HIPPA security of incoming emails to Microsoft 365

Morrie Med 0 Reputation points
2026-10-15T19:40:00.7066667+00:00

We recently moved to Microsoft Business Premium and are using cloud hosted Microsoft 365 tools. I'm wanting to update my staff training.

My understanding of HIPPA security is that all protected health information (PHI) should be secure at point of origin, in-transit, and at point of destination. Because our organization is all using the tools above, PHI related information could be shared by email between members of our organization, correct?

And secondly, what about patients who want to email us information - is there a way we can ensure that if they send us information, it is secure at all stages? In other words can we set our inboxes to only receive secure transmissions, even from users using @gmail, @yahoo, etc.?

Outlook | Web | Outlook on the web for business | Security
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-10-15T19:40:53.6166667+00:00

    Microsoft 365 cannot make an unsolicited email originating in any Gmail, Yahoo, or other external mailbox secure at every stage; for PHI, initiate the exchange with Microsoft Purview Message Encryption and have the patient reply through that protected conversation.

    Email between staff

    Yes, staff can exchange PHI between mailboxes in your Microsoft 365 organization, provided your organization has configured and governs Microsoft 365 appropriately:

    • Exchange Online encrypts connections between Exchange Online servers with TLS 1.2. Messages sent within your organization are automatically transported over an encrypted connection.^1^
    • Exchange Online is among the commercial Office 365 services covered by Microsoft’s HIPAA/HITECH offering. Microsoft’s HIPAA Business Associate Agreement (BAA) is available by default to covered entities and business associates for in-scope services.^2^
    • A BAA and an eligible service do not make the organization automatically HIPAA compliant. Your organization remains responsible for access controls, staff procedures, permitted disclosures, device security, retention, auditing, and its overall compliance program.^2^

    TLS protects the connection while mail is moving between servers; it does not itself encrypt the stored message or prevent an authorized recipient from forwarding or copying it.^1^ For especially sensitive internal messages, use Purview Message Encryption or an appropriate rights-management option in addition to normal transport protection.

    Email sent by patients

    Ordinary Internet email uses opportunistic TLS: Exchange Online first attempts an encrypted TLS connection, but normal mail flow can continue without TLS when the other system does not support it. It also cannot control whether the patient’s device or mailbox was secure before the message reached Microsoft 365.^1^

    Consequently, there is no inbox setting that can guarantee arbitrary incoming mail was protected:

    • on the patient’s device;
    • while stored in the patient’s mailbox;
    • before the sender submitted it to Gmail, Yahoo, or another provider;
    • after anyone outside your organization copied or forwarded it.

    Requiring TLS can ensure transport encryption for accepted connections, but it would reject senders that cannot meet the requirement. Forced-TLS connectors are intended for known partner organizations that can use an agreed domain, IP address, or certificate—not arbitrary individual patients across public providers.^3^

    1. Do not invite patients to start a PHI conversation through ordinary email. Publish a non-PHI contact address or instructions asking them to request a protected message.
    2. Have a staff member initiate an encrypted message from Outlook or Outlook on the web using Encrypt or your organization’s approved encryption option.
    3. Ask the patient to reply to that encrypted message. Purview Message Encryption encrypts replies made within the protected conversation.
    4. Gmail and Yahoo recipients can authenticate and read or reply through the encrypted-message portal; recipients do not need their own Microsoft 365 subscription.^4^
    5. For repeat intake, consider a purpose-built authenticated patient portal or secure form so PHI does not originate in ordinary email.

    Microsoft 365 Business Premium includes Purview Message Encryption. Each user benefiting from the feature must have the appropriate license.^5^

    Administrators can also create Exchange mail-flow rules that automatically encrypt outbound messages based on conditions such as external recipients, keywords, or sensitive-information types.^4^ This reduces reliance on staff remembering to select encryption manually, but the policy should first be tested against your actual clinical and operational workflows.

    Points to include in staff training

    • Use only organizational Microsoft 365 accounts for PHI.
    • Verify recipients before sending.
    • Use encrypted messages for patient and other external communications containing PHI.
    • Ask patients to reply inside the encrypted conversation rather than creating a new ordinary email.
    • Do not place PHI in the subject line; encryption policies may protect message content, while notification and routing metadata can remain visible.
    • Treat unsolicited PHI received by ordinary email under your documented incident/intake procedure rather than replying with more PHI in an unprotected thread.
    • Confirm the BAA, compliance configuration, access policies, and training requirements with your HIPAA privacy/security officer or legal adviser.

    References

    1. How Exchange Online uses TLS to secure email connections
    2. Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act
    3. Configure mail flow using connectors in Exchange Online
    4. Message encryption
    5. Microsoft Purview service description
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

    1 person found this answer helpful.
  2. Hendrix 2,690 Reputation points Independent Advisor
    2026-10-15T20:41:24.4333333+00:00

    Hi Morrie,

    Let me address each of your questions:

    1/ Can staff email PHI internally?

    Yes, staff members can exchange PHI between mailboxes within your Microsoft 365 organization, provided that:

    • Your Microsoft agreement includes the appropriate Business Associate Agreement, or BAA
    • Your Microsoft 365 environment is configured with appropriate security controls
    • Your organization’s HIPAA policies allow email to be used for PHI
    • Staff follow your approved procedures for handling PHI

    Microsoft 365 provides security features such as encryption in transit, multifactor authentication, access controls, auditing, and device protection. However, having Microsoft 365 Business Premium doesn't make every email exchange HIPAA-compliant. Your organization is still responsible for configuring and using the services appropriately.

    2/ Can Microsoft 365 ensure that incoming patient email is secure?

    No. Microsoft 365 cannot control how a message was created, stored, or transmitted before it reached your organization. Even if Microsoft 365 receives the message over an encrypted TLS connection, that does not guarantee that the message was protected on the patient’s device or in the patient’s external mailbox.

    3/ Can you accept only encrypted incoming messages?

    Microsoft 365 can be configured to require TLS from specific organizations or trusted partners. This is most practical when communicating with known healthcare providers or business partners.

    However, requiring TLS from every external sender is usually not recommended because:

    • Some legitimate patient messages may be rejected
    • Not every external email provider or sending system will meet the requirement
    • It still cannot guarantee that the message was secure on the patient’s device or in the patient’s mailbox

    4/ The safer option

    The preferred approach is to use:

    • A secure patient portal or upload form
    • A secure file-upload service approved by your organization
    • An encrypted email initiated by your organization
    • Microsoft Purview Message Encryption, where the patient opens and replies to a protected message

    If a patient sends PHI through ordinary email without first using the approved secure method, your organization should have a procedure for handling it. For example, staff could transfer the information to the approved clinical system and continue the conversation through a secure channel. Your HIPAA privacy or security officer should approve the final workflow because compliance depends on both the technology and how your organization configures and uses it.

    Hope this will help. Should you have any other questions, please feel free to share them in the comments of this post. I'm happy to assist you further.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.