AegisAI Perspectives · 019
Email security for healthcare means HIPAA transmission security, one identity per user, audit logs and training on every mailbox, plus the breach clocks.
Email security for healthcare means applying the HIPAA Security Rule to every mailbox: transmission security, one identity per user, audit controls and workforce training11. Phishing opened 14% of healthcare breaches in the 2026 DBIR2. AegisAI reads each inbound message for what it is trying to do, so a lure is removed before staff see or click it.
The 2026 DBIR counts 1,492 healthcare incidents, 1,438 of them with confirmed data disclosure1. The human element was present in 54% of those breaches and a third party in 32%3. HHS reports that from 2018 to 2023 breaches of unsecured health information reported to it grew 100 percent, and the number of people affected grew 950 percent5.
The essential safeguards are the ones the Security Rule already names, put in place in this order. Steps 1 to 3 settle identity and the delivery path. Steps 4 to 6 protect content and records. Steps 7 and 8 cover people and response.
Start from the risk analysis. The rule requires an accurate and thorough assessment of risks to the confidentiality, integrity and availability of ePHI17. List every mailbox and shared inbox, plus each system that sends patient data by email.
Give every person one mailbox identity and prove it at sign-in. Unique user identification is Required, and person or entity authentication is a standard of its own13. The HHS Email Security goal lists MFA for Email Access as a practice22. Shared inboxes get named delegates instead of a shared password.
Encrypt the path to every partner who receives ePHI. Transmission security guards ePHI sent over an electronic communications network. Exchange Online uses opportunistic TLS by default and can force TLS for medical organizations through connectors24.
Decide on message encryption and write the decision down. Encryption of transmitted ePHI is Addressable12. Addressable means you implement it when reasonable and appropriate, or document why not and put an equivalent measure in place15. TLS encrypts the connection and not the message, so a forwarded message can leave the encrypted path.
Authenticate your sending domains. Publish SPF and DKIM, then raise DMARC from p=none to p=reject in stages, as set out in how to roll out DMARC without breaking mail.
Log mailbox activity. The audit controls standard requires mechanisms that record and examine activity in systems that hold ePHI14. Turn on mailbox audit logging and alert on new forwarding rules, a step attackers use after they take over a mailbox, as shown in how email account takeover works.
Train the whole workforce, management included. The rule requires a security awareness and training program for every workforce member, with protection from malicious software and log-in monitoring as addressable items16. Give staff one button to report a suspicious message.
Write the response for a phished mailbox before you need it. Notice to patients is due no later than 60 calendar days after discovery18. At 500 or more individuals, HHS hears at the same time as the patients.
AegisAI investigates every inbound email for what it is trying to do, as its inbound email security page sets out, and removes the ones that fail from every mailbox they reached6. It reads mail through the email platform's API after delivery10. MX records and mail routing stay as they are. Every verdict comes with its reason in plain language, so the security or privacy officer can check it and keep it with the incident record25. It starts read-only in monitoring mode, and removal needs write access that your admin grants and can revoke.
The rule in force in 2026 still marks email encryption Addressable. In January 2025 HHS proposed to require encryption of all ePHI at rest and in transit8, to expressly require MFA23 and to drop the addressable label9. Until a final rule is published, keep evidence against the text in force.
| Email control | Where the rule says it | Required or addressable today | Evidence to keep |
|---|---|---|---|
| Risk analysis that lists every mail system | 164.308(a)(1)(ii)(A) | Required | The written analysis with email in scope |
| One identity per mailbox user | 164.312(a)(2)(i) | Required | Directory export with no shared logins |
| Verify the person at sign-in | 164.312(d) | Standard | MFA enrollment report |
| Guard ePHI sent over a network | 164.312(e)(1) | Standard | Forced TLS policy for partner domains |
| Encrypt transmitted ePHI | 164.312(e)(2)(ii) | Addressable | Decision record under 164.306(d)(3) |
| Record and examine mailbox activity | 164.312(b) | Standard | Audit log retention setting |
| Train every workforce member | 164.308(a)(5) | Standard, items addressable | Training roster with dates |
| Contract terms with the email provider | 164.314(a)(2)(i) | Required7 | Signed business associate contract |
One phished mailbox can start every clock in the Breach Notification Rule.
Illustrative example, figures are fictional. A clinic group with 40 clinicians bills through one shared billing team. A billing coordinator types a password into a fake sign-in page on a Tuesday. The attacker adds a mailbox rule that forwards every message with "claim" in the subject to an outside address. The mailbox holds claim records for 620 patients. The security officer finds the rule 9 days later, and that day becomes the discovery date. Because 620 is 500 or more, HHS is notified with the patient letters. If more than 500 of those patients live in one state, prominent media outlets serving that state are notified too20. The last day for patient notice is 60 calendar days after discovery.
The first step in that story, a credential phish with no payload, is traced in how a credential phishing email led to a Microsoft 365 mailbox breach.
The top email threats are phishing that opens the door, stolen credentials that keep it open, and payment fraud sent from trusted accounts. In 2026 DBIR healthcare breaches, phishing was the initial access vector in 14%, credential abuse in 11% and exploitation of vulnerabilities in 20%. System Intrusion leads the three patterns behind 81% of healthcare breaches; Miscellaneous Errors and Social Engineering are the other two4.
A payment change request from a vendor's real but compromised mailbox passes sender checks, which is why the controls in how to prevent business email compromise rest on a callback rule.
A third party was involved in 32% of healthcare breaches, so the mail your vendors send you belongs in the risk analysis.
Evaluate them first on the contract they sign and where they sit. Then check what they record and what they do after delivery. The covered entity stays responsible under the rule; a product supplies controls and evidence.
Track three numbers. Each one already sits in a system you run.
Not by name today. Encryption of transmitted ePHI is Addressable, so you encrypt where reasonable and appropriate or document why not and adopt an equivalent measure. The January 2025 proposal would require encryption of all ePHI in transit.
The rule in force requires procedures that verify a person seeking access is the one claimed. It does not name MFA. HHS proposed in January 2025 to expressly require MFA, and its voluntary performance goals already list MFA for Email Access.
Yes, when the patient agreed to electronic notice. Otherwise notice goes by first-class mail to the last known address, no later than 60 calendar days after discovery.
When it leads to unsecured PHI being acquired, used or disclosed in a way the Privacy Rule does not permit. PHI rendered unusable, unreadable or indecipherable to unauthorized persons through the methods HHS specifies is not unsecured.
Start with MFA on every mailbox and forced TLS to the partners who receive patient data. Add DMARC on your domain and mailbox audit logging, then a training program with a report button. Each item maps to a row in the table above, and AegisAI adds removal after delivery on top of those controls.
No. HHS describes them as voluntary goals. The obligations come from the Security Rule text cited in the table, and the goals show which email practices HHS treats as essential.
