In the late 1990s, electronic communication began transforming healthcare. According to the study "We Got Mail": Electronic Communication Between Physicians and Patients, by 1997, approximately 17.5 million adults in the U.S. were already using the internet to seek medical information. At the same time, physicians began using email for professional tasks such as consulting with colleagues, reviewing lab results, tracking patient outcomes, and corresponding with patients.
The healthcare sector has since adopted email as its primary mode of communication. As noted in Email in Healthcare: Pros, Cons and Efficient Use, “It is the assumption of many healthcare organizations that staff will regularly check and act on their email messages.” This widespread reliance on email makes it essential for healthcare organizations to implement robust internal email governance policies, particularly those that align with the Health Insurance Portability and Accountability Act (HIPAA).
These policies help ensure sensitive patient data is protected, communication practices meet regulatory standards, and operations are secure and efficient.
HIPAA requires specific safeguards to safeguard protected health information (PHI), including any electronic PHI (ePHI) stored or transmitted via email. Under the HIPAA Security Rule, covered entities and business associates must implement administrative, physical, and technical safeguards that preserve the confidentiality, integrity, and availability of ePHI.
As the U.S. Department of Health and Human Services (HHS) explains, “A major goal of the Security Rule is to protect the security of individuals’ ePHI while allowing regulated entities to adopt new technologies that improve the quality and efficiency of health care.” The Rule is designed to be flexible and scalable, allowing organizations to tailor their safeguards to their size, structure, and risk profile.
Without formal email policies, healthcare organizations face risks of:
Many data breaches originate from simple mistakes or user negligence. As Sarah Varnell, manager of attest services at BARR Advisory, states, “My recommendations for healthcare organizations do not differ significantly from what is considered best practice in other industries. In most cases, the attacks targeting healthcare organizations are not very technical attacks. They rely on tricking users, exploiting weak or reused passwords, or taking advantage of gaps in basic security hygiene. Once attackers have access, they can exfiltrate PHI and either ransom it back to the organization or sell it on the dark web."
To develop an effective internal email governance strategy, organizations should include the following components:
An Acceptable Use Policy outlines what staff can and cannot do when using organizational email systems. To comply with HIPAA, the AUP should clarify:
As Varnell notes, policies on acceptable use and clean workdesks are foundational practices that reinforce organizational security culture.
In December 2025, the Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services (HHS) released a Notice of Proposed Rulemaking (NPRM). This proposal aims to amend the Security Rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), enhancing cybersecurity measures for electronic protected health information (ePHI).
Under the newly proposed updates to the HIPAA Security Rule, encryption would become a mandatory requirement rather than an “addressable” implementation specification.
Encryption is required when:
Internal policies should mandate encryption in transit and, where applicable, at rest, and specify how and when encryption must be used.
The HIPAA Privacy Rule requires that “A covered entity must maintain [patient records] until six years after the later of the date of their creation or last effective date.” This requirement extends to any email communications that include protected health information (PHI) or are considered part of a patient’s designated record set. As such, healthcare organizations must implement email retention and archiving policies that align with this rule.
Internal email governance policies should clearly define:
Email access must be tightly controlled. HIPAA requires that access to ePHI be limited to only those who need it to perform their job functions. This is in line with the principle of least privilege, which Sarah Varnell also recommends, stating, “Enforcing least privilege access controls to ensure that a compromised account can’t freely move throughout the network is also a critical step in a defense plan."
Governance policies should define:
Strong authentication mechanisms, including MFA, are a technical safeguard under HIPAA’s Security Rule. Governance policies should require:
As Varnell suggests, “Additional technical controls to implement include timely patch management, endpoint detection and response, and strong multifactor authentication, potentially in the form of hardware security keys where appropriate.”
A study by IBM, as quoted by The Hacker News, found that human error is “a major contributing cause in 95% of all breaches.” Internal email governance should mandate regular security awareness training, including simulated phishing exercises.
Sarah Varnell emphasizes that “Information security awareness training that covers how to identify and prevent phishing and other social engineering attacks is critical for ensuring employees are equipped with the appropriate knowledge to protect themselves and the organization.”
Training should be:
Policies should also encourage employees to report suspicious emails without fear of punishment.
HIPAA requires covered entities to have policies in place for identifying, reporting, and responding to security incidents. Internal email governance must include:
With more healthcare professionals using mobile devices, laptops, and tablets to check email, mobile governance is essential. Policies should address:
Emails to and from business associates must also be governed. Varnell cautions that “It is important to ensure that vendors and partners, especially those that handle PHI, understand what constitutes a breach and have a clear incident response plan of their own. Many healthcare breaches originate in the supply chain, so conducting due diligence as part of a strong vendor management program is also key.”
Internal policies should:
To demonstrate HIPAA compliance, organizations must log and monitor email activity. Governance policies should require:
These practices can help detect early indicators of compromise.
A well-written policy only works when supported by the right tools. Healthcare organizations should integrate their governance framework with:
As Varnell notes, “From a technical perspective, organizations should build robust vulnerability management programs and conduct regular penetration testing to identify and address security issues before attackers do. Additional technical controls to implement include timely patch management, endpoint detection and response, and strong multifactor authentication, potentially in the form of hardware security keys where appropriate.”
PHI includes any individually identifiable health information sent via email, such as medical records, insurance details, lab results, or appointment data, when it can be linked to a specific patient.
Yes. Any vendor that handles PHI must sign a business associate agreement (BAA) and adhere to the same security requirements, including secure email communication practices.
At minimum, policies should be reviewed annually or whenever there is a change in regulations, technology, or organizational structure. Regular updates ensure continued relevance, legal alignment, and operational effectiveness.