure Information Protection or Message Encryption licenses to users through the admin center. Users see the Encrypt button in the Options ribbon in Outlook the next time they compose a message. Outlook on the web shows the same button in the compose interface.

Test with a compose to an external Gmail or Yahoo address before rolling out to end users. The test verifies the notification email arrives, the portal login works, and the message body renders correctly on the recipient side.

Automating encryption with mail flow rules

Mail flow rules in the Exchange admin center apply encryption automatically based on conditions. This removes the per-message decision from the sender and prevents the plaintext accident.

Common conditions include keyword lists in the subject or body, sender group membership, recipient domain matching, and attachment content patterns. A healthcare practice might trigger encryption on any outbound message to a patient domain list or containing terms like DOB, MRN, or diagnosis.

Configure the rule under Mail flow in the Exchange admin center. Add a new rule. Select Apply Office 365 Message Encryption and rights protection to the message. Choose the encryption template such as Encrypt or Do Not Forward. Save.

Test the rule with a message that matches the condition. Confirm the message is delivered encrypted. Then move on to the next rule. Complex mail flow with many rules can produce order-of-evaluation issues, so keep the rule set small and documented.

Example

A 40-user regional accounting firm moved from Business Basic to Business Premium at $22 per user per month specifically to enable Purview Message Encryption for client tax documents. The admin enabled Azure Rights Management through PowerShell, built a mail flow rule matching outbound messages containing SSN patterns, and set the rule to preview mode for one week. The rule caught 340 messages, six of which were false matches on internal replies. The admin refined the keyword list, moved the rule to enforced mode, and rolled encryption to all client-facing staff.

Comparing Purview Message Encryption to S/MIME in O365

Both Purview and S/MIME are supported in O365. They solve different problems and are often deployed together in the same tenant for different use cases.

Attribute Purview Message Encryption S/MIME
Recipient prerequisites None, portal-based Public certificate installed
Setup complexity Tenant-side only Sender and recipient certificate exchange
Recipient experience Portal login Inline in mail client
Reach to any address Yes Only PKI-equipped recipients
Typical fit Business to consumer Government, defense, enterprise PKI
Branding Portal branded on Enterprise E5 No portal to brand

Purview is the modern default for reaching external recipients on any platform. S/MIME is the preferred path when both sides already run PKI and inline decryption is required by policy.

Practices comparing broader alternatives can review the email encryption category overview alongside the Purview and S/MIME options.

Signing and encrypting in the same message

Signing and encryption are separate operations. Some organizations require both on the same message. O365 supports this through S/MIME with certificates installed in Outlook Trust Center.

Signing uses the sender’s signing certificate to hash the message and encrypt the hash with the sender’s private key. The recipient uses the sender’s public certificate to verify the signature. This proves sender identity and message integrity.

Encryption uses the recipient’s public certificate to encrypt the message content. Only the recipient’s private key can decrypt. Applying both operations on the same message provides authenticity and confidentiality together.

Sign-only, encrypt-only, and sign-and-encrypt are all valid options. Government and financial services organizations often mandate sign-and-encrypt as the default. Healthcare practices sending patient email usually apply encryption without signing because recipients are not verifying certificate chains.

o365 email encryption in article illustration two

Branding the recipient portal experience

Advanced Message Encryption on Enterprise E5 supports portal branding. This changes what an external recipient sees when they open the portal to read the encrypted message.

Configure branding through Exchange Online PowerShell using Set-OMEConfiguration. Parameters include OMEConfiguration for logo URL, background color hex, disclaimer text, portal text, and email text. Multiple configurations can be created and mapped to different mail flow rules.

Branding appears when external recipients open the portal. It does not appear on messages viewed inline in Outlook by internal recipients on the same tenant. Branding does not change the encryption itself. It changes the recipient trust signal.

Practices with a website and consistent visual identity often extend the same branding to the encrypted portal. Redefine Web covers the underlying identity work in the overview of healthcare web design.

Encryption at rest and mailbox-level protection

At-rest encryption in Exchange Online uses BitLocker on the underlying storage. This is transparent to admins and users. Every stored mail item is encrypted at the storage layer.

Customer Key is an option on Enterprise E5 and Advanced Compliance add-ons. It allows the customer to provide their own encryption keys used alongside Microsoft-managed keys. Losing the customer key results in permanent data loss, so key management overhead is significant.

Customer Key is a control for regulated industries that require key custody separate from the platform provider. For most healthcare and business use cases, Microsoft-managed keys are sufficient and much easier to operate.

Microsoft publishes the at-rest encryption architecture in the Microsoft Purview encryption reference. The design is aligned with NIST cryptographic guidance in NIST SP 800-52 Rev. 2.

💡Pro Tip: Run every mail flow rule in preview mode for one week

New encryption rules routinely match more messages than admins expect, catching normal internal replies alongside intended sensitive content. Preview mode logs matches without applying encryption, giving the admin real data on false-positive rates before staff experience broken workflows. Review the message tracking log daily during the preview week. Refine keywords, sender groups, or recipient conditions based on actual matches. Move the rule to enforced mode only after false matches drop below 1 percent of total volume.

Known limitations and workarounds

Every encryption system has limits. Documenting them in advance saves helpdesk hours later.

  • Branding does not appear on messages viewed inline in Outlook, only in the portal view
  • External recipients occasionally lose the portal notification to spam filtering
  • Outlook 2013 requires patching and the Message Encryption add-in for the Protect button
  • S/MIME needs certificate pre-exchange, which is not practical for ad hoc external sends
  • Some compliance frameworks require signing in addition to encryption, doubling the setup work

Workarounds include publishing a short recipient guide, allowlisting the Microsoft notification domain on partner mail servers, and upgrading beyond Outlook 2013. Each mitigation is small individually and adds up to a smoother user experience.

Some organizations supplement O365 encryption with a dedicated email encryption service for specific use cases where the portal experience is not suitable. The two can coexist through mail flow rules that route matching messages through the vertical vendor.

Operational monitoring and audit trails

Encryption is only useful if it stays on. Operational monitoring catches drift, misconfiguration, and user error before they turn into compliance events.

Enable audit log retention for at least six years in the Microsoft Purview compliance portal. HIPAA record-keeping applies to policies and procedures, and the audit log is the evidence trail during any Office for Civil Rights inquiry.

Monitor the Encrypt button usage through Message Trace and Advanced Message Encryption reports. Users who never use the button after a rollout are either not sending sensitive mail or are bypassing the encryption workflow. Both cases warrant follow-up.

Review mail flow rule hits monthly. A rule that produced regular hits then stopped may indicate an upstream change that broke the trigger. Diagnosing early prevents a silent gap in encryption coverage.

Practical rollout plan for a new O365 encryption deployment

A first-time O365 encryption deployment can run in one afternoon for a small tenant or across two weeks for a larger organization. The key stages are the same.

Confirm licenses cover the target user population. Enable Azure Rights Management if not already active. Configure mail flow rules for the initial triggers, such as external mail with specific keywords. Assign encryption-eligible licenses to pilot users.

Pilot with five to ten users for two to three weeks. Collect feedback on the sender workflow and the recipient portal experience. Adjust mail flow rules and branding based on the pilot findings. Roll out to remaining users in staggered groups.

Publish a one-page recipient guide for external partners describing the portal login process. Practices with a broader compliance program should coordinate the rollout with related work such as healthcare website maintenance to keep the whole patient communication stack aligned.

Frequently Asked Questions

Is O365 email encrypted by default? +

Yes for transport and at rest, no for message-level. Exchange Online encrypts mail in transit using TLS between servers when both sides support it. Exchange Online encrypts stored mail at rest using BitLocker on the underlying storage and per-message encryption keys. The Encrypt button for on-demand message-level protection is a licensed feature available on Business Premium and Enterprise tiers, not the default across all Microsoft 365 subscriptions. Compliance-covered communication requires the message-level protection in addition to the automatic transport and at-rest encryption.

Which O365 license do I need for email encryption? +

The end-user Encrypt button requires Microsoft 365 Business Premium, Enterprise E3, Enterprise E5, or Microsoft 365 Apps for enterprise with an Azure Information Protection Plan 1 or 2 add-on. Enterprise E5 adds Advanced Message Encryption for portal branding, custom expiration, and message revocation. Lower tiers such as Business Basic, Business Standard, and Enterprise E1 include TLS and at-rest encryption but not the on-demand Encrypt button. Government tenants use GCC or GCC High equivalents of these tiers. Confirm current licensing through the Microsoft 365 admin center before enabling encryption rules.

How do I set up O365 email encryption in Outlook 2013? +

Outlook 2013 requires a specific patch level and the Message Encryption add-in to display the Protect button on the ribbon. Confirm Outlook is patched to the latest security update. Install the add-in through the Office 365 admin push or manual download. The Protect button then appears in the ribbon on new message composition. Choose Encrypt-Only or Do Not Forward from the dropdown. Modern Microsoft guidance recommends moving beyond Outlook 2013 because extended support ended April 2023. Practices still on Outlook 2013 should plan an upgrade.

How do I add signing to O365 email encryption? +

Signing and encryption are separate operations in Purview. To sign messages, use S/MIME with a signing certificate installed in Outlook Trust Center, Email Security. To encrypt with Purview, click the Encrypt button in the Options ribbon. Both can be applied to the same message. Signing verifies sender identity to the recipient. Encryption protects content confidentiality. Government and financial services organizations often mandate both. Small practices sending encrypted patient email usually only apply Purview encryption without signing because the recipient is not verifying sender identity through certificate chains.

How do I brand the O365 encrypted email recipient portal? +

Advanced Message Encryption on Enterprise E5 supports portal branding. Use Set-OMEConfiguration in Exchange Online PowerShell to configure logo URL, background color, disclaimer text, and portal title. Multiple configurations can be created and mapped to different mail flow rules for different sender groups. The branding appears when external recipients open the portal to read the message. It does not appear on messages viewed inline in Outlook by internal recipients. Branding does not change the encryption itself. It changes what the recipient sees at the sign-in screen.

Are there known flaws in O365 email encryption? +

Security researchers have published analyses of Purview Message Encryption over the years, and Microsoft has responded with updates. The most-discussed finding involved the use of Electronic Codebook mode in earlier implementations, which was replaced with more modern modes. Current Purview implementations use approved cipher modes and align with NIST guidance. No cryptographic system is guaranteed to be flaw-free, and administrators should apply Microsoft patches promptly and monitor Microsoft Security Response Center bulletins. For compliance-covered communication, layered defenses matter more than any single algorithm choice.

Posted on

Email Encryption Programs Explained for Small Practices and Solo Providers

email encryption programs guide featured image

🔑 Key Takeaways

  • Encryption programs split into three groups: native client features, plugins, and gateway services.
  • Free tools like Mailvelope skip the BAA, which 45 CFR 164.308(b) requires for any PHI vendor.
  • S/MIME and OpenPGP are protocols, not products; both leave the subject line fully unencrypted.
  • Gateway services host a portal so recipients skip keys entirely and audit logs come out clean.
  • Start selection with a risk assessment mapping who sends PHI and how often external parties reply.

Email encryption programs protect messages that carry protected health information, financial records, or legal documents as they travel between mail servers and inboxes. The category covers native features built into Outlook and Gmail, browser plugins, and dedicated gateway services that route mail through a policy layer.

Choosing between them looks simple until a practice tries to deploy one across a staff of ten and a rotating list of referral partners. This guide compares the real options, explains what each protocol actually does, and covers the HIPAA rules that shape the decision. For clinics sending patient data every day, a HIPAA-ready encrypted email service removes most of the friction.

The wrong program does not just leak data. It also produces a workflow so awkward that staff bypass it to finish the day. Below is what actually works.

Native client encryption is the starting point for most offices

Outlook, Apple Mail, and iOS Mail all support S/MIME natively. Once an IT team installs an X.509 certificate on the user device, the Encrypt button appears in the compose window and the mail app handles the cryptographic work.

Gmail supports S/MIME on Google Workspace Enterprise and Education plans. Confidential mode is a separate feature that adds expiration and passcode gating but is not true end-to-end encryption. The message still sits on Google servers in a form Google can read.

Microsoft 365 Business Premium and higher include Purview Message Encryption. Staff click Encrypt in the Options ribbon, pick a policy, and Outlook handles the rest. External recipients get a portal link and sign in with Microsoft, Google, or a one-time passcode.

Native features work when everyone uses the same platform. The moment referrals cross between Outlook, Gmail, and older Exchange servers, gaps appear. That is where dedicated encryption for email gateway tools earn their subscription cost.

Free email encryption programs have real limits for HIPAA workflows

Mailvelope, an OpenPGP browser extension, encrypts Gmail and Outlook Web messages from inside the browser. Enigmail forks and GnuPG add PGP to desktop clients like Thunderbird. Both are free and technically strong.

The problem is not the cryptography. It is the operational model. Every recipient needs a keypair, a way to publish the public key, and a habit of protecting the private key. Patients and small billing partners rarely meet any of those requirements.

Free tools also do not sign a Business Associate Agreement. HHS makes the BAA a hard requirement at 45 CFR 164.308(b) for any vendor that processes PHI. Without that document on file, a covered entity carries the compliance risk alone.

Practices that want a free email encryption service for personal correspondence can use these tools safely. For clinical email, the missing BAA rules them out. This is the single most common mistake in small-office HIPAA audits.

email encryption programs in article illustration one

S/MIME and OpenPGP handle key management differently

S/MIME relies on a hierarchy of certificate authorities. A trusted CA issues each user a certificate, mail clients verify certificates against a root store, and revocation lists let administrators kill a compromised key. The model matches how corporate IT already thinks about identity.

OpenPGP uses a decentralized web of trust. Users sign each other keys, publish public keys to a keyserver, and rely on personal verification rather than a central authority. It is powerful for technical users and painful for everyone else.

Neither protocol encrypts the subject line or the To and From headers. Metadata leaks through both. NIST covers key management requirements in Special Publication 800-175B, available at nist.gov/publications.

Practices adopting S/MIME need a plan for certificate renewal, mobile provisioning, and revocation. Practices adopting OpenPGP need a plan for user training. Both are legitimate paths, but neither is a low-effort choice.

Gateway encryption services remove the recipient key problem

A gateway service sits between the practice mail server and the wider internet. When the outbound message matches a policy, the gateway diverts it to a secure web portal and sends the recipient a notification with a link.

The recipient clicks the link, verifies identity through a one-time code or federated login, and reads the message in a browser. No plugin, no certificate, no keypair. This is the pattern behind Microsoft Purview, Google client-side encryption, and dedicated HIPAA services.

Gateway tools also produce audit logs that show when the recipient opened the message, when the link expired, and whether the message was forwarded. Those logs feed directly into the HIPAA risk analysis process.

For practices comparing options, the deciding question is usually recipient experience. If patients reply from phones, gateway wins. If all recipients are corporate IT-managed staff, native S/MIME works. A more detailed best free email encryption solution comparison can help narrow the shortlist.

Example

A billing company in Tampa processing 400 claims a day ran on Mailvelope for outbound mail to insurance carriers. The setup worked until three carrier staff rotated and the new hires had no PGP keys. Twelve claims sat undecrypted for four business days, delaying $86,000 in adjudication. The company migrated to a gateway service with portal delivery and a BAA in the base plan. Recipient staff opened messages in a browser with a one-time code, no keys required. Turnaround on future claims dropped from three days to same-day pickup within the first month.

Deployment paths differ across Outlook, Gmail, and Apple Mail

For Microsoft 365 Business Premium and Enterprise plans, administrators enable Purview Message Encryption in the Exchange admin center, publish rights management templates, and the Encrypt button appears in Outlook for every user. Microsoft documents the full path at learn.microsoft.com/purview.

For Google Workspace, S/MIME requires the Enterprise plan. Administrators upload each user certificate to the admin console, and Gmail activates the encrypt option in compose. Confidential mode works on all plans but is not a HIPAA control by itself.

For Apple Mail on macOS and iOS, users import certificates into the keychain and the Encrypt lock icon appears in the compose window. Mobile device management profiles can push certificates automatically to staff phones.

Deployment complexity grows with the mix of platforms. A practice on a single Microsoft tenant has the easiest path. A practice with staff on Gmail, Outlook, and personal iPhones needs either uniform S/MIME provisioning or a gateway service to bridge the gap.

Comparison of common email encryption programs

The table below shows how the three main categories compare on cost, recipient experience, and HIPAA fit. Practices should treat this as a starting point rather than a purchasing rule.

Program type Cost model Recipient experience BAA available
Native S/MIME (Outlook, Apple Mail) Included in Microsoft 365 Business Premium or Google Workspace Enterprise Requires recipient certificate Through Microsoft or Google BAA
OpenPGP plugin (Mailvelope, GnuPG) Free Requires recipient PGP keypair No
Gateway service (Microsoft Purview, dedicated HIPAA) Per user per month Portal login with one-time passcode Yes, included in HIPAA plans
Confidential mode (Gmail) Included in Google Workspace Passcode or in-Gmail preview Not sufficient alone

Cost per seat rarely tells the full story. Total cost also includes support tickets when recipients cannot open a message, certificate renewal work, and the compliance risk of a program that does not sign a BAA.

email encryption programs in article illustration two

HIPAA rules that shape the encryption program decision

The HIPAA Security Rule at 45 CFR 164.312(e)(1) treats transmission security as an addressable standard. Addressable does not mean optional. It means the practice must implement the safeguard or document why an equivalent alternative works.

HHS guidance points to NIST 800-52 Rev. 2 for TLS baselines and NIST 800-175B for cryptographic key management. Both documents are free at csrc.nist.gov/publications. Auditors expect to see specific citations in the practice policy documents.

The Business Associate Agreement requirement at 45 CFR 164.308(b) covers any vendor that creates, receives, maintains, or transmits PHI. That includes the email encryption vendor. A signed BAA on file before go-live is not negotiable.

Practices building a HIPAA-compliant patient communications program should also review healthcare website security features that carry the same rigor into the web layer where patient forms and portals live.

User training determines whether encryption actually gets used

Buying an encryption program is one line item. Getting staff to use it every time PHI leaves the office is a different project. Training programs that focus on when to encrypt work better than training that focuses on how.

Effective training covers the practical scenarios. A referral letter to another clinic, a claim to a billing partner, an intake form sent back to a patient, a lab report forwarded to a specialist. Each one is a moment where a staff member decides to encrypt.

Policy-based gateway services reduce the training burden by making the decision automatic. If the message contains a subject keyword, a policy trigger, or goes to a domain on the encryption list, the gateway encrypts without a manual click.

  • Train new hires in the first week, not the first month
  • Include encryption steps in the intake and referral workflows
  • Test the process quarterly with a live send to a personal address
  • Document exceptions where encryption was skipped and why
💡Pro Tip: Start with a mail-flow map before comparing programs

List every recipient type the practice mails, how often each replies, and which devices they use. A patient on a phone, a billing partner with rotating staff, and a specialist on hospital IT-managed Outlook each need a different encryption path. Vendor feature checklists tell you nothing if the mail flow map is missing. Once the map exists, compare programs against real recipient behavior, not marketing copy. A three-person clinic and a 30-person billing company almost never pick the same tool.

Cost breakdown across common encryption program tiers

Free tools cost nothing but time. Staff spend hours provisioning keypairs, and IT spends hours resolving recipient errors. For a two-person clinic that sends encrypted mail twice a week, that math might still work.

Microsoft 365 Business Premium runs about $22 per user per month and includes Purview Message Encryption. Google Workspace Enterprise Standard starts higher but includes S/MIME and client-side encryption controls.

Dedicated HIPAA email services typically price between $5 and $15 per user per month with the BAA included. That range covers the encryption itself, the portal, audit logs, and support. For a five-person office, the total sits around $50 to $75 a month.

Practices that also invest in HIPAA-compliant website design and encrypted email together get consistent controls across the patient-facing surface and the back-office communication layer.

Migration paths from a free tool to a HIPAA-ready service

Practices already using Mailvelope or a similar free tool can migrate in a phased plan. Start by identifying which mail flows carry PHI and which do not. Only the PHI flows need the paid service.

Next, run the new service in parallel for two weeks. Staff send a copy of each encrypted message through both tools and confirm the recipient can open it. This catches configuration errors before the free tool gets turned off.

After the parallel period, publish a written cutover date, decommission the free tool, and export any archived messages the practice needs to retain. HIPAA retention rules at 45 CFR 164.316(b)(2) require six years for policy documentation.

Services designed for healthcare use, including a HIPAA-compliant secure email service, plug into existing Gmail or Outlook accounts and remove the recipient key problem in a single onboarding step.

Ongoing controls that keep an encryption program compliant

Encryption controls decay over time. Certificates expire, staff turn over, recipient domains change hands, and vendors update their portals. A control that worked last year may not work this year.

NIST recommends quarterly verification of encryption controls as part of the risk analysis process. A simple test send to an external address, review of the message headers, and confirmation of the portal login flow catches most drift issues.

  • Review the BAA renewal date with each vendor annually
  • Rotate S/MIME certificates before expiration, not after
  • Audit access logs quarterly for portal-based services
  • Update the risk analysis document after any material change
  • Test disaster recovery for encrypted mail at least once a year

Practices that pair encryption controls with strong healthcare website maintenance keep the entire patient communications stack aligned. Encryption is one layer. The web layer, the endpoint layer, and the training layer all need the same maintenance rhythm to hold up under audit.

The HHS Office for Civil Rights publishes enforcement actions at hhs.gov/hipaa/enforcement. Reading the recent cases shows which encryption gaps trigger investigations. Almost every settlement includes a missing or outdated risk analysis.

Frequently Asked Questions

What counts as an email encryption program under HIPAA? +

HHS does not certify specific products. The rule requires that PHI in transit be protected against unauthorized access, and the guidance points to NIST 800-52 Rev. 2 for TLS and NIST 800-175B for cryptographic key management. Any program that meets those baselines, backs the deployment with a signed Business Associate Agreement, and produces retrievable audit logs meets the technical safeguards standard at 45 CFR 164.312(e)(1). Certification claims from vendors are marketing, not regulation.

Do free email encryption programs work for a small medical office? +

For personal use they work fine. For a practice sending PHI they usually do not. Free tools like Mailvelope or ProtonMail free tier lack a signed BAA, which HHS requires for any vendor that creates, receives, maintains, or transmits PHI on the covered entity behalf. A single missed BAA can turn a data incident into a reportable breach under the Breach Notification Rule at 45 CFR 164.400-414. Paid HIPAA services include the BAA in the base plan.

Is TLS encryption alone enough for HIPAA email? +

TLS protects mail while it moves between two servers that both support it. Opportunistic TLS drops to plaintext when the receiving server does not negotiate a session. For internal mail between two Google Workspace or Microsoft 365 tenants that both enforce TLS 1.2 or 1.3, this is usually fine. For mail leaving the practice to unknown recipients, opportunistic TLS is not sufficient, and the office needs a policy engine that forces encryption or diverts to a secure portal.

What is the difference between S/MIME and PGP for daily use? +

S/MIME uses certificates from a public certificate authority and works natively in Outlook, Apple Mail, and iOS Mail. IT teams can push certificates through a mobile device management profile. PGP uses a web of trust model where users exchange public keys directly or through a keyserver. PGP is more flexible for cross-platform use but requires more user training. Neither protocol encrypts the subject line, and both fail silently when a recipient key expires.

Can I use Outlook or Gmail encryption without buying anything extra? +

Outlook 365 Business Premium includes Microsoft Purview Message Encryption and the Encrypt button in the ribbon. Gmail confidential mode adds message expiration and passcode gating but is not end-to-end encrypted. Google Workspace Enterprise Plus offers true client-side encryption with customer-managed keys. Free consumer Gmail and Outlook.com accounts do not qualify for a Business Associate Agreement and cannot be used to send PHI regardless of whether a confidential mode toggle exists in the interface.

How do I test whether my encryption program is actually working? +

Send a test message to a personal address on a different mail provider, open the message headers, and look for the Authentication-Results and Received headers. TLS negotiation appears as TLS=version in the Received line. For portal-based encryption, the recipient should hit a login page rather than see the message body inline. NIST recommends quarterly verification of encryption controls as part of a broader risk analysis under 45 CFR 164.308(a)(1)(ii)(A).

What happens when a recipient cannot open an encrypted message? +

Portal services fall back to a one-time passcode sent to the recipient inbox, which the recipient enters on the portal to read the message. S/MIME and PGP have no fallback. The message either decrypts with the correct private key or shows as unreadable ciphertext. This is one of the biggest reasons small practices move from certificate-based encryption to gateway services. A single unreadable prescription authorization can delay patient care by a full day.

Posted on

What Is an Encrypted Email

what is an encrypted email guide featured image

🔑 Key Takeaways

  • An encrypted email is scrambled ciphertext only the recipient private key can unlock.
  • Transport encryption protects the wire; message encryption protects the stored copy.
  • Asymmetric keys let senders encrypt with a public key only the private key can decrypt.
  • HIPAA, GLBA, and similar rules demand verified encryption plus a signed vendor BAA.
  • Portal delivery beats S/MIME for one-off patient sends because no keys change hands.

An encrypted email is a message that has been scrambled with a cryptographic key so only the intended recipient can read it. The sender applies encryption, the message travels as ciphertext, and the recipient decrypts it back to readable form.

This matters because standard email was designed in the 1980s without built-in encryption. Anyone with access to the network path or the mail server could read the content. Encryption fixes that gap.

Understanding what an encrypted email is starts with two questions. What is being encrypted, and who holds the keys?

Encryption Converts a Message into Unreadable Ciphertext

Encryption takes plaintext, the readable message, and applies a mathematical function called a cipher along with a key. The output is ciphertext, a sequence of bytes that looks like random noise to anyone without the key.

Modern email encryption uses algorithms like AES-256 for symmetric encryption and RSA-2048 or higher for asymmetric encryption. These are the same algorithms that protect online banking, government communications, and enterprise data storage.

The recipient reverses the process. They apply the matching decryption function with the correct key, and the ciphertext becomes readable plaintext again. Without the key, the ciphertext is effectively random data that cannot be reversed by brute force with current computing.

The security of the whole system depends on protecting the key. If an attacker steals the recipient private key, the attacker can decrypt every message sent to that recipient. Key management is why encrypted email deployments require careful setup.

Two Layers of Email Encryption Exist

Email encryption operates at two layers. The transport layer protects the connection between mail servers. The message layer protects the content of the message itself.

Transport encryption uses TLS, the same protocol that protects HTTPS websites. When two mail servers connect, they negotiate a TLS handshake and encrypt the traffic in flight. An observer on the network sees only ciphertext.

Message encryption uses S/MIME, PGP, or a portal-based service. The sender encrypts the message content before it leaves their client. The mail server stores ciphertext. Only the recipient with the matching key can decrypt.

The difference matters for compliance. Transport encryption protects the connection but not the stored copy. Message encryption protects both. For regulated content, message encryption is the standard because it removes the mail server from the trust boundary.

what is an encrypted email in article illustration one

TLS Is the Default Transport Encryption for Modern Email

Every major mail provider, Gmail, Outlook, Yahoo, Apple, and the rest, uses TLS by default. When a sending server contacts a receiving server, it attempts a TLS handshake. If both sides support it, the connection is encrypted.

The user does not enable TLS. The client shows a padlock icon when it is in effect. Gmail shows a gray padlock for TLS, green for S/MIME, red for unencrypted.

TLS has a critical weakness. It is opportunistic. If the receiving server does not support TLS, the sending server delivers the message in plaintext by default. The sender may not see any warning, and the client padlock may still show as green in the Sent folder because the initial hop was encrypted.

This behavior means TLS alone cannot guarantee an encrypted send. For regulated content, opportunistic TLS is not sufficient. According to NIST SP 800-45, verified end-to-end encryption is required for sensitive email.

S/MIME Uses Certificates from a Trusted Authority

S/MIME, or Secure/Multipurpose Internet Mail Extensions, is the built-in message encryption standard for Outlook, Apple Mail, and Gmail on Workspace Enterprise. It uses X.509 certificates issued by a trusted certificate authority.

Each user has a public key certificate that is shared with correspondents and a private key that stays local. When someone sends an encrypted message, they encrypt with the recipient public key. Only the recipient private key can decrypt.

Signing is a separate function that uses the same certificates. A signed message includes a signature computed with the sender private key. Any recipient can verify the signature using the sender public key. This proves the message came from the claimed sender and was not modified in transit.

S/MIME suits organizations that can coordinate certificate deployment across all users. Certificate authorities such as DigiCert, Sectigo, and IdenTrust issue certificates for annual fees between roughly $20 and $100 per user.

Example

A cardiologist sends a patient discharge summary to a referring family physician on a small independent practice mail server. Native TLS fails because the receiving server disabled TLS after a misconfigured update. Without a verified method in place, the message would have sent in plaintext. The cardiologist uses a portal-based service that detects TLS unavailability and delivers a browser-based link instead. The referring physician clicks, enters a one-time passcode by email, and reads the summary without any certificate or software installation on their side.

PGP Uses Locally Generated Keys and Personal Trust

PGP, or Pretty Good Privacy, is the open-source alternative to S/MIME. It uses public-private key pairs generated locally by the user. There is no certificate authority. Users trust each other keys directly.

The sender exchanges public keys with the recipient through a side channel, verifies the key fingerprint, and then encrypts messages with the recipient public key. The recipient decrypts with their private key. The private key is protected with a passphrase.

PGP has stronger algorithmic flexibility than S/MIME but a steeper learning curve. Recipients unfamiliar with key exchange will not decrypt a PGP message without setup. Thunderbird, Mailvelope, and GPG Suite provide user interfaces that simplify most of the workflow.

PGP suits technical correspondents, security researchers, journalists working with sources, and internal teams that can standardize on key exchange procedures. It is the wrong tool for reaching general external recipients like patients.

what is an encrypted email in article illustration two

Portal-Based Encrypted Email Removes Recipient Setup

Portal-based services solve the recipient friction problem. The sender writes and sends from their normal client. The service intercepts the message, encrypts it, and delivers over TLS when supported or through a portal link when TLS is unavailable.

Mailhippo works this way. The recipient receives a notification email with a click-to-open link. They enter a one-time passcode sent to their phone or email, and they read the message in a browser. No account creation. No key management. No software install.

For HIPAA, the service includes a signed BAA in the base plan and logs every message access. This is the model most healthcare organizations use because patients and external providers cannot be expected to manage keys or install plug-ins.

The tradeoff is that the encryption happens at the service, not on the sender client. For most healthcare and business contexts, this is acceptable because the service holds a BAA and provides audit logs. For extremely sensitive content, S/MIME with local keys remains the highest-assurance model.

Encrypted Email Is Required for Regulated Content

HIPAA, the US health privacy law, requires encryption in transit for any electronic transmission of protected health information across public networks. The rule is technology-neutral, but auditors expect a verified encryption method with a signed business associate agreement.

GLBA, the financial-services privacy law, imposes similar transmission requirements for customer financial data. PCI DSS covers card data. State privacy laws such as CCPA and NYDFS add their own requirements.

Native TLS in Gmail or Outlook does not automatically meet these standards because of the opportunistic fallback. A HIPAA-compliant service closes the gap by refusing to send in plaintext and delivering through a portal fallback when TLS is unavailable.

For healthcare organizations, this pairs with broader compliance work covered in healthcare website security features and healthcare marketing services.

💡Pro Tip: Protect Private Keys Like Passwords

Modern encryption algorithms are resistant to brute force with current computing. The practical attack surface is not the cipher, it is the private key. Store S/MIME private keys in hardware-backed storage like a smart card or hardware security module when possible. Use strong passphrases on PGP private key files. Revoke certificates and keys promptly when a device is lost or staff leave. Log key access for anomaly review.

Recipient Experience Varies by Encryption Method

The recipient sees a different experience for each method. TLS is invisible when it works. The message arrives in the inbox looking normal. Nothing signals that transport encryption was applied.

S/MIME shows a lock icon in supported clients. The client decrypts using the recipient certificate and displays the plaintext inline. In an unsupported client, the recipient sees ciphertext or an unopenable attachment.

PGP requires a supported client with the recipient private key installed. Thunderbird, Mailvelope, and GPG Suite decrypt inline. Without the tools, the recipient sees a PGP-formatted block of ciphertext.

Portal-based services deliver a notification email with a click-to-open link. The recipient clicks, authenticates with a one-time passcode, and reads in a browser. This is the lowest-friction path for any recipient without prior setup.

Key Management Is the Practical Security Boundary

The mathematics of modern encryption are resistant to brute force with current computing. AES-256 and RSA-2048 are considered secure through the near future. The practical attack surface is key management, not cipher-breaking.

An attacker who steals a private key can decrypt every message sent to that recipient. Key protection includes strong passphrases on private keys, hardware-backed key storage such as smart cards or hardware security modules, and prompt revocation of keys when a device is lost or an employee leaves.

  • Store private keys in hardware-backed storage when possible.
  • Use strong passphrases on private key files.
  • Revoke certificates and PGP keys promptly on departure or device loss.
  • Log and monitor key access for anomalous activity.

For portal-based services, the equivalent controls are account access management, multi-factor authentication, and audit logging. The service holds the encryption keys, so the sender must trust the service and verify the audit trail.

Choose an Encryption Method Based on Recipient and Content

The right encryption method depends on the recipient technical setup and the content sensitivity. Match the method to the practical situation.

  • Internal team, no regulated content: TLS is sufficient.
  • Internal team, regulated content, certified users: S/MIME.
  • Technical external correspondents, high sensitivity: PGP.
  • External recipients without technical setup, regulated content, HIPAA scope: portal-based service.

For deeper coverage on specific methods, see the sibling guides what does encrypted email mean, what does it mean to encrypt an email, and what happens when you encrypt an email in Outlook.

The one-line summary is that an encrypted email is a message only the intended recipient can read. The method behind that outcome shapes the setup cost, the compliance posture, and the recipient friction. Choose deliberately.

Frequently Asked Questions

How can I tell if an email I received is encrypted? +

Look at the message header or the indicator in your mail client. Gmail shows a padlock icon on encrypted messages, green for S/MIME, gray for TLS, red for unencrypted. Outlook shows a padlock or a lock icon when S/MIME or Purview Message Encryption is in use. Portal-based services deliver a distinct notification email that says a secure message is waiting behind a link. If none of these indicators are present, the message likely relied on opportunistic TLS or was sent in plaintext.

Are encrypted emails safe to store on the mail server? +

Yes, when the encryption method is message-level rather than transport-only. S/MIME and PGP produce ciphertext that the mail server stores without being able to decrypt. Portal-based services store content on the vendor infrastructure with access controls. TLS does not qualify because it only protects the transport; once the message reaches the server, it sits as plaintext in storage. For HIPAA-relevant retention, message-level encryption is the standard.

Can encrypted emails be intercepted? +

An encrypted email can be intercepted in the sense that ciphertext can be captured. Without the decryption key, the intercepted content is unreadable. Modern encryption algorithms including AES-256 and RSA-2048 are considered infeasible to break with current computing. The practical risk is not brute-forcing the cipher; it is stealing the private key from the recipient device or fooling the sender into encrypting to an attacker key. Key management is the security-critical part of an encrypted email deployment.

What is the difference between an encrypted email and a password-protected email? +

An encrypted email uses cryptographic algorithms to make the content unreadable without a decryption key. A password-protected email typically wraps the message or an attachment in a container that requires a password to unlock. The password approach is weaker because passwords are shared through side channels, often the same email thread. Encrypted email uses key pairs or trusted portals to authenticate without exchanging shared secrets through the message itself.

Do I need to encrypt every email? +

No. Encryption is a technical control matched to a specific risk. Routine internal correspondence, non-sensitive external messages, and public communications do not need message-level encryption. TLS provides adequate protection for the vast majority of email in flight. Encryption becomes necessary when the content is regulated, such as PHI, financial account information, or personally identifying data. Apply encryption selectively based on content sensitivity, not universally to every message.

Can I encrypt an email attachment separately from the message? +

Yes. Some workflows encrypt only the attachment, typically a document containing sensitive data, and send the encrypted file with a plaintext message body. The recipient decrypts the attachment separately using a password or key. This is a partial approach; the message body still travels in the clear. For regulated content, encrypt the message body itself, either through S/MIME, PGP, or a portal-based service that treats attachments as part of the encrypted payload.

How long does an encrypted email stay secure? +

The encryption stays secure for as long as the underlying algorithm is considered resistant to attack and the private key stays private. AES-256 and RSA-2048 or higher are expected to remain secure through at least the current decade. Post-quantum cryptography is an active area of research because quantum computers may eventually break RSA. For today, the practical time horizon of a well-encrypted email is measured in decades, provided the recipient private key is not stolen.

Posted on

What Are Encrypted Emails and How They Actually Work

what are encrypted emails guide featured image

🔑 Key Takeaways

  • Encrypted email means ciphertext in transit and at rest, decoded only by the recipient's key.
  • Gmail auto-encrypts transport via TLS, but true content encryption needs S/MIME on Enterprise Plus.
  • S/MIME forwards re-encrypt per recipient; portal messages usually can't be forwarded at all.
  • You get encrypted mail when a provider, lawyer, or insurer applies encryption to protect the thread.
  • Encryption stops interception, not phishing or malware. Layer MFA and endpoint protection on top.

Encrypted emails are messages you cannot read without the right key or credential. The concept is simple. The specific methods, recipient experiences, and edge cases behind it are where confusion starts.

This guide covers what encrypted emails actually are, how Gmail and Outlook handle them, whether they can be forwarded, and how to tell a legitimate encrypted message from a phishing attempt. For senders evaluating an encrypted email service, the recipient experience is often more important than the technical specs.

Read the sections in order. Each one covers a specific question users typically ask.

Encrypted Emails Turn Message Content Into Unreadable Ciphertext

An encrypted email is a message where the content has been transformed into ciphertext that only the intended recipient can decode. Encryption applies at one or more layers of the email delivery path.

Transport encryption using TLS protects the message between mail servers. The message body is readable at the servers themselves but not on the network between them.

Content encryption using S/MIME or PGP protects the message body itself. The message stays encrypted at the recipient mail provider until decrypted by the recipient with a matching key.

Portal-based encryption stores the message on a vendor server and delivers a sign-in link. The recipient authenticates to the vendor portal and reads the message in a browser.

Each method covers different threats. Best practice layers TLS with content or portal encryption rather than relying on transport alone.

Gmail and Encrypted Email Behavior

Gmail encrypts messages automatically for transport but not for content by default. Understanding the difference clears up common questions about Gmail encryption.

Google Workspace uses TLS 1.2 or 1.3 when connecting to receiving servers that support it. Standard consumer Gmail does the same. This transport encryption prevents interception on the network path.

Content encryption in Gmail requires Google Workspace Enterprise Plus for S/MIME. The administrator provisions certificates for users and enables encrypted sending inside the workspace policy.

Add-ons like FlowCrypt and Mailvelope bring PGP-based encryption to any Gmail account. The user installs the browser extension, generates a key pair, and encrypts messages one at a time.

Google Confidential Mode is not content encryption. It adds expiration and access controls but Google retains access to the underlying content. Practices should not treat Confidential Mode as HIPAA-compliant encryption.

what are encrypted emails in article illustration one

Outlook and Encrypted Email Behavior

Outlook supports S/MIME natively across Microsoft 365 Business Premium and higher tiers. The certificate installs into the local certificate store and enables signed and encrypted sending.

Microsoft Purview Message Encryption adds a policy-based layer that triggers on rules configured by the administrator. External recipients receive a portal link and sign in with Microsoft, Google, or a one-time passcode.

Third-party add-ins from Virtru, Mailhippo, and other vendors add another encryption path that works across Microsoft 365 tiers without requiring Business Premium.

Outlook shows encrypted messages with a padlock icon in the header. The message properties confirm the encryption method and certificate details.

Users can verify a sent message was encrypted by checking the Sent Items folder for the same padlock indicator. Related coverage in encrypted emails Outlook covers the specific configuration steps.

Forwarding Encrypted Emails Changes the Encryption Context

Encrypted emails can sometimes be forwarded but the encryption context often changes depending on the method and sender policy.

S/MIME messages forwarded from Outlook typically get decrypted with the original recipient key and re-encrypted for the forward recipient if forwarding is permitted. The forward recipient must have a matching certificate or the message will not decrypt on their end.

Portal-based encrypted messages usually cannot be forwarded because the recipient holds a portal access link, not the underlying content. Some vendors allow the recipient to share the portal link with another user, subject to sender policy.

Sender-set rights management controls decide what forwarding is allowed. Microsoft Purview Message Encryption supports Do Not Forward as a rights template that blocks forwarding entirely.

Practices sending regulated content should default to Do Not Forward and enable forwarding only when the sender explicitly permits it. Blanket forwarding permissions undermine the sender control that encryption otherwise provides.

Example A patient received a Purview-encrypted email from her cardiologist with lab results. She forwarded the message to her adult son for a second opinion, expecting the encryption to travel with the message. The sender had applied the Do Not Forward template, so her Outlook client blocked the forward attempt with a rights management warning. She instead saved the PDF attachment locally, opened a separate encrypted email through Mailhippo to her son, and attached the PDF. The chain preserved sender control while still reaching the trusted second reader.

Encrypted Email Comparison Across Common Methods

The table below compares four common encryption methods across the fields that decide recipient experience and security posture.

MethodRecipient StepsContent Encrypted at RestForwarding BehaviorTypical Use
TLS Transport OnlyNoneNoFreely forwardableStandard business email
S/MIMECertificate installedYesRe-encrypted per recipientEnterprise between certificate holders
PGPKey installedYesRe-encrypted per recipientTechnical users, journalists
Portal EncryptionClick link, sign inYes on vendor serverUsually blockedHealthcare, finance to external recipients

Real-world deployments often layer TLS with either content or portal encryption. The layered approach covers more threats than any single method alone.

Why You Might Be Getting Encrypted Emails

Recipients often receive encrypted emails without expecting them. The reasons are usually straightforward.

A healthcare provider sending PHI encrypts to protect patient information under HIPAA. Test results, appointment details, and billing statements often arrive encrypted.

A financial services firm sending account details encrypts to protect against fraud and to meet GLBA requirements. Statements, tax documents, and account changes often arrive encrypted.

A legal counterparty sending privileged material encrypts to protect attorney-client privilege. Settlement documents, court filings, and case correspondence often arrive encrypted.

An employer sending HR content encrypts to protect employee records. Offer letters, tax forms, and performance reviews often arrive encrypted.

Legitimate encrypted messages come from known senders and route through recognizable vendors like Microsoft, Google, Mailhippo, Virtru, or Barracuda. Suspicious encrypted messages from unknown senders should be treated as potential phishing.

what are encrypted emails in article illustration two

Phishing Increasingly Mimics Encrypted Email Delivery

Phishing campaigns increasingly use fake encryption portals to harvest credentials. Recognizing the pattern reduces the risk of falling for one.

Fake encrypted email notifications typically arrive from unfamiliar senders and reference a document you did not expect. The link goes to a domain that looks similar to a real vendor but does not match.

The fake portal asks for the email password or a Microsoft account sign-in. Legitimate portals ask for a one-time passcode sent to your address or a sign-in with an existing account you recognize.

The CISA phishing guidance covers common patterns and what to do if you suspect a phishing attempt.

Best practice verifies the sender through a separate channel before clicking any encrypted email link from an unfamiliar source. A phone call to a known number is worth thirty seconds of caution.

Are Encrypted Emails Actually Safe

Encrypted emails are safer than unencrypted emails against interception and provider-side access. They do not defend against every threat.

Phishing attacks that steal mail credentials bypass encryption by giving the attacker legitimate access to the inbox. The attacker sees the plaintext through the same interface as the real user.

Malware on the sender or recipient device captures plaintext before encryption or after decryption. Keyloggers, screen scrapers, and clipboard monitors all bypass the encryption layer.

Weak recipient portal passwords make encryption meaningless. A message encrypted with AES-256 protected by a password of qwerty is not protected in any meaningful sense.

Real security posture layers encryption with multi-factor authentication, endpoint protection, phishing training, and incident response. Each layer covers threats the others miss.

💡Pro Tip: Default to Do Not Forward for regulated contentEncrypt-Only lets recipients forward, print, and copy freely once decrypted, which defeats sender control for regulated PHI, legal documents, and privileged material. Set Do Not Forward as the default template on any mail flow rule that fires for clinical, legal, or HR content. Recipients who genuinely need to share the content can request a fresh encrypted send to the additional party, which keeps the audit trail intact and preserves rights management on the second thread.

Shared Mailboxes and Encrypted Messages

Shared mailboxes complicate encrypted email handling. The complications matter more for regulated content than for general business email.

S/MIME-encrypted messages in a shared mailbox require the mailbox owner or delegated user to have a matching certificate. If the certificate is tied to an individual account, other delegates cannot decrypt.

Portal-encrypted messages in a shared mailbox arrive as notification emails. Anyone with credentials to the portal can sign in and read the content. This model preserves recipient anonymity at the cost of audit clarity.

Best practice restricts encrypted PHI or sensitive content to named individual mailboxes rather than shared ones. The audit trail stays clean, and inadvertent access by delegated users does not happen.

Practices with shared inboxes for reception or billing should route PHI through a named clinical inbox and reserve the shared inbox for non-PHI communication.

Related Encrypted Email Reading

Encrypted emails cover multiple adjacent topics. The companion guides below add depth on specific questions.

Users trying to open a specific encrypted message can review how to open encrypted emails in Outlook and how to view encrypted emails. Both guides cover the recipient-side workflow across common vendors.

Senders configuring encrypted sending in Outlook benefit from encrypting emails in Outlook. The guide covers S/MIME setup and the ribbon controls.

Users comparing encryption providers can review ProtonMail encrypted email for a specific vendor deep-dive. ProtonMail illustrates a pure E2EE approach.

Broader coverage of whether standard email is encrypted at all lives in are emails encrypted. The guide covers the transport-only default across major providers.

Where Redefine Web Fits the Healthcare Email Stack

Encrypted email covers the message pipeline. Website contact forms, patient portals, and marketing platforms carry PHI that must reach the same encryption controls.

A contact form on the practice website that emails PHI to a generic Gmail address bypasses every encryption control the practice buys. The submission arrives unencrypted, and the audit trail does not exist.

Redefine Web builds HIPAA-aware healthcare websites and integrates the forms with encrypted delivery paths. Details on the healthcare marketing agency practice cover the surface area that sits alongside encrypted email.

A closed-loop review across website, forms, email, and portal reduces the risk that a PHI leak lands in an unencrypted channel by mistake.

Mailhippo fits senders that want encrypted email delivery with the BAA, audit logging, and simple recipient experience in one product. The service integrates with existing Gmail or Outlook accounts and keeps the recipient path to a single click for most messages, whether the recipient is on Gmail, Outlook, or another provider. Understanding what encrypted emails are makes the vendor conversation shorter and the buying decision more defensible.

Posted on

Smarsh Email Encryption Explained for Compliance Teams

smarsh email encryption guide featured image

🔑 Key Takeaways

  • Smarsh bundles encryption with archiving and supervision for FINRA, SEC, and HIPAA workflows.
  • The encryption piece uses TLS transport plus portal delivery with a one-time passcode fallback.
  • Onboarding runs four to eight weeks through a Smarsh implementation team, not self-service.
  • Broker-dealers value the multi-channel supervision; small practices find it heavier than needed.
  • Smarsh holds SOC 2 Type II and signs BAAs; portal deliverability is the main recipient friction.

Smarsh email encryption is one part of a wider compliance platform rather than a standalone encryption product. Firms in financial services, healthcare, and insurance use it when they need encryption, archiving, and supervision under one contract.

This guide covers what Smarsh encryption actually does, how the platform is set up, and when a lighter encrypted email service covers the same compliance ground with less overhead. Comparing honestly matters because the fit varies with firm size and use case.

The audience for this article is a compliance officer, IT lead, or practice manager evaluating Smarsh against alternatives. The details focus on functional behavior rather than sales positioning.

What Smarsh email encryption actually is

Smarsh is a communications compliance company that acquired Actiance in 2017 and expanded through further acquisitions to become a broad archiving and supervision vendor. Email encryption sits inside the Smarsh Professional Archive and Enterprise Archive product families.

The encryption piece is not sold as a standalone product for most customers. Firms that buy Smarsh for encryption alone are rare. The typical purchase includes archiving, supervision, and encryption together to satisfy a regulatory obligation that spans all three.

Transport encryption uses TLS 1.2 or higher between mail servers. Message-level encryption uses a portal delivery model where the recipient reads the message inside a Smarsh-hosted web view after authenticating with a one-time passcode.

The architecture is designed for compliance-heavy environments where messages must be retained, searchable, and reviewable by a supervisor. Encryption alone does not require this depth of infrastructure, which explains the fit question for smaller firms.

Which regulations Smarsh encryption is designed to satisfy

The primary compliance drivers for Smarsh customers are FINRA Rule 3110, SEC Rule 17a-4, and HIPAA. Each of these regulations imposes obligations that extend beyond encryption itself.

  • FINRA Rule 3110 requires broker-dealers to supervise associated persons and review certain communications
  • SEC Rule 17a-4 requires certain records to be retained in a non-erasable, non-rewritable format for defined periods
  • HIPAA requires encryption of protected health information in transit and at rest, plus audit logging and access controls
  • State privacy laws such as CCPA add breach notification and data subject rights obligations on top of federal rules

A pure email encryption service covers HIPAA on its own. Adding supervision and non-rewritable archiving is what makes Smarsh a fit for a broker-dealer rather than a therapy practice.

Compliance officers evaluating Smarsh should map their specific regulatory obligations against the platform’s features rather than buying the full stack by default. A single-rule requirement rarely justifies the full stack.

smarsh email encryption in article illustration one

Smarsh email encryption setup end to end

Smarsh onboarding is not a self-service signup. A prospective customer talks to a sales engineer, scopes the deployment, and works with a Smarsh implementation team through provisioning.

The customer connects their email platform to Smarsh through mail flow rules on Exchange Online, Google Workspace, or on-premises Exchange. The connection routes outbound messages through Smarsh gateways for policy inspection.

Encryption policies are defined using keyword lists, sender groups, subject line patterns, or attachment content matching. A common example is triggering encryption on any outbound message containing an account number pattern or specific medical terminology.

Once policies are active, supervisors are configured for review queues, archive retention is set to match the regulation, and users are onboarded. A typical mid-sized firm rollout runs four to eight weeks. Microsoft’s own Exchange mail flow rule documentation is published in the Microsoft Exchange documentation.

Accessing a Smarsh encryption account as an end user

Two different login experiences exist. Firm employees log into a Smarsh admin portal to manage archives, run searches, or handle supervision queues. Message recipients log into a separate portal to read encrypted messages.

Firm users receive credentials from their internal compliance administrator during onboarding. Password resets and access changes are handled through the firm’s admin, not through Smarsh support directly. This model protects segregation of duties.

Message recipients receive an email notification with a secure link. Clicking the link opens a login prompt on the Smarsh portal domain. First-time recipients set a passcode. Return recipients enter the credentials they set previously.

Recipients who lose the passcode can request a reset from the same portal. The reset flow uses email verification back to the original recipient address, which is the standard model for portal-based encrypted delivery across most vendors.

Example A 15-advisor RIA subject to FINRA Rule 3110 supervision picks Smarsh for archive, supervision, and encryption under one contract. Onboarding runs six weeks with an implementation engineer scoping mail flow rules across Microsoft 365 and Bloomberg chat. First-year cost lands near $52,000. A four-clinician therapy office next door evaluates the same platform, sees the same six-week timeline, and switches to a dedicated encrypted email service with a BAA. Setup finishes in three hours at $2,400 annually. Both firms match their regulatory footprint.

How Smarsh compares to lighter encrypted email services

The comparison matters most for practices that need encrypted email without the wider supervision and archiving stack. The tradeoffs are real, and neither option is universally better.

CapabilitySmarshDedicated encrypted email service
TLS transport encryptionYesYes
Portal-based message encryptionYesYes
FINRA-grade archiving and supervisionYes, core featureNot the primary use case
Business associate agreement for HIPAAYes, on requestYes, in base subscription
Typical onboarding timeFour to eight weeksSame day to one week
Fit for solo practice or two-person firmHeavy for the use caseWell-matched

A broker-dealer that must supervise communications across email, chat, and social media benefits from Smarsh as one contract covering all channels. A four-clinician therapy office that only needs encrypted email to patients does not.

The email encryption service category has matured to the point where dedicated products handle HIPAA well without archiving depth that a small practice will never use.

Smarsh email encryption reviews from compliance teams

Reviews from Smarsh customers cluster around a few consistent themes. The archiving and supervision are strong. The encryption is a supporting feature rather than a headline capability. Support quality depends on the tier.

Broker-dealers and registered investment advisers give positive reviews on the ability to search across email, chat, social, and voice channels from one interface. FINRA examiners are familiar with the platform, which reduces friction during exams.

Healthcare customers on the mid-market end of the range report solid HIPAA coverage. Smaller practices sometimes report that the platform’s breadth is more than they need for encrypted patient communication alone.

Onboarding time is the most common negative theme in reviews. A multi-week implementation is normal for a compliance platform of this scope, but it can be a surprise to teams expecting a faster start.

smarsh email encryption in article illustration two

Deliverability and spam concerns with portal-based encryption

Portal-based encryption sends the recipient a notification email with a link to a secure portal. This model is standard across Smarsh, Microsoft Purview Message Encryption, and most enterprise-grade encrypted email services.

The deliverability question is whether the notification lands in the recipient inbox. Aggressive spam filters on the recipient side occasionally flag portal notifications because the message is short, contains a login link, and comes from a domain the recipient may not recognize.

The fix is on the recipient side. A mail flow rule that allowlists the Smarsh notification domain resolves the flagging. Firms with a large recipient base sometimes publish a one-page guide for external counterparties explaining the setup.

Sender-side deliverability issues almost always trace back to DMARC, SPF, or DKIM misconfiguration on the customer’s own domain. The National Institute of Standards and Technology publishes email authentication guidance in NIST SP 800-177 Rev. 1.

Signing the business associate agreement for HIPAA coverage

Healthcare customers using Smarsh for HIPAA-covered communications need a signed business associate agreement in the compliance file. Smarsh signs BAAs with covered entities, but the process is not automatic on sign-up.

The BAA is requested through the Smarsh account team during onboarding. The signed document is returned to the customer for records retention. HIPAA does not accept a BAA that is only stored on the vendor’s side.

The HHS Office for Civil Rights publishes a sample BAA at HHS.gov sample BAA provisions. Vendors typically use their own template that covers the required clauses.

The BAA is the legal piece. The technical piece is configuring mail flow rules that force encryption on any outbound message containing protected health information. Both pieces are required for HIPAA coverage, not just one.

💡Pro Tip: Map regulations before requesting a Smarsh quoteSmarsh bundles encryption, archiving, and supervision under one contract. That bundle fits broker-dealers and hospital systems that need all three under FINRA, SEC, or HIPAA. It overshoots a solo practice or two-person insurance office that only needs encrypted patient email. Before requesting a scoped quote, list every rule the firm must satisfy and mark which require encryption, which require archiving, and which require supervision. If only encryption applies, a dedicated service reaches the same outcome faster and cheaper.

Integrating Smarsh with Microsoft 365 and Google Workspace

Most Smarsh customers run either Microsoft 365 or Google Workspace as their primary mail platform. Both platforms integrate with Smarsh through mail flow connectors and journal rules.

On Microsoft 365, the connector routes outbound messages through Smarsh for policy inspection, and a journal rule copies messages to the Smarsh archive for retention. The Exchange admin center handles the connector configuration.

On Google Workspace, the routing setup uses content compliance rules and an outbound gateway configuration. Google publishes admin guidance in the Google Workspace admin help center.

Configuration errors during the connector setup are the most common source of incident tickets during onboarding. Testing the flow with a small pilot group before rolling out firm-wide catches most issues before they affect production traffic.

When a firm should look at alternatives to Smarsh

Alternatives to Smarsh fall into two groups. Full compliance platforms compete with Smarsh directly for broker-dealer and hospital-scale customers. Dedicated encrypted email services target smaller practices where archiving and supervision are not the primary need.

  • Solo therapy practices, two-person insurance offices, and small clinics rarely need Smarsh-level archiving depth
  • Broker-dealers, registered investment advisers, and hospital systems usually do need it and stay with a platform like Smarsh
  • Firms that only need encrypted patient email save time and cost with a dedicated secure email service that ships the BAA in the base plan
  • Firms that need full-stack supervision across email, chat, social, and voice cannot replicate that with a dedicated encryption service

The decision is not about which platform is better in the abstract. It is about which platform matches the regulatory footprint of the specific firm.

Compliance officers who inherit a Smarsh contract at a smaller organization should review whether the full stack is still needed. Compliance officers at growing firms should confirm the current encryption service will scale to the archiving and supervision requirements the firm is heading toward.

Practical next steps for a compliance officer evaluating Smarsh

Start with the regulatory map. List every rule the firm must satisfy and mark which of them require encryption, archiving, supervision, or all three. This grid drives the platform choice.

Request a scoped Smarsh quote alongside a quote from at least one dedicated encrypted email service. Comparing pricing at the same feature scope is more useful than comparing full-stack Smarsh against encryption-only alternatives.

Run a small pilot before committing. A two-week test with a handful of users on real message flows reveals deliverability, portal experience, and administrator workflow issues that a demo cannot surface.

For healthcare organizations building a website that will collect protected health information alongside encrypted email, the HIPAA-compliant website design considerations pair naturally with the email compliance decision. Both belong on the same risk register.

Posted on

Encryption for Email Explained for Business and Regulated Teams

encryption for email guide featured image

🔑 Key Takeaways

  • Email encryption stacks three layers: TLS transport, S/MIME or PGP content, and RMS rights.
  • PGP works for a stable partner list but breaks on ad hoc patient sends needing prior key swap.
  • S/MIME is the enterprise standard when PKI already exists; certificate lifecycle is the real cost.
  • Microsoft Purview labels apply encryption plus do-not-forward from one dropdown in Outlook.
  • TLS covers most outpatient sends; message-level encryption still sits on top for HIPAA PHI.

Encryption for email splits into three layers: transport, message body, and rights protection. Each layer solves a different problem, and each has a different cost profile.

Business teams and regulated teams like healthcare, legal, and finance all need to know which layer fits which send. This guide walks the three layers, the standards behind each, and how they combine into a workable stack. For teams that want a simpler encrypted email path without managing certificates, the last section covers the dedicated service option.

Start with what encryption actually does and where it does not do enough.

The Three Layers of Encryption for Email

Transport Layer Security protects the connection between two mail servers. When both Microsoft 365 and Google negotiate TLS, the wire hop is encrypted. Anyone tapping the network sees ciphertext.

Message body encryption protects the actual content. S/MIME and PGP both encrypt the payload with a key pair. Only the recipient with the matching private key can decrypt. The message stays encrypted at rest on the receiver side.

Rights management sits on top. Microsoft Purview and its predecessor RMS apply policy controls like block forwarding, block printing, and enforce expiration. Rights management works alongside encryption to enforce how the recipient can use the message.

A complete stack usually uses TLS by default, message body encryption for sensitive mail, and rights management templates for regulated policy enforcement. Sibling coverage on the concept sits at email encryption.

PGP Encryption for Email in Practice

PGP, short for Pretty Good Privacy, and its open standard OpenPGP, uses a key pair for each user. The public key encrypts to that user. The private key decrypts.

Thunderbird ships with OpenPGP support since version 78. Users generate a key pair inside Thunderbird, export the public key, and share it with recipients. Encrypted messages send through any IMAP or POP mailbox.

Mailvelope is a browser extension for Chrome, Firefox, and Edge. It layers PGP on top of Gmail, Outlook on the web, and other webmail providers. Users generate a key pair in the extension and encrypt or decrypt inside the webmail interface.

PGP works well for a stable set of technical counterparties. It does not scale to ad hoc sends because each new recipient needs a key exchange before the first encrypted message. That rules out one off patient or client mail.

encryption for email in article illustration one

S/MIME as the Enterprise Standard

S/MIME, short for Secure/Multipurpose Internet Mail Extensions, is the enterprise message encryption standard. Certificates come from a public certificate authority or an internal PKI.

Outlook desktop, Outlook for Mac, Apple Mail, and Google Workspace with hosted S/MIME all support the standard. The sender needs a valid certificate installed in the local certificate store. The recipient needs a matching public certificate exchanged in advance.

Certificate lifecycle is the operational cost. Certificates expire, keys need backup, and revocation lists need updates. Large enterprises staff a PKI team to handle this. Small teams struggle with the overhead.

Sibling reading on the S/MIME format sits at s mime email encryption. For file level encryption tied to email, see the guide on how to encrypt a file for email.

RMS Templates and Microsoft Purview Labels

Rights Management Services, or RMS, applies policy controls on top of encryption. Microsoft Purview sensitivity labels are the modern successor and the current best practice for Microsoft 365 tenants.

Default templates include Encrypt Only, Do Not Forward, Confidential, and Highly Confidential. Each template applies a defined set of controls: encryption, forwarding restriction, printing restriction, expiration, and watermarking.

Senders pick a label from a dropdown in Outlook or Word. The template applies the encryption and policy in one action. Staff do not configure encryption settings per send. That reduces training and errors.

Administrators create custom templates in the Purview admin center. A custom template can encrypt with a tenant key, restrict access to a security group, and apply a specific expiration. Learn more at Microsoft Learn on sensitivity labels.

Example A three-partner law firm evaluates encryption for client communication across 300 active matters. Two partners test S/MIME with certificates from Sectigo at $60 per user annually. The third partner tries Mailvelope PGP for tech-savvy clients. After six weeks, the S/MIME pair completes 22 encrypted client threads. The PGP partner completes only 4 because most clients cannot exchange keys. The firm adds a dedicated encrypted email service on top for one-off client mail. The layered stack matches each communication pattern to the right tool.

TLS as the Transport Baseline

Every serious mail server supports TLS today. Microsoft 365 and Google Workspace negotiate TLS 1.2 or TLS 1.3 on outbound by default.

TLS is opportunistic in the default configuration. When the receiving server does not offer TLS, the message can fall back to plain text. Mail flow rules can force TLS on outbound connectors or block the delivery.

TLS does not encrypt the message at rest. Once the message lands in the recipient inbox, anyone with access to that mailbox reads it. TLS covers the wire between servers only.

For HIPAA sends, TLS is the floor and not the ceiling. Auditors expect message level encryption on top of TLS. See the NIST guide on Trustworthy Email for the transport security context.

encryption for email in article illustration two

Email Encryption for Office 365 Users

Microsoft 365 tenants on Business Premium, Enterprise E3, Enterprise E5, or the E5 Compliance add on can use Microsoft Purview Message Encryption without adding a separate service.

Senders click Options, then Encrypt in the Outlook ribbon and pick a policy. External recipients open the message through the Microsoft encrypted message portal with a Microsoft, Google, or one time passcode sign in.

Administrators can add mail flow rules in the Exchange admin center that apply encryption automatically. A rule can encrypt any message with the word confidential in the subject, or any message to a defined partner domain.

Tenants on Business Basic or Business Standard do not include the Encrypt button. The options are upgrading the plan or adding a dedicated encrypted email service. Sibling coverage on the RMS template question sits at which rms template do i use for email encryption.

Email Encryption for Businesses of Different Sizes

Business size drives the sensible choice. A five person practice does not need the same stack as a thousand seat enterprise.

  • 1 to 25 seats. A dedicated hosted service like Mailhippo layered on the existing Gmail or Outlook mailbox. BAA included, one click recipient open, minimal training.
  • 25 to 250 seats. Microsoft 365 Business Premium with Purview Message Encryption, or Google Workspace Enterprise Standard with hosted S/MIME. Native integration inside the platform.
  • 250 to 2500 seats. Microsoft Purview with custom sensitivity labels tied to the internal classification schema. Central compliance team owns the label taxonomy.
  • 2500 seats and up. Enterprise appliance from Cisco, Proofpoint, or OpenText Voltage tied to inbound email security. Full change management, dedicated security team ownership.

Match the deployment to the team that will run it. Overbuying leads to shelfware. Underbuying leads to workarounds that break compliance. Sibling coverage on the MSP side sits at best solutions for email encryption.

💡Pro Tip: Layer the stack, do not stack the layers wrongTLS covers the wire. S/MIME or PGP protects the message body for known partners. Rights management templates enforce policy on top. Trying to run one layer alone leaves gaps. Trying to run all three on every message creates recipient friction that drives adoption down. Map each message type to the right layer combination. Ad hoc external mail wants a dedicated service with one-click open. Fixed partner exchanges tolerate S/MIME. Regulated policy enforcement wants sensitivity labels.

Encryption for Email at Law Firms

Law firms use encryption for email to protect attorney client privilege, comply with state bar rules on client communication, and meet client audit requirements.

Small firms usually pick a dedicated service like Mailhippo or Virtru. The service adds a send workflow on top of Outlook or Gmail and provides one click recipient delivery. That matches the ad hoc client communication pattern.

Mid size firms lean toward Microsoft 365 Business Premium or E3 with Purview Message Encryption and sensitivity labels. The label taxonomy matches internal document classification and travels between mail and documents in Word and Excel.

Large firms deploy enterprise appliances tied to a broader security stack. Cisco Secure Email Encryption Service and Proofpoint Encryption dominate that segment. Adoption follows the firm wide security architecture.

Encrypting Files and PDFs Sent by Email

Email encryption protects the message. Files attached to the message can carry their own encryption in addition, which travels with the file after download.

PDF encryption is the most common file layer. Adobe Acrobat, Microsoft Word export to PDF, and macOS Preview all support password protected PDFs. The recipient enters the password to open the file.

Office documents support encryption from File, Info, Protect Document, Encrypt with Password in Word, Excel, and PowerPoint. The document stores the password protection and travels encrypted with the message.

Password sharing is the friction point. Deliver the password on a separate channel like a phone call or SMS. Never send the password in the same email. Sibling coverage on the PDF path sits at how to encrypt a pdf for email.

Picking the Right Encryption for Email Stack

Match the encryption stack to the workflow. Ad hoc external mail needs a portal or one click service. Fixed partner exchanges tolerate S/MIME or PGP. Regulated policy enforcement needs sensitivity labels.

Start with the platform license. If Microsoft 365 or Google Workspace already includes the encryption path, use it. Add sensitivity labels for policy control. If the platform license does not include encryption, add a dedicated secure email service that includes a BAA.

Test the recipient experience on real inboxes before the first live send. Send to a personal Gmail, a personal Outlook, a Yahoo, and one enterprise domain. Measure time to open and confirm the message renders correctly on each.

Posted on

How to Encrypt Email in Every Major Client

how encrypt email guide featured image

🔑 Key Takeaways

  • Email encryption works at two layers: TLS on the wire and end-to-end on the message body itself.
  • Outlook 365 Business Premium unlocks the Encrypt button; lower tiers get no message protection.
  • Gmail Confidential Mode is portal access control, not encryption, and fails every HIPAA audit.
  • Yahoo and AOL rely on opportunistic TLS alone with no S/MIME, no BAA, no fit for PHI workflows.
  • GoDaddy Professional Email runs on Microsoft 365 and inherits Encrypt on Business Premium plans.

Every major email client handles encryption differently, and the differences matter the moment a message carries patient data, financial records, or contract terms. The Encrypt button in Outlook does one thing. The Confidential Mode toggle in Gmail does something else entirely. AOL and Yahoo do a third thing, which is essentially nothing at the body level.

This guide walks through how to encrypt email in Outlook, Outlook on the Web, Gmail, Yahoo Mail, AOL Mail, and GoDaddy Professional Email. Each section covers the real steps, the license requirements, and what happens on the recipient side. For teams that need HIPAA-covered encryption without per-recipient certificate management, a dedicated encrypted email service handles the workflow with a signed business associate agreement in the base plan.

The article closes with a comparison table, a short section on encrypted HTML messages, and answers to the questions readers most often ask about specific providers.

Email Encryption Has Two Layers That Behave Differently

The word encryption covers two separate protections in email. Transport Layer Security wraps the connection between mail servers so intercepted traffic looks like noise. End-to-end encryption protects the message body itself so the recipient inbox holds ciphertext until they authenticate.

Every major provider now uses TLS by default when the other side supports it. Google, Microsoft, Yahoo, and AOL all handshake to TLS 1.2 or 1.3 automatically. That covers the wire, which is one leg of the trip.

The body is a separate problem. TLS does nothing for a message once it lands on the recipient server. If an attacker gets into that inbox through credential theft or a backdoor, TLS did not encrypt what they can read. That is the gap end-to-end encryption closes.

The NIST cybersecurity framework treats these as two distinct controls. Regulated industries in the United States including healthcare, finance, and legal services are expected to apply both layers when sensitive data is in the message.

Outlook Desktop Uses the Encrypt Button Under Options

Outlook 365 on Windows and Mac exposes an Encrypt control on the Options ribbon when the underlying Microsoft 365 plan supports Purview Message Encryption. Open a new message, click the Options tab, then click Encrypt. Pick either Encrypt or Do Not Forward.

Encrypt allows the recipient to reply. Do Not Forward removes reply and forward permissions. Both options run through Microsoft cloud key management and require Azure Rights Management to be active on the tenant.

External recipients on any email platform get a link to a Microsoft portal. They sign in with their Microsoft, Google, or Yahoo account, or they request a one-time passcode delivered to that address. The portal shows the message body inside the browser without exposing the ciphertext.

Tenants below Business Premium do not see the Encrypt button. The Microsoft documentation on Message Encryption lists the exact eligible plans. Practices on lower tiers add the license across seats or move sensitive workflows to a dedicated service.

how encrypt email in article illustration one

Outlook on the Web Mirrors the Desktop Encrypt Menu

Outlook on the Web, sometimes called OWA, provides the same encryption control through a slightly different menu. Compose a new message. Click the three-dot menu next to the send button. Select Encrypt, then pick the policy.

The behavior on the recipient side is identical to desktop Outlook. External addresses get a portal link. Microsoft 365 and Google Workspace recipients often experience a direct inline decryption if their tenant is configured for it.

When the Encrypt menu does not appear in OWA, the tenant lacks the required license. Administrators can verify this in the Microsoft 365 admin center under Licenses. The affected users need a plan that includes Azure Information Protection or Microsoft 365 Business Premium and above.

Users authenticated through single sign-on with hardware keys retain the security posture on both platforms. The encryption policy travels with the message regardless of where the sender composed it.

Gmail Handles Encryption Three Different Ways

Gmail encrypts email in three modes that many users conflate. The first is TLS in transit, which every Gmail message uses when the receiving server supports it. Gmail shows a small padlock icon in the message header to indicate TLS status.

The second is Confidential Mode, which any Gmail user can activate by clicking the padlock-clock icon in the compose window. Confidential Mode adds expiration dates, passcodes over SMS, and revocation, but the body itself is stored on Google servers without additional cryptographic wrapping.

The third is client-side encryption on Workspace Enterprise Plus, Education Plus, and Education Standard. Admins enable it through the admin console, and users see a shield icon in the compose bar. Keys stay under the customer control through an external key service.

S/MIME support is also available on Workspace and can be enforced per-domain. The Google Workspace admin guide on hosted S/MIME covers configuration. Confidential Mode alone does not qualify as HIPAA-covered encryption because it lacks cryptographic body protection.

Example A solo massage therapist bills insurance and uses an AOL Mail account she has held for 15 years. Her billing service asks for signed authorization forms by email. AOL has TLS to and from the billing service but no end-to-end body encryption, no S/MIME support, and no BAA. She keeps the AOL address for personal mail and routes clinical correspondence through a dedicated encrypted email service tied to a new business address, which includes the BAA and delivers a one-click portal to the billing office.

Yahoo Mail and AOL Mail Rely on Transport Encryption Only

Yahoo Mail and AOL Mail both use TLS for server-to-server delivery and HTTPS for the browser session. Neither service offers a native encryption button in the compose window. Neither supports S/MIME certificate installation in the web interface.

A Yahoo user sending to a Gmail user gets TLS on the wire. The message body lands in Google storage in a form Google can read, and it stays that way until the recipient opens it. That is standard consumer webmail behavior.

Neither Yahoo nor AOL offers a business associate agreement for HIPAA-regulated senders. A dental practice, therapy clinic, or medical billing office using an AOL address for clinical correspondence has no compliant encryption path inside that account.

The remediation is straightforward. Move the mailbox to a Workspace or Microsoft 365 plan that supports encryption, or route sensitive messages through a dedicated encrypted email service that layers on top of the existing address.

GoDaddy Professional Email Inherits Microsoft 365 Encryption

GoDaddy Professional Email product runs on Microsoft 365 infrastructure under the hood. Users on the Business Premium tier and above get the same Encrypt button and Purview Message Encryption behavior as customers who buy directly from Microsoft.

The Encrypt control lives in the same place in Outlook desktop and Outlook on the Web. Portal delivery for external recipients works identically. GoDaddy also sells a Microsoft 365 Advanced Email Security add-on that adds threat protection on top of the base encryption feature.

GoDaddy Webmail Classic, the older non-Microsoft product, does not offer a native encryption interface. Accounts still using Webmail Classic should upgrade to the Microsoft-backed Professional Email product or route sensitive messages through a separate encrypted platform.

Practices in healthcare using GoDaddy for domain email should verify the specific product tier attached to the mailbox. The tier determines whether encryption is one click away or requires an entirely different tool.

how encrypt email in article illustration two

S/MIME and PGP Are the Certificate-Based Options

S/MIME and PGP are the two long-standing certificate-based encryption standards. Both require the sender and recipient to exchange public keys before the first encrypted message can travel. Both work across email clients that support the standard.

S/MIME is the dominant standard in enterprise environments. Outlook, Apple Mail, and Workspace on eligible plans support S/MIME natively. Certificates come from commercial certificate authorities like DigiCert, Sectigo, and Entrust, or from an internal PKI.

PGP, and its open source implementation GnuPG, is dominant in developer, journalist, and activist communities. Thunderbird ships with OpenPGP support built in. Outlook and Gmail require add-ons to work with PGP.

The friction with both standards is key management at scale. A clinic emailing 300 patients cannot ask each patient to install a certificate. That is where portal-based delivery from Microsoft Purview, dedicated encrypted email services, or client-side encryption on Workspace replaces per-recipient certificate exchange.

Encrypting an HTML Email Uses the Same Native Controls

HTML formatting and encryption are independent. The Encrypt button in Outlook, the client-side encryption shield in Workspace, and the S/MIME toggle all encrypt the entire message body including HTML markup, inline images, and attachments.

Do not attempt to encrypt HTML inside the source using scripts or base64 obfuscation. That approach breaks rendering across most clients and does not provide real cryptographic protection. Spam filters also flag obfuscated HTML.

Compose the message normally with rich formatting. Apply the native encryption control before pressing send. The recipient sees decrypted HTML with all formatting intact after authenticating through the portal or with their certificate.

Newsletter platforms and transactional email services handle HTML separately and often add DKIM and DMARC signatures without body encryption. Those signatures verify sender identity but do not encrypt content. Encryption is a separate step, applied by the sender.

💡Pro Tip: Verify the license tier before rolling out encryption trainingThe Encrypt button appears only on Business Premium and above in Microsoft 365, and Confidential Mode is not real encryption in Gmail. Before training staff on an encryption workflow, pull the license report from the admin console and confirm every mailbox that needs to send secure mail sits on a qualifying tier. Mismatched licenses produce a silent gap: staff click Encrypt, nothing happens, and PHI leaves unprotected.

Comparison of Native Encryption Options Across Providers

The table below summarizes native encryption support in the major email platforms. Availability shifts with license tier, so verify the specific plan attached to a mailbox before assuming a feature is present.

PlatformTLS in transitEnd-to-end bodyBAA availableLicense needed
Outlook 365YesYes, via PurviewYesBusiness Premium and above
Outlook on the WebYesYes, via PurviewYesBusiness Premium and above
Gmail freeYesNo, Confidential Mode is portal onlyNoFree
Workspace Enterprise PlusYesYes, client-side encryptionYesEnterprise Plus, Education Plus
Yahoo MailYesNoNoNone
AOL MailYesNoNoNone
GoDaddy Professional EmailYesYes, via PurviewYesBusiness Premium and above

Practices that need encryption without navigating license tiers often pair their existing Gmail or Outlook mailbox with a secure email service that applies encryption and a signed business associate agreement to every outgoing message without changing the sending address.

Common Mistakes When Setting Up Email Encryption

The most common mistake is assuming that a padlock icon in Gmail or the presence of HTTPS in the browser means the message body is encrypted end-to-end. Neither indicator means that.

The second most common mistake is turning on Confidential Mode and treating the result as HIPAA compliant. Confidential Mode is portal access control. It does not carry the cryptographic and BAA coverage HIPAA requires.

A third mistake is deploying S/MIME to internal staff and skipping the certificate distribution to external counterparties. Encryption then works only within the domain, which is not what the policy usually intends.

Before rolling out encryption to a practice, verify three items:

  • The license tier on every mailbox actually includes the encryption feature.
  • External recipients on major providers can decrypt without extra setup on their side.
  • A signed business associate agreement covers the specific product feature used, not just the base mailbox.

When a Dedicated Encrypted Email Service Makes Sense

Native encryption in Outlook and Workspace works well for organizations already on the required license tiers with IT staff to manage certificates, portal experiences, and admin console configuration. It fits enterprises with mature identity systems.

Smaller practices, solo providers, and multi-location dental groups often carry a different profile. They run on lower Microsoft 365 or Workspace tiers, they lack dedicated IT staff, and they need HIPAA coverage without buying enterprise seats across every user.

Mailhippo is a secure email service built for this profile. It works with existing Gmail and Outlook accounts, applies TLS and client-side encryption automatically, includes a business associate agreement in the base plan, and delivers messages through a one-click recipient experience without PGP keys or S/MIME certificate management. One brief mention here, in case the license math on native tools does not work out for the practice.

Healthcare practices weighing the tradeoffs between native and dedicated encryption often benefit from a broader look at their site and communication stack. A healthcare marketing agency can help align patient-facing channels with the encryption layer sitting behind them.

For a deeper look at the security controls that pair with encrypted communication in medical environments, review the guidance on security features on healthcare websites. Encryption is one control in a broader posture that includes authentication, backups, and monitoring.