HIPAA Compliant Email for Therapists

It’s 7:40pm. Maya’s last client, Jordan, asked her to email tonight’s thought log to a personal address before tomorrow’s session. The note is open. The send button is under her thumb. She fills the HIPAA compliant email for therapists card before the message leaves: the inbox, the written agreement, the encryption note, and the stop row. Role inventory and the annual review are on the HIPAA guide for solo therapists. Contract clauses are on the business associate agreement guide for therapists.

Fill every row before the message leaves. A blank stop row means you have not decided.

Maya’s card, filled for tonight, looks like this. Jordan asked for a personal webmail address. Maya’s practice mail lives on a host that stores messages. She has not asked that host for a written agreement. She has not written down an encryption decision. Jordan did not hear the risks. The thought log names a fight with his sister and a sleep number. That is more than a scheduling line, and she has not named another safeguard for that unencrypted path.

Educational resource for licensed mental-health clinicians in US practice. HIPAA materials change. The two HHS FAQ links below are archived copies, because the live HHS pages returned Access Denied on September 24, 2026. Verify current guidance before you rely on a workflow. This card is not legal advice.

The wider map sits on the therapy compliance hub. Come back here when the only question is which inbox can carry the next client message.

What HIPAA compliant email for therapists decides

The click you wanted was a brand name. The decision you actually have is smaller. Can this inbox carry client communication tonight, what has to be true first, and what do you stop using today?

HHS has already answered the email question. In FAQ 570, archived September 8, 2026, the answer is yes, with a condition. The Privacy Rule allows covered health care providers to communicate electronically, such as through email, with their patients, provided they apply reasonable safeguards when doing so. The same answer points to 45 CFR 164.530(c). It also says the Privacy Rule does not prohibit the use of unencrypted email for treatment-related communications between health care providers and patients. Other safeguards should be applied to reasonably protect privacy, such as limiting the amount or type of information disclosed through the unencrypted email. The same answer says covered entities will want to ensure that any transmission of electronic protected health information complies with the Security Rule at 45 CFR Part 164, Subpart C.

FAQ 2006, archived May 11, 2026 is the Security Rule companion. The Security Rule does not expressly prohibit the use of email for sending electronic protected health information. The standards for access control at 45 CFR 164.312(a), integrity at 164.312(c)(1), and transmission security at 164.312(e)(1) require a covered entity to implement policies and procedures to restrict access to, protect the integrity of, and guard against unauthorized access to that information. Transmission security also includes addressable specifications for integrity controls and encryption. HHS says that means the covered entity must assess its use of open networks, identify the available and appropriate means to protect the information as it is transmitted, select a solution, and document the decision. The Security Rule allows that information to be sent over an electronic open network as long as it is adequately protected.

The question is whether you can fill six rows without inventing a yes.

Current email setup

Write the inbox you would actually send from. Not the one you wish you had.

If that inbox is Gmail, the pass or fail is whether Gmail is HIPAA compliant, not a guess from the app on your phone.

Maya almost sent from Jordan’s personal address because that is the address he typed. That inbox is not her practice. She does not control who else can open it, how long it keeps a copy, or whether the host will sign anything. Name it as personal or unknown. That row is a no.

Her practice host is a different row. She pays for it. She can log in. It still stores every message on the host’s servers. Naming the host is not the same as clearing the agreement row.

If you cannot name the host, the setup row stays a no. “The one on my phone” is not a setup.

When the host needs a business associate agreement

A business associate, under 45 CFR 160.103, is a person who, on behalf of a covered entity and not as workforce, creates, receives, maintains, or transmits protected health information for a function regulated by HIPAA. The definition also includes a person that provides data transmission services and requires access on a routine basis. It does not include a health care provider, with respect to disclosures about the treatment of the individual.

Read that against an inbox. If the host stores client messages, it maintains them. That is the definition, not a marketing label. A treating colleague who receives a consult about Jordan’s care is not your email host, and the definition carves that treatment disclosure out of the business-associate bucket. Do not mix those two people up on the card.

45 CFR 164.502(e) says you may disclose protected health information to a business associate, and may allow that associate to create, receive, maintain, or transmit it on your behalf, if you obtain satisfactory assurances that the associate will safeguard the information. Those assurances must be documented through a written contract or other written agreement that meets 45 CFR 164.504(e). 45 CFR 164.314 then says the contract required by 45 CFR 164.308(b)(3) must provide that the associate will comply with the applicable Security Rule requirements, bind subcontractors who handle electronic protected health information, and report security incidents.

The card’s BAA row is a yes only when that written agreement is in the file before client content moves. “They have a HIPAA page” is not the agreement. Clause-by-clause review belongs on the business associate agreement guide for therapists.

If the host will not give you the written agreement, the row is a no. Stop using that inbox for client content. Do not wait for a quieter week.

Encryption in transit and at rest

Transmission security is a required standard. 45 CFR 164.312(e)(1) says you implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network. The encryption specification under that standard, 164.312(e)(2)(ii), is addressable: implement a mechanism to encrypt electronic protected health information whenever deemed appropriate. Encryption and decryption at 164.312(a)(2)(iv) is also addressable: implement a mechanism to encrypt and decrypt electronic protected health information.

Addressable is not a synonym for optional, and it is not a synonym for always required. 45 CFR 164.306(d) says that when a standard includes addressable implementation specifications, a covered entity or business associate must assess whether each specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting electronic protected health information. If it is reasonable and appropriate, implement it. If it is not, document why it would not be reasonable and appropriate to implement it, and implement an equivalent alternative measure if that alternative is reasonable and appropriate.

FAQ 2006 applies the transmission decision to electronic open networks. A covered entity must assess its use of those networks, identify the available and appropriate means to protect the information as it is transmitted, select a solution, and document the decision. A blank encryption row is not that documented decision. That row is the encryption line on a HIPAA compliant email for therapists card, and “not assessed” is a no.

You do not need a product name in the cell. You need the mechanism, or the written equivalent, and the date you wrote it down. Password length, device lock, and the annual review sit on the HIPAA guide for solo therapists.

Client consent to unencrypted email

FAQ 570 is specific. The Privacy Rule does not prohibit unencrypted email for treatment-related communications between health care providers and patients. Other safeguards should be applied to reasonably protect privacy, such as limiting the amount or type of information disclosed that way. An individual has the right under the Privacy Rule to request and have a covered health care provider communicate with the individual by alternative means or at alternative locations, if reasonable. The FAQ cites that right to 45 CFR 164.522(b). The regulation says a covered health care provider must permit individuals to request, and must accommodate reasonable requests by individuals to receive, protected health information by alternative means or at alternative locations. If unencrypted email is unacceptable to a patient who requests confidential communications, the FAQ says other means, such as a more secure electronic method, mail, or telephone, should be offered and accommodated.

Patients may initiate email with a provider. If they do, the FAQ says the provider can assume, unless the patient has explicitly stated otherwise, that email is acceptable. If the provider feels the patient may not be aware of the possible risks of using unencrypted email, or has concerns about potential liability, the provider can alert the patient of those risks and let the patient decide whether to continue. The FAQ says “can.” It does not say the provider must send a risk note before every reply to a patient who started the thread.

Maya’s miss was the alert she could have given. Jordan asked. She had not told him that a personal inbox can be forwarded, left open on a shared computer, or kept by a host she does not control. The card’s yes is narrower than the assumption the FAQ allows. It is a yes only when the client initiated the email, or accepted it after she named the risk. A hallway “email is fine” with no risk named is not the row. The FAQ’s assumption is not a substitute for a blank cell. A no on that row is the card’s own bar. If you initiate an unencrypted email and believe the patient may not know its risks, consider alerting the patient and let them decide whether to continue. Apply reasonable safeguards to the message.

If he then says he still wants the message in ordinary email, write what you told him and what he chose. That note is your evidence. It is not a magic form the regulation prints for you. If he says he wants a more secure path, accommodate that. Do not talk him back into the risky one because it is faster at 7:40pm.

Minimum necessary content

Two rules get mashed together here. Keep them apart on the card.

45 CFR 164.502(b) says that when you use or disclose protected health information, or request it from another covered entity or business associate, you make reasonable efforts to limit it to the minimum necessary to accomplish the purpose. That requirement does not apply to disclosures to or requests by a health care provider for treatment. It does not apply to uses or disclosures made to the individual. It also does not apply to uses or disclosures made under an authorization, or to disclosures required by law, among other listed exceptions.

An email to Jordan about Jordan’s own care is a disclosure to the individual. The minimum necessary standard does not apply to that disclosure. An email to a colleague who is treating him can fall under the treatment exception. An email to his school, his spouse, a billing contact, or a supervisor who is not treating him usually does not. For those recipients, the message has to be as thin as the job.

Unencrypted email has a second limit that is not the minimum necessary standard. FAQ 570 says other safeguards should be applied to reasonably protect privacy, such as limiting the amount or type of information disclosed through unencrypted email. Limiting the amount is an example, not the only safeguard the answer names. That example can apply even when the recipient is the client, because it is not the minimum necessary standard.

Jordan’s thought log fails that example if the path is unencrypted and Maya has named no other safeguard. A scheduling line might not. The card asks you to write who receives it and which limit applies, then mark yes only if the rule that actually applies is met, and, when the path is unencrypted, a safeguard is named. “I was emailing the client, so I can paste the chart” is the mistake.

What to stop using today

Would you put that thought log in an inbox you cannot name? If the answer is no, the stop row should already be filled.

Stop these before the next send:

• An inbox whose host stores client content and has no written agreement. 45 CFR 164.502(e) allows that disclosure only with satisfactory assurances in a written contract. No contract, no client content in that inbox.
• A fat message to someone who is not the client and not a treating provider. 45 CFR 164.502(b) still asks for the minimum necessary on that disclosure, unless another listed exception fits.
• A blank encryption row on an electronic open network. FAQ 2006 says the covered entity must assess, identify an available and appropriate means, select a solution, and document the decision. A blank cell is not that documentation.

If you initiate an unencrypted email and believe the patient may not know its risks, consider alerting the patient and let them decide whether to continue. Apply reasonable safeguards to the message. FAQ 570 says the Privacy Rule does not prohibit unencrypted email for treatment-related communications between health care providers and patients. Other safeguards should be applied to reasonably protect privacy. A provider can assume email is acceptable when the patient initiates it, unless the patient has explicitly stated otherwise. The FAQ does not give that assumption when you start the thread. If you think the patient may not know the risks, or you have concerns about potential liability, the FAQ says you can alert them and let them decide whether to continue.

The last row of HIPAA compliant email for therapists is the one people skip. Maya’s stop row is the personal address, and the practice host until the agreement is in the file. She can call Jordan. She can tell him, in that call, what ordinary email risks, and let him choose. She does not get to send the log while the agreement is missing and the encryption row is blank.

Stopping is not the same as deleting an account, shredding a vendor, or declaring a product illegal. It means client content does not move through that path today.

Where the rest of the work lives

Fill the inbox, the written agreement, the encryption note, and the stop row here before the next message leaves. The day-to-day safeguard pass, not just the inbox, is the HIPAA safeguard checklist. The HIPAA guide for solo therapists holds the role inventory, the device workflow, password rules, unique logins, and the annual review. When the agreement’s clauses are the question, use the business associate agreement guide for therapists.

If the thought log belongs in the chart, keep it in the chart. Pasting it into an inbox you have not cleared is how a documentation habit becomes a disclosure. Security on the product side is a separate question from which inbox you use tonight.

Fill the HIPAA compliant email for therapists card before the next client message leaves your outbox. Then put the note where it belongs.

See how Emosapien holds the session note