When do I need to use encryption to protect an email?
When PHI needs encryption: not for internal or healthcare recipients, yes for patients.
When in doubt, just use encryption. That is what we tell everyone we train during setup.
If your message contains PHI (Patient Health Information), you may need an encryption tool to protect it. For an illustrated overview of how TLS and message encryption work, see our How it Works page.
Internal messages are end-to-end secure by default
You do not need an encryption tool for internal messages. You can send any patient information back and forth without doing anything special. Internal email never leaves our secure system. This is true for any EnGuard address writing to any other EnGuard address. If you know another person uses us for email hosting, your messages to them are internal.
Transport Layer Security (TLS)
HIPAA requires covered entities and healthcare professionals to use encryption when sending data over the internet. The current email encryption standard is Transport Layer Security (TLS), which protects data in transit. Email servers use it to send data back and forth with users and other servers over an encrypted connection. When both email servers use TLS, the experience for sender and recipient is seamless.
All your outgoing messages are protected in transit by TLS, automatically.
When to use an encryption tool
When you send PHI to an external address, there are two cases: (1) you are sending to another covered entity under HIPAA, such as doctors, hospitals, insurance companies, labs or medical billers, or (2) you are sending directly to a patient or guardian.
1. Other healthcare entities: no encryption needed
Your secure inbox and built-in TLS are enough for emails with PHI to covered entities and healthcare professionals. Your recipient is fully responsible for the security of the message on their end. Like you, they must have a HIPAA compliant email host and use TLS. If they do not, or they have a breach, that is not your violation. It is often impossible to check whether a recipient is HIPAA compliant, but you can rest easy knowing that if a covered entity fails on their end, it is their violation.
2. Patients: you must use encryption
TLS is not enough when you email PHI to patients, their guardians, or anyone who is not a covered entity under HIPAA. Always assume patients do not have secure email.
Because of that, you need to protect the message in their inbox too. To send them any PHI by email, use one of our security tools:
Sometimes you will know that a healthcare provider you are emailing is not secure, for example a doctor using email@gmail.com for business. Protecting their end is still their responsibility. But out of kindness and concern for your patient's information, you can choose to encrypt the message anyway, even though it is technically not your obligation.