According to the Department of Health and Human Services (HHS), encryption is “the process of using an algorithmic process to convert data into another form” with a low probability of being understood without a confidential key or process.

In healthcare, encryption can help secure the electronic protected health information (ePHI) when it is in transit (i.e., between messaging servers) or when it is at rest (i.e., stored electronically). It should ensure that unauthorized entities cannot read or use the information without the encryption key.

But, on its own, cannot enforce who can read the message, confirm the validity of the source (i.e., verify that the message was not sent by an unauthorized entity), alert the relevant authorities of potential violations, and prevent future breaches. In addition, an encryption tool cannot prevent the use of compromised credentials to access restricted ePHI.

 

The number that should get IT teams' attention

Paubox analyzed PHI breaches affecting 500+ persons disclosed to the HHS for our July 2026 HIPAA Breach Report. Network server breaches were the leading breach category for the month, affecting 2,341,561 individuals. Email breaches affected 126,321 individuals. Network servers were also the leading attack vector, with 32 incidents compared to six for email.

What this data shows is that the largest breaches are happening outside of the inbox. These breaches are occurring in the infrastructure, specifically on servers that house, relay, or transmit PHI. The conversation needs to shift from asking whether the message is encrypted to asking which server it is on and how that server is secured.

 

What a secure messaging server actually does

A secure messaging server is the technology that performs encryption negotiation, validates the receiving server, and routes a message so that contents cannot be read or altered in-transit. It usually consists of the following for HIPAA compliant email elements:

  • Transport Layer Security (TLS) to encrypt messages sent between mail servers
  • Certificate validation, to ensure the receiving server is who they claim to be
  • Enforcement policies, to determine what to do if TLS encryption or certificate validation fail (bounce the message, deliver it anyway, etc)

According to a Springer Nature Computer Science article on network authentication protocols, “The TLS protocol provides certificate-based authentication to manage secure communication among two nodes.” For email, those nodes can be the sending and receiving servers.

None of this is visible to the person hitting send. And that introduces risk as that a message can look completely normal to both sender and recipient, even if the server-to-server connection was never properly secured. TLS will typically offer hop-to-hop protection so that the connection between servers is safe. But TLS does not necessarily protect the message after it is delivered or while it is in storage.

 

Expired email certificates risk 3 million email addresses and hide in plain sight

A Paubox analysis of 803,378 individual unique outbound email relays found during a one-week period had 0.48% expired certificates and 3.35% contained self-signed certificates, totaling 3.8%. It was estimated that certificate-validation failures could allow attackers to eavesdrop on 33% of all messages and up to 3,000,000 individual recipient emails, creating a man-in-the-middle attack. The issue is that if the certificate presented by the receiving mail server cannot be validated, and the sending email server is configured to use only strictly enforced TLS encryption, the sending server will be unable to connect to the receiving server and instead attempt other, potentially insecure, methods of sending the email.

HIPAA Security Rule does not define which ciphers are approved for use or explicitly prohibits the use of self-signed certificates. It only requires that covered entities and business associates adopt policies and procedures that ensure the confidentiality, integrity, and availability of ePHI using encryption and integrity checks, which are addressable, i.e., not mandatory, implementation specifications. Finding an invalid certificate during the validation process is not a HIPAA violation, although it might complicate the encryption validation process, adding extra risk and effort.

 

Secure email servers are not the same as secure messaging platforms

Published research on secure messaging adoption among clinicians notes that secure messaging, unlike EHR integrated email communication, is intended for more interactive and conversational messaging among clinicians. A study of more than 33,000 healthcare professionals found that use of secure messaging had nearly doubled over five years, with varying adoption rates depending on clinical role, hospital location, and clinical unit.

In another study, a large academic safety-net hospital system found that 85% of healthcare staff had smartphone access and that 60-80% of clinical staff used text-based messages to discuss patient care, driving a shift toward these HIPAA compatible platforms (as recently as 2017, only about 26.6% of surveyed organizations had adopted one).

Secure email servers solve a different problem than a secure messaging server behind a hospital's outbound email. A common and risky assumption is that if clinicians have a secure chat tool, the organization’s email transport is secure. Clinicians conflate the two. They typically operate on separate infrastructures, each with its own threat model and failure points.

 

Encryption is not enough

HIPAA compliance requires more than an encrypted transmission channel, even where server-side encryption is implemented correctly. Access controls, audit logging, business associate agreements, workforce training, and breach notification procedures all fall under the umbrella of the Security Rule. Believing our email is encrypted and we are HIPAA compliant disregards everything else the Security Rule mandates.

Paubox’s 2026 breach report found that 86% agreed their teams were aware that employees were purposely circumventing security controls to minimize the friction in their day-to-day workflow. If it is easier to ignore the encryption policy, many will do so at the point of use. Paubox’s research also found that only 57% of healthcare organizations train their employees on email security more than once a year, and employees only self-report 5% of known phishing attacks and 4% of known HIPAA violating emails.

Research noted around asynchronous EHR messaging between teams working with breast cancer patients builds off of previous research to discussed how the security necessary when utilizing clinical messaging leads to physician exhaustion and burnout. If a more secure tool is not usable, it will eventually be bypassed.

 

FAQs

Who guards you when the business associate’s server is the problem?

Both parties are exposed. OCR can go after your organization due to downstream failures, and it did, hence the importance of auditing the business associate’s actual configuration.

 

Does encrypting each sent message with something like S/MIME or PGP solve the problem?

It would protect the contents, yes, but most healthcare organizations’ day-to-day communication uses TLS which means that emails are encrypted in transit but not by the individual messages. And it is during transit that the violations documented above occur.

 

If our vendor says their platform is HIPAA compliant, does that cover our email risk?

Platforms can provide HIPAA compliant features but be configured in ways that do not enforce HIPAA compliance by default. The Microsoft 365 and Google Workspace examples above come from organizations trusting compliant platforms.