Standard email is not HIPAA compliant. Gmail, Yahoo, and most basic email services do not encrypt messages in a way that satisfies HIPAA requirements and do not sign Business Associate Agreements with covered entities. Using them to send or receive patient information is a violation regardless of the content of the message.
Here is what dental practices actually need to communicate by email while staying on the right side of HIPAA.
The Rule Most Practices Miss
Sending a patient’s name, appointment details, treatment information, or any other protected health information through a non-HIPAA-compliant email service is a HIPAA violation.
This applies to emails sent by your practice, emails sent by staff from personal accounts for convenience, and automated appointment reminders sent through a non-compliant patient communication platform. The medium is the violation, not the content.
Need HIPAA-compliant email configured before your practice opens? Find out in 15 minutes if we are the right fit.
HIPAA-Compliant Email Options for Dental Practices
Every compliant email setup requires three things. Select a platform to see how it meets each requirement.
1Signed BAA with your practice
2Encryption in transit and at rest
3Strong authentication controls (MFA)
Which email platform are you evaluating?
Microsoft 365 Business
Google Workspace for Healthcare
Hushmail for Healthcare
LuxSci
Standard Gmail / Yahoo (current)
What About Patient Communication Platforms?
Your office emailStaff-to-staff and staff-to-vendor communication
Used by staff to communicate with each other, with vendors, and with patients on clinical or administrative matters. Must be HIPAA compliant with a signed BAA from your email provider.
Your patient communication platformAutomated appointment reminders, recall notices, and review requests
Handles automated outreach that includes patient names, appointment dates, and contact data. Must also be HIPAA compliant and sign a BAA with your practice before use. This is separate from your office email.
Patient portal messagesThe safest channel for transmitting clinical information electronically
Secure messages sent through a patient portal are encrypted end-to-end and do not pass through external email servers. The safest channel for transmitting clinical information by electronic message.
What Your IT Provider Configures
Business email account setup under a HIPAA-compliant plan with a signed BAA
Encryption settings configured for both in-transit and at-rest message protection
Multi-factor authentication enabled on every staff email account at the organizational level
Email retention policies configured to meet HIPAA documentation requirements
Spam and phishing filtering to reduce the risk of credential theft through email
Frequently Asked Questions
Standard Gmail is not HIPAA compliant. Google Workspace for Business or Google Workspace for Healthcare, configured under a BAA with HIPAA-appropriate settings enabled by your IT provider, can be used. The free consumer version of Gmail cannot be used for any communication involving patient information.
Any email containing protected health information requires encryption. A patient’s name alone may not constitute PHI if it is not combined with any health-related information. But a name combined with an appointment date, a diagnosis, a treatment plan, or insurance information is PHI and requires an encrypted transmission channel.
If a patient initiates contact by email from their personal account and requests a response by email, HIPAA permits responding to the channel the patient chose. Document the patient’s preference in their chart. The practice’s outgoing message should still be sent from a HIPAA-compliant email account with encryption enabled.
Yes, and they should. HIPAA-compliant email setup including platform selection, BAA verification, encryption configuration, and MFA enrollment is a standard component of a dental IT managed services engagement. If your IT provider has not addressed your email compliance specifically, that is a gap worth raising.
Still using Gmail or a standard email account to communicate with patients and wondering if that is actually a HIPAA problem?
Ekim IT Solutions works exclusively with dental practices. We serve New England and New York with on-site support and dental practices nationwide with remote support. We configure and manage HIPAA-compliant email for dental practices with the right encryption, BAA documentation, and access controls so your team can communicate without putting patient data at risk.
Standard email and patient data is a HIPAA violation waiting to happen. Find out if your practice email is actually compliant.
Ezra Angelo
