Email is the part of your HIPAA program nobody owns. Now it has an owner.
Your EHR is covered. Your fax line is covered. Email — the channel staff use for everything else — is usually “we have a BAA with Google”. PXCMail gives it enforced encryption, PHI detection, an archive and an audit trail, for less than the cost of one staff hour per month.
| Require TLS to every recipient | On |
| Encrypt when PHI detected (MRN, DOB, ICD-10) | On |
| EHR sender routed through Gateway | On |
| Block forward to personal mail | On |
| Archive every message | 1 year |
Overview
Primary & specialty care
Referral letters, lab results, prior auths, patient questions — encrypted where needed, logged always.
Physical & occupational therapy
Plans of care to physicians, progress notes to case managers, with S/MIME to partners who support it.
Urgent care & clinics with turnover
New staff get the policy automatically. Offboarding revokes access and keeps the mailbox under retention.
For the compliance officer
- Written policy templates, versioned, reflected in the audit trail
- Annual compliance letter from PXCMail for your risk analysis file
- Exports mapped to the HHS audit protocol questions
- Breach support: a list of affected recipients from the audit trail within hours
For the practice manager
- Nothing new for staff to learn
- 30-minute setup; DNS done on a call
- One invoice, seat count follows your directory
- Human support in 15 minutes
What a small practice needs from email under HIPAA
A primary-care or specialty practice needs four things from email: encryption that happens without staff deciding, a way to stop PHI going to the wrong place, a record of every message for six years, and a BAA with the vendor in the path. The Security Rule asks for transmission security and access control (45 CFR 164.312), a named owner for the risk analysis and workforce training (164.308), and six-year retention of policies and action records (164.316). HHS’s own FAQ 570 confirms providers may email patients about their care, provided reasonable safeguards are in place. PXCMail is those safeguards on the Google or Microsoft account you already run. It is not an EHR, a patient portal or a fax replacement, and it is not a certification.
A week at a 12-person primary-care practice
Two physicians, a nurse practitioner, a practice manager and eight staff on Microsoft 365, with athenahealth for the chart. The practice manager owns compliance alongside everything else.
- Monday. Referral letters go to a cardiology group and an orthopedic practice. Both carry a name, date of birth and ICD-10 codes; the clinical-code detector marks them PHI. The cardiology group publishes S/MIME, so that one is encrypted automatically; the orthopedic practice gets locked delivery and opens with a code.
- Tuesday. A patient emails from Gmail asking about a lab result. The nurse replies with the values. Policy sees the MRN in the thread and the reply goes out encrypted, exactly as FAQ 570 expects.
- Wednesday. athenahealth sends appointment reminders and a batch of visit summaries on the practice’s behalf. They route through Gateway and get the same policy as a human sender.
- Thursday. A medical assistant forwards a prior-auth with a patient list to her own address to finish at home. Policy: block. She gets a bounce with guidance; the practice manager sees it in the audit log.
- Friday. A payer asks for proof a prior-auth was sent on the 3rd. Archive search finds it, with the TLS record and delivery time, in under a minute.
By the numbers
- 60 days after discovery is the deadline to notify affected patients of a breach of unsecured PHI; a breach affecting 500 or more people also goes to HHS and prominent media. (45 CFR 164, Subpart D; the public list is the HHS breach portal)
- Encrypted means not “unsecured”. HHS guidance treats PHI encrypted to its standard as secured, so a misdirected encrypted message is a near miss, not a reportable breach. (HHS guidance on unsecured PHI)
- 98% of cyber claims in the 2025 NetDiligence study came from small and mid-sized businesses. (NetDiligence Cyber Claims Study 2025)
Two more things to know. HHS has proposed, but not finalized, a Security Rule update that would make encryption and MFA required rather than addressable (January 2025 NPRM). And settlements are a tail risk; the record is on the HHS resolution agreements page.
What the auditor asks
“Show me your risk analysis covers email.” The annual safeguards letter describes the controls in force; the quarterly compliance report shows them operating. Both go in the file.
“How do you know PHI was encrypted in transit?” Every message has a record: sender, recipient, policy decision and reason, encryption method, opens. Exports are mapped to the HHS audit protocol questions.
“Who can read patient email, and from where?” Your staff by role; PXCMail staff only in the US, logged. Tier-1 support sees configuration and metadata, never content.
“What did you do about the message that went to the wrong patient?” Revoke the locked-delivery link in the console; the audit trail shows whether it was opened before revocation. That answer decides whether it is a breach.
“Do you have a BAA with your email vendor?” Yes, with PXCMail, signed in signup, alongside your Microsoft or Google BAA.
Going live
- Start the trial and sign the BAA
Healthcare profile, 14 days, $0 charged. Card or PayPal on file. - Connect Microsoft 365 or Google Workspace
DNS wizard with a five-minute re-check; support stays on the call until it is green. - Test mode for one week
Watch what would be encrypted, held or blocked. Tune the clinical-code and MRN detectors to your charting conventions. - Route athenahealth, Tebra or eClinicalWorks
Anything your EHR sends through your Microsoft or Google account inherits the policy; no integration work. - Enforce and train
Switch to enforce; the ten-minute staff note covers the bounce messages and the [SECURE] subject tag.
What the 12-person practice pays
- Gateway, 12 seats
- $72 per month, billed yearly
- Gateway + 6-year archive
- $108 per month ($9 per seat)
- Hosted mailboxes
- $144 per month, 50 GB each, device policies and remote wipe
- Hosted Pro
- $216 per month with immutable 6-year archive, legal hold and contractual SLA
The BAA, detection, locked delivery and audit trail are in every tier. Organization minimum $49.
Questions practices ask
Our EHR already has secure messaging. Why email?
Because referrals, lab follow-ups, payer questions and patient replies still arrive and leave by email. PXCMail covers that channel; it does not touch the EHR.
Can patients reply to an encrypted message?
Yes, from the same page, without an account or app. Replies come back encrypted and are archived with the thread. English and Spanish.
What counts as PHI for detection?
Identifiers such as MRN, SSN and dates of birth, clinical codes (ICD-10, CPT), document fingerprints and your own keyword lists. Rules are deterministic, so the reason for every decision is shown.
We are a physical therapy clinic sending plans of care. Same setup?
Yes. Plans of care and progress notes to physicians and case managers follow the same policy; partners with S/MIME get it automatically.
Do we need the archive add-on?
Gateway keeps one year. If you want email covered by the same six-year horizon as your other HIPAA documentation, add the archive for $3 per seat.
What is still on the roadmap?
SOC 2 Type I, the Outlook and Gmail add-ins, SCIM and URL detonation are ROADMAP. Nothing on this page depends on them.