Plain answers to compliance email questions.
Written for office managers and practice owners, reviewed by people who have read the regulation.
Overview
A BAA from Google isn’t a control
What Google Workspace’s BAA covers, what it doesn’t, and the four things you still need.
Read →PDF, portal or TLS? How patients actually receive encrypted email
The three delivery methods, what each feels like on a phone, and when each is the right call.
Read →What HIPAA email costs in 2026
Real prices from Google, Microsoft, Hushmail, Paubox and PXCMail for a 10-person practice.
Read →The Safeguards Rule is about your email, not your portal
Why the FTC rule bites accounting firms at the inbox, and the four controls that satisfy it.
Read →Rule 204-2 archiving without enterprise prices
What the rule requires, what examiners ask, and what it should cost a five-person firm.
Read →What the 2025 HIPAA Security Rule update means for a 12-person practice
Encryption, MFA, inventories, testing, 72-hour restore — and what email has to do with it.
Read →“TLS usually” is not a control
The 1–3% that weren’t encrypted, and why regulators ask for the control, not the average.
Read →How to read an SEC exam request list
What each communications item really asks, and answering them in an afternoon.
Read →A WISP in a weekend for tax preparers
The nine elements and how to write the email section truthfully.
Read →Business email compromise at a title company: the first 60 minutes
Bank recall, IC3, carrier, clients, evidence — in order.
Read →Editorial calendar: two articles a month, alternating industries; every article reviewed against the primary regulation before publication. More at launch: the 42 CFR Part 2 email guide, DMARC for practices, what to do in the first hour after a misdirected email.