Four rules, in plain English.
What each regulation actually asks of email, what it doesn’t, and where PXCMail maps to it. Written for the person who has to sign the form.
Overview
HIPAA & the BAA
Security Rule technical safeguards, the 2025 update, and what a BAA commits to.
Read →FTC Safeguards Rule & IRS Pub 4557
Who it applies to, the nine WISP elements, the PTIN question.
Read →ABA Opinion 477R & ALTA Pillar 3
Reasonable efforts, wire-fraud guidance, litigation holds.
Read →Advisers Act Rule 204-2
Books and records for RIAs, and how it differs from broker-dealer Rule 17a-4.
Read →The short version
None of these four rules names a product, and none of them bans email. Each one asks a small firm to do roughly the same things: know what sensitive data moves through email, encrypt it when it leaves, keep a record that cannot be quietly altered, control who can sign in, and write down what you decided. The differences are in who enforces the rule, how long records must be kept, and what paperwork the vendor has to sign. The table puts the four side by side; the linked pages go deeper into each one.
Four rules side by side
| Rule | Who it applies to | What it asks of email | Retention | What PXCMail maps to |
|---|---|---|---|---|
| HIPAA Security Rule (45 CFR 164.308, 164.312) | Covered entities (practices, plans, clearinghouses) and their business associates | Access control, audit controls, integrity, authentication and transmission security for ePHI; a BAA with any vendor that handles PHI; breach notice to individuals within 60 days under Subpart D | Security documentation 6 years (164.316); the Rule sets no email retention period, so most practices keep mail for the same 6 years | Enforced TLS, locked delivery, PHI detection packs, per-message audit trail, 6-year archive on the healthcare profile, BAA signed in signup |
| FTC Safeguards Rule (16 CFR 314) | Non-bank financial institutions: tax preparers, accounting firms that prepare returns, mortgage brokers, insurance agencies and similar | A written program with encryption in transit and at rest (314.4(c)(3)), MFA (c)(5), staff training (e), service-provider contracts (f), and FTC notice within 30 days of an event affecting 500 or more consumers (j); firms under 5,000 consumers skip some written elements under 314.6 | No email period in the Rule; IRS Publication 4557 expects a retention decision in the WISP. PXCMail defaults to 7 years on the accounting profile | Enforced TLS, W-2/1099/1040 fingerprints and SSN detection, MFA, forwarding controls, 7-year archive, Data Processing & Safeguards Addendum with 314.4(f) terms |
| ABA Opinion 477R and ALTA Best Practices | Lawyers (Model Rule 1.6(c) reasonable efforts) and title and settlement agents (ALTA Pillar 3) | A judgment about which matters need more than ordinary email, encryption for the sensitive ones, protection of wire instructions, and a litigation hold that works | Set by state bar file-retention rules and underwriter requirements, not by 477R; PXCMail defaults to 6 years on the legal and title profile | Enforced TLS, locked delivery for privileged documents and wire instructions, matter-number detection, legal hold by matter or custodian, EML/PST exports with chain of custody |
| Advisers Act Rule 204-2 (17 CFR 275.204-2) | SEC-registered investment advisers; state-registered advisers under equivalent state rules | Keep originals of written communications received and copies sent about advice, funds and orders (a)(7); electronic records indexed, promptly producible and safeguarded against alteration (g); advertisements under the Marketing Rule | Five years from the end of the fiscal year of the last entry, first two years easily accessible (e)(1) | 100% journaling, immutable storage with a cross-region copy, 5-year retention with everything searchable, exports by custodian, date and keyword, books-and-records vendor letter |
Broker-dealers follow Exchange Act Rule 17a-4 and FINRA Rule 3110, which are stricter than 204-2. A broker-dealer edition of PXCMail is ROADMAP, not live.
How to use these pages
- Open the page for your rule and read the “what it requires” section with your written program or policy manual next to it. Mark each requirement as met, partly met or not met.
- For each gap, note whether it is a technology control (encryption, archive, MFA) or a paper control (a signed agreement, a training record, a retention decision). PXCMail closes the first kind; you close the second kind, and the pages say which is which.
- Take the mapping table from the page into the email section of your program. Auditors, carriers and examiners accept a table that cites the rule paragraph next to the control.
- Open the matching checklist and fill in the twelve answers. The compliance scanner checks the domain questions (TLS, SPF, DKIM, DMARC) for you.
- Sign the matching agreement during signup: the BAA for healthcare, the Data Processing & Safeguards Addendum for accounting, legal and wealth firms. The countersigned copy lives in your console.
Example
Daniel Ortiz, partner at a nine-person CPA firm, has a PTIN renewal in front of him that asks whether the firm has a written data security plan. He reads the Safeguards page, finds that 314.4(c)(3) and (c)(5) are the paragraphs that touch email, and confirms that the firm is under the 5,000-consumer threshold in 314.6. His remaining paper work is a named qualified individual (himself), a training record and a service-provider contract. The addendum from signup covers the last item.
FAQ
Which rule applies if we are a dental office that also offers payment plans?
HIPAA for patient information. The Safeguards Rule reaches businesses that extend credit as a significant activity; ask your counsel whether your payment plans qualify. The email controls are the same either way; the paperwork differs.
Does PXCMail make us compliant with any of these?
No vendor can. Each rule also asks for things that live in your office: a named responsible person, training, risk decisions and written policies. PXCMail provides the email controls and the evidence that they ran.
Is the 2025 HIPAA Security Rule update in force?
No. The January 2025 proposed rule is a proposal, not a final rule. We build to it because the direction (encryption, MFA, restore within 72 hours) is clear, but the current rule is what an auditor applies today.
Where do fines fit in?
They are a tail risk. HHS publishes its resolution agreements; a small firm is far more likely to meet a carrier questionnaire or an exam request than an enforcement action.
Related
Trust Center · Checklists · Agreements and policies · Security