Emailing patients under HIPAA: when plain email is allowed, the safeguards HHS expects, and wording to copy

Many small practices avoid email with patients because they think HIPAA forbids it, and then spend the time on phone tag instead. HHS's own answer is more practical: email is allowed with reasonable care, and the patient's preference counts. What a practice needs is a short set of habits and three or four pieces of wording.

What HHS allows

In its answer on email, HHS says the Privacy Rule allows covered health care providers to communicate electronically with patients, such as by email, provided they apply reasonable safeguards, under 45 CFR 164.530(c). It adds that the Privacy Rule does not prohibit unencrypted email for treatment-related communications between providers and patients, as long as other safeguards reasonably protect privacy.¹

The same answer reminds practices that electronic health information they send must also meet the HIPAA Security Rule, in 45 CFR Part 164, Subpart C.¹ This is a summary, not legal advice, and your own risk assessment decides which messages go by plain email.

The safeguards HHS names

• Check the address. HHS gives checking the email address for accuracy before sending as an example precaution.¹
• Confirm it first. HHS also suggests sending an alert to the patient to confirm the address before sending the message itself.¹
• Say less. Limit the amount or type of information in an unencrypted email.¹ Our recommendation is a simple rule for the team: plain email carries times, reminders, forms and "please call us", and results or diagnoses go through your patient portal or a call.

The patient's choice

Under 45 CFR 164.522(b), a provider must let patients ask to receive communications by other means or at other places, and must accommodate reasonable requests. The provider may ask for the request in writing, but may not require the patient to explain why.²

HHS gives both directions as examples. A patient who asks for appointment reminders by email instead of a postcard should get them by email, if that is reasonable for the practice. A patient who finds plain email unacceptable should be offered something else, such as a more secure electronic method, mail or the phone.¹

When the patient emails first

HHS says that when a patient starts an email conversation, the provider can assume email is acceptable to them, unless they have said otherwise. If the provider thinks the patient may not know the risks of unencrypted email, it can tell them and let them decide whether to continue.¹ Our recommendation is to do that once, in the first reply, and to record the answer in the chart.

Wording you can copy

Replace the words in brackets. The first goes on your intake form, as in our new patient intake checklist.

Text messages follow similar habits, with their own FCC rules, in our appointment reminder texts guide. Replies to online reviews have stricter limits, covered in our guide to Google reviews.

What can run by itself

• The patient's choice, read from the intake form and saved, so every reminder goes the way they asked.
• The address check, sent automatically the first time an address is added or changed, and nothing else sent until the patient replies.
• Short reminders and forms by email, written to say only what plain email should carry, as in our front desk automation guide.
• A flag on any outgoing email that looks like it contains results or a diagnosis, held for a person to check.

What stays with your team

• What counts as too much for email, which your risk assessment and the clinician decide.
• Answering clinical questions, by phone or the portal.
• A wrong-address email, which needs a person to follow your breach procedure.

More of what we write for practices is on the blog.

Questions practices ask