A journal article published in Applied Clinical Informatics puts forward that, “Confidentiality is a cornerstone of providing health care to adolescents.” Minor patient data can include routine information, such as immunization records and appointment details, alongside sensitive information about mental health, reproductive care, substance use, or infectious diseases. Protecting that information requires healthcare organizations to secure the email itself and confirm that the recipient is legally permitted to receive the information.

HIPAA compliant email allows healthcare organizations to send and receive electronic communications while putting safeguards in place around electronic protected health information (ePHI). According to the Department of Health and Human Services (HHS), providers are permitted to discuss health issues with patients via email when reasonable safeguards are used. These safeguards can include verifying the recipient’s address, protecting the message during transmission, and limiting the information shared over unsecured channels.

 

Why minors’ health information requires additional care

Parents or legal guardians are typically considered a minor’s personal representative under HIPAA’s Privacy Rule. Under the rule, a personal representative is anyone with legal authority to act for another person. This relationship usually grants access to a child’s health information and the ability to receive communications directly from healthcare providers.

There are exceptions to this rule. Parents may not be in control of information related to a particular service if a state law permits the minor to consent to that service on their own behalf, another person or the court consents to the care, or the parent agrees to a confidential relationship between the provider and the child. State law may also specifically allow or prevent a parent from accessing the child’s information. Providers can also refuse to treat someone as a minor’s personal representative if they suspect abuse, neglect, or endangerment and exercise their professional judgment when making that decision.

These differences impact where healthcare organizations can send email. An authorized parent may be able to access their child’s health information regarding checkups and vaccinations but may not be entitled to information about mental health counseling if the minor has a right to confidential treatment under state law. Healthcare organizations should determine who can access what type of information rather than assuming parental access is always allowed or denied.

A Journal of the American Medical Informatics Association study noted, “Variation in data sharing and data access between institutions can result in privacy breaches and create confusion about completeness of data for patients and families.” Across ten US healthcare organizations, the study revealed notable inconsistencies in their privacy settings concerning minors and their proxies. Having a clearly defined email policy can help reduce this discrepancy by instructing staff on how to choose, verify, and document recipients.

 

How HIPAA and COPPA differ

HIPAA covers any PHI created, received, maintained, or transmitted by covered entities and business associates. These protections can apply to patients regardless of age when their information meets the definition of PHI. COPPA applies to specific online platforms and services aimed at kids under 13, plus any sites designed for everyone that are aware they're gathering personal details from youngsters under that age.

The updated COPPA Rule defines personal information to include email addresses, phone numbers, government IDs, biometric data, photographs, geolocation, and persistent identifiers used for online child recognition. Operators are obligated to inform users about their data handling procedures, secure documented parental permission (barring specific exemptions), safeguard any data gathered from minors, and adhere to rules for keeping and discarding that information.

If a pediatric provider offers a covered website or mobile app for children and handles PHI, it could be subject to both laws. While HIPAA compliant email allows secure transmission and documentation, it will not satisfy COPPA’s notice and consent requirements on its own. Complying with COPPA also does not eliminate the need to comply with HIPAA’s privacy and security safeguards.

 

How HIPAA compliant email protects minors’ data

Use an email provider that will sign a BAA

A HIPAA compliant email service that creates, receives, maintains, or transmits ePHI on behalf of a covered entity will generally be considered a business associate. Covered entities must have written confirmation (usually a business associate agreement) that the business associate will safeguard PHI.

Having a business associate agreement with an email provider does not automatically make all uses compliant. Healthcare organizations must configure email appropriately, conduct risk analyses, control access to ePHI, and follow their privacy policies. BAAs create contractual obligations but do not prevent a user from sending to the wrong person or improperly disclosing PHI.

 

Limit the information exposed

HIPAA includes a minimum necessary standard that generally requires covered entities to limit access to PHI to what is reasonably needed for the intended purpose. The standard does not apply to routine uses and disclosures for treatment, disclosure to the individual, or when the individual has authorized access.

Standard precautions still apply to sensitive information. Putting diagnoses and treatment details in the subject line exposes that information if someone improperly accesses the inbox. Staff should review attachments and minimize the people copied on an email before hitting send. Information from your care team is less informative to a stranger than naming a specific disease or condition.

 

Protect both incoming and outgoing email

A Paubox study reviewed 170 healthcare-related email breaches reported in 2025. Over half of the breaches were due to compromised Microsoft 365 accounts. 74% of breached healthcare domains had poorly enforced or nonexistent Domain-based Message Authentication, Reporting & Conformance (DMARC) policies. DMARC allows organizations to reduce the risk to their domain from criminal impersonation.

Organizations should enable inbox protections on incoming mail, enable multifactor authentication, verify incoming email, apply data loss prevention policies, and monitor user activity. Paubox also recommends encrypting data to better protect against accidental disclosure.

 

Creating a safer email workflow for pediatric care

Healthcare organizations should train staff to:

  • Verify that an email contains PHI.
  • Check who controls the minor’s information.
  • Review applicable state law and healthcare service.
  • Confirm the recipient’s identity and email address.
  • Use HIPAA compliant email that protects messages.
  • Proof subject lines, recipients, and attachments.
  • Document communication preferences.
  • Consult with the privacy team if unsure.

A 2021 Elsevier study found, “It is critical that clinicians understand the adolescent confidentiality considerations with increased sharing of EHI through a patient portal.” The same can be said for email. Having clear policies and procedures allows staff to communicate efficiently while respecting the minor’s right to confidentiality.

Paubox Email Suite works with Google Workspace and Microsoft 365 to automatically encrypt outbound email. Our BAA covers the storage and handling of encrypted email, and we use TLS 1.2+ with a secure link fallback when the recipient’s server cannot accept modern TLS versions. Automatic encryption reduces the burden on employees to remember to encrypt sensitive information while allowing patients and authorized caregivers to use email to receive health information.

 

FAQs

Does a parent always have access to their child’s health information?

No, although parents are generally considered a minor’s personal representatives, exceptions can apply under HIPAA and state law when minors are permitted to consent to care or receive confidential services.

 

Is email sent to school nurses always protected by HIPAA?

Many schools maintain student health records covered by FERPA, not HIPAA. It will depend on the school and type of record.

 

Does COPPA apply to teenagers?

No, COPPA focuses on children under the age of 13. Other federal and state laws may apply to older children.

 

If a healthcare organization signs a BAA, will its email service be HIPAA compliant?

Signing a BAA holds the email provider contractually responsible for safeguarding information. The healthcare organization is still responsible for following the law.