HIPPA security of incoming emails to Microsoft 365

Question

HIPPA security of incoming emails to Microsoft 365

Morrie Med 0

We recently moved to Microsoft Business Premium and are using cloud hosted Microsoft 365 tools. I'm wanting to update my staff training.

My understanding of HIPPA security is that all protected health information (PHI) should be secure at point of origin, in-transit, and at point of destination. Because our organization is all using the tools above, PHI related information could be shared by email between members of our organization, correct?

And secondly, what about patients who want to email us information - is there a way we can ensure that if they send us information, it is secure at all stages? In other words can we set our inboxes to only receive secure transmissions, even from users using @gmail, @yahoo, etc.?

0 comments

2 answers

Your answer

Answer 1

Hi Morrie,

Let me address each of your questions:

1/ Can staff email PHI internally?

Yes, staff members can exchange PHI between mailboxes within your Microsoft 365 organization, provided that:

Your Microsoft agreement includes the appropriate Business Associate Agreement, or BAA
Your Microsoft 365 environment is configured with appropriate security controls
Your organization’s HIPAA policies allow email to be used for PHI
Staff follow your approved procedures for handling PHI

Microsoft 365 provides security features such as encryption in transit, multifactor authentication, access controls, auditing, and device protection. However, having Microsoft 365 Business Premium doesn't make every email exchange HIPAA-compliant. Your organization is still responsible for configuring and using the services appropriately.

2/ Can Microsoft 365 ensure that incoming patient email is secure?

No. Microsoft 365 cannot control how a message was created, stored, or transmitted before it reached your organization. Even if Microsoft 365 receives the message over an encrypted TLS connection, that does not guarantee that the message was protected on the patient’s device or in the patient’s external mailbox.

3/ Can you accept only encrypted incoming messages?

Microsoft 365 can be configured to require TLS from specific organizations or trusted partners. This is most practical when communicating with known healthcare providers or business partners.

However, requiring TLS from every external sender is usually not recommended because:

Some legitimate patient messages may be rejected
Not every external email provider or sending system will meet the requirement
It still cannot guarantee that the message was secure on the patient’s device or in the patient’s mailbox

4/ The safer option

The preferred approach is to use:

A secure patient portal or upload form
A secure file-upload service approved by your organization
An encrypted email initiated by your organization
Microsoft Purview Message Encryption, where the patient opens and replies to a protected message

If a patient sends PHI through ordinary email without first using the approved secure method, your organization should have a procedure for handling it. For example, staff could transfer the information to the approved clinical system and continue the conversation through a secure channel. Your HIPAA privacy or security officer should approve the final workflow because compliance depends on both the technology and how your organization configures and uses it.

Hope this will help. Should you have any other questions, please feel free to share them in the comments of this post. I'm happy to assist you further.

Hendrix 2,335 Reputation points Independent Advisor

2026-10-16T22:19:56.1866667+00:00

Good day Morrie

Just checking in to see if you've reviewed the proposed answer. If you have any other questions, please feel free to reach out again.

Answer 2

Microsoft 365 cannot make an unsolicited email originating in any Gmail, Yahoo, or other external mailbox secure at every stage; for PHI, initiate the exchange with Microsoft Purview Message Encryption and have the patient reply through that protected conversation.

Email between staff

Yes, staff can exchange PHI between mailboxes in your Microsoft 365 organization, provided your organization has configured and governs Microsoft 365 appropriately:

Exchange Online encrypts connections between Exchange Online servers with TLS 1.2. Messages sent within your organization are automatically transported over an encrypted connection.^1^
Exchange Online is among the commercial Office 365 services covered by Microsoft’s HIPAA/HITECH offering. Microsoft’s HIPAA Business Associate Agreement (BAA) is available by default to covered entities and business associates for in-scope services.^2^
A BAA and an eligible service do not make the organization automatically HIPAA compliant. Your organization remains responsible for access controls, staff procedures, permitted disclosures, device security, retention, auditing, and its overall compliance program.^2^

TLS protects the connection while mail is moving between servers; it does not itself encrypt the stored message or prevent an authorized recipient from forwarding or copying it.^1^ For especially sensitive internal messages, use Purview Message Encryption or an appropriate rights-management option in addition to normal transport protection.

Email sent by patients

Ordinary Internet email uses opportunistic TLS: Exchange Online first attempts an encrypted TLS connection, but normal mail flow can continue without TLS when the other system does not support it. It also cannot control whether the patient’s device or mailbox was secure before the message reached Microsoft 365.^1^

Consequently, there is no inbox setting that can guarantee arbitrary incoming mail was protected:

on the patient’s device;
while stored in the patient’s mailbox;
before the sender submitted it to Gmail, Yahoo, or another provider;
after anyone outside your organization copied or forwarded it.

Requiring TLS can ensure transport encryption for accepted connections, but it would reject senders that cannot meet the requirement. Forced-TLS connectors are intended for known partner organizations that can use an agreed domain, IP address, or certificate—not arbitrary individual patients across public providers.^3^

Recommended patient workflow

Do not invite patients to start a PHI conversation through ordinary email. Publish a non-PHI contact address or instructions asking them to request a protected message.
Have a staff member initiate an encrypted message from Outlook or Outlook on the web using Encrypt or your organization’s approved encryption option.
Ask the patient to reply to that encrypted message. Purview Message Encryption encrypts replies made within the protected conversation.
Gmail and Yahoo recipients can authenticate and read or reply through the encrypted-message portal; recipients do not need their own Microsoft 365 subscription.^4^
For repeat intake, consider a purpose-built authenticated patient portal or secure form so PHI does not originate in ordinary email.

Microsoft 365 Business Premium includes Purview Message Encryption. Each user benefiting from the feature must have the appropriate license.^5^

Administrators can also create Exchange mail-flow rules that automatically encrypt outbound messages based on conditions such as external recipients, keywords, or sensitive-information types.^4^ This reduces reliance on staff remembering to select encryption manually, but the policy should first be tested against your actual clinical and operational workflows.

Points to include in staff training

Use only organizational Microsoft 365 accounts for PHI.
Verify recipients before sending.
Use encrypted messages for patient and other external communications containing PHI.
Ask patients to reply inside the encrypted conversation rather than creating a new ordinary email.
Do not place PHI in the subject line; encryption policies may protect message content, while notification and routing metadata can remain visible.
Treat unsolicited PHI received by ordinary email under your documented incident/intake procedure rather than replying with more PHI in an unprotected thread.
Confirm the BAA, compliance configuration, access policies, and training requirements with your HIPAA privacy/security officer or legal adviser.

References