HIPAA Email for Dental Offices: Can You Email Patient Information from Gmail, Outlook or Microsoft 365?

A parent at the front desk asks you to email her son's X-rays and treatment plan to the orthodontist across town. The practice address is an @gmail.com account someone set up years ago, the lab has just written asking you to "update our payment details", and nobody in the office is sure what HIPAA actually lets you send.

This guide covers HIPAA email for dental offices from the front desk's point of view: who you can email and how, Gmail versus Microsoft 365, step-by-step encryption, the settings that stop a mailbox takeover, offboarding, a 30-minute self-audit and what to do after a misdirected message. Compare it with what a secure email setup for dental practices includes. It describes what the rules and vendors say; it is not legal advice.

Does HIPAA allow a dental office to email patient information?

Yes. HIPAA does not ban email. It requires reasonable safeguards: a business associate agreement (BAA) with your email vendor, protection for patient information in transit, access controls, and only the minimum necessary detail for most purposes. Patients may also choose plain, unencrypted email after you warn them of the risk.

Three parts of the HIPAA rules shape every email your office sends. The Security Rule's technical safeguards in 45 CFR 164.312 include a transmission security standard: "Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network." Under it, encryption is labelled "Addressable": "Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate."

"Addressable" is not the same as optional. Section 164.306(d)(3) says a practice must assess whether the safeguard is reasonable and appropriate, implement it if so, and if not, "document why it would not be reasonable and appropriate" and implement an equivalent alternative where that is reasonable. In practice, that means either encrypting clinical email or writing down why not and what you do instead.

The Privacy Rule adds two everyday points. The minimum necessary standard in 164.502(b) asks you to limit what you send, although it does not apply to disclosures to another provider for treatment or to the patient. And 164.522(b) says a provider "must accommodate reasonable requests by individuals to receive communications of protected health information … by alternative means or at alternative locations." Email is one of those alternative means.

What HHS says when a patient asks for plain email

When HHS finalized the 2013 Omnibus Rule, it answered this exact question in the Federal Register preamble at 78 FR 5634: "covered entities are permitted to send individuals unencrypted emails if they have advised the individual of the risk, and the individual still prefers the unencrypted email." HHS added that it does not expect practices to educate patients about encryption, only "to notify the individual that there may be some level of risk that the information in the email could be read by a third party."

For a dental office, that becomes a short routine: tell the patient plain email could be read by someone else, offer the encrypted option or the patient portal, and note their choice in the chart. That permission covers the patient's own request. It does not cover messages to a specialist, a lab or an insurer, which still need your normal safeguards.

Who can your dental office email, and what does each message need?

You can email patients, parents or guardians, referring specialists, labs, insurers and billing partners, but each needs a different safeguard. Encrypt anything clinical, keep a BAA with every vendor that handles patient data for you, send only what the task needs, and confirm the address before you press Send.

The table below is the one most offices are missing. It shows the common dental email recipients, the channel that fits, and when a BAA question arises. The business associate definition in 45 CFR 160.103 matters here: it says a business associate does not include "a health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual."

Two dental habits deserve a second look. Photos taken on a personal phone and emailed from it leave patient images in a personal account the practice does not control. And "reply all" on a referral thread can copy patient details to people who never needed them, which is exactly what the minimum necessary standard is meant to prevent.

Which email option fits a dental office: free Gmail, Workspace, Microsoft 365, an add-on portal or the patient portal?

For patient information, use a business service whose vendor offers a BAA: Microsoft 365 or Google Workspace, set up with MFA and encryption. Free consumer Gmail has no BAA path. Add-on encryption portals and your practice software's patient portal can sit alongside either, for patients who prefer them.

Most dental offices end up comparing five options. The comparison below uses only what each vendor documents, as of October 2026, and leaves out prices because they change; ask for current quotes.

Open Dental's manual is a documented example of the last row. Its Secure Email feature sends the patient a notice, asks for a one-time passcode emailed to the address on file, and the message expires seven days after sending; it can only be sent to the patient, with no CC or BCC. Dentrix, Eaglesoft, Denticon and Curve users should check their own vendor's documentation for the equivalent.

Is free Gmail OK for patient information?

No. A personal @gmail.com account has no administrator who can accept Google's BAA, and Google's own help says customers without a signed BAA "must not use PHI" in its services. Google Workspace is different: once an administrator accepts the BAA, Gmail is on Google's list of covered services.

Google's HIPAA page for Google Workspace and Cloud Identity (last updated 22 October 2026) explains that an administrator must review and accept the BAA electronically in the Admin console, and a super administrator can find the acceptance record under Account settings, then Legal and compliance. Google's list of included services, dated 31 August 2025, names Gmail, Calendar, Drive, Meet, Chat and others. Third-party add-ons are not included.

Gmail and HIPAA questions usually come down to encryption. Google's Gmail Help says "All Gmail messages use TLS automatically," shown by a gray lock, which Google calls standard encryption. A red open lock "means the message is unencrypted"; Google advises not sending sensitive information in that case. Hosted S/MIME, for work or school accounts, shows a green lock and is called enhanced encryption.

Gmail encryption: TLS, S/MIME and client-side encryption

TLS encryption protects a message while it travels between mail servers. It does not control what happens after the message lands in the recipient's inbox, and it only works when the receiving server supports it. That is why the question "is TLS encryption enough for HIPAA?" has no one-line answer: it depends on your risk analysis, the recipient and the content.

Client-side encryption (CSE) encrypts the message with keys your organization controls before it leaves the browser. Google's setup overview (last updated 22 October 2026) lists the supported editions as Frontline Plus, Enterprise Plus, Education Standard and Education Plus, says consumer Gmail accounts "can't" send encrypted email, and notes that setup generally requires an external key service and an identity provider. Offices on Business Starter, Business Standard or Business Plus do not have CSE without changing edition.

Gmail's confidential mode is often mistaken for encryption. Google's help page says it lets you set expiry dates and turn off forwarding, copying, printing and downloading, but recipients "can still take screenshots or photos of your emails." Treat it as a guard against accidental sharing, not as a substitute for encryption.

How to set up Google Workspace for HIPAA email

1. 1. Confirm the practice is on Google Workspace, not personal Gmail accounts, and that every staff member has their own named account.
2. 1. Have an administrator review and accept the BAA in the Admin console, then, from a super administrator account, save a copy of the acceptance record from Account settings, then Legal and compliance.
3. 1. Turn on 2-Step Verification for every account and enforce it.
4. 1. Require TLS for the domains you exchange patient information with. In the Admin console go to Menu, Apps, Google Workspace, Gmail, Compliance; point to Secure transport (TLS) compliance and click Configure; choose Inbound, Outbound or both; add the domains in an address list; Google recommends selecting Require CA signed certificate and Validate certificate hostname; then Save. Google says changes can take up to 24 hours, and if the other server cannot use TLS, outgoing messages bounce back to the sender.
5. 1. Decide how patients receive encrypted records: a CSE-capable edition, a portal in your practice software, or an add-on with its own BAA.
6. 1. Remove third-party add-ons that touch Gmail unless they have their own BAA.

Is Microsoft 365 OK for patient email?

Yes, when it is set up for it. Microsoft offers its HIPAA BAA by default through its Data Protection Addendum, and Exchange Online is in scope. The BAA alone is not enough: Microsoft says using its services does not on its own achieve HIPAA compliance. You still need MFA, encryption and sound policies.

Microsoft's HIPAA and HITECH page on Microsoft Learn (updated 11 September 2026) says the "Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA." Exchange Online, Microsoft Teams, OneDrive for Business and SharePoint Online are on its commercial in-scope list. There is nothing to sign separately, so ask your IT provider to show you the in-scope list rather than looking for a signed form.

The same page is clear that "using Microsoft services doesn't on its own achieve HIPAA compliance." A subscription with no MFA, no encryption rule and old staff accounts still active has the BAA but not the safeguards.

Which Microsoft 365 plans include Purview Message Encryption?

Microsoft Purview Message Encryption is the feature behind Outlook's Encrypt button. It replaced the older Office 365 Message Encryption, which Microsoft lists as deprecated. Licensing depends on your plan, according to the Microsoft Purview service description (updated 21 August 2026).

Recipients outside your practice do not need a Microsoft subscription. Microsoft's Purview documentation says people on Gmail and Yahoo receive a wrapper message that takes them to a portal, where they sign in with a Microsoft account, Gmail or Yahoo credentials, or a one-time passcode, and they can send encrypted replies. An administrator can also create mail flow rules that encrypt messages automatically, for example every message to an external address that contains chosen keywords.

How do you encrypt an email in Outlook?

In new Outlook for Windows, open the message, select Options, then Encrypt, and pick Encrypt or Do Not Forward before you send. Classic Outlook uses the same Options, Encrypt path. Outlook on the web offers the Encrypt option too. Your account needs a Microsoft 365 plan that includes encryption, and your administrator must have it switched on.

These steps follow Microsoft's support article "Send S/MIME or Microsoft Purview encrypted emails in Outlook", opened on 25 October 2026. Menu names can move between updates, so use the Microsoft encryption steps for each Outlook version as the reference if your screen looks different.

New Outlook for Windows

Microsoft's steps: in an email message, choose Options, then select Encrypt; pick the encryption with the restrictions you want, such as Encrypt or Do Not Forward; finish composing and select Send. Microsoft adds a note that new Outlook "supports Microsoft 365 Message Encryption as long as your email server has an Office 365 Enterprise E3 license. If not, you can encrypt messages using S/MIME." If the Encrypt option is missing, ask your IT provider to confirm your licence and tenant settings rather than switching to a workaround.

Classic Outlook for Windows

In an email message, select Options, then Encrypt, choose the option you want, such as Do Not Forward, and send. Avoid the "Encrypt contents and attachments for outgoing messages" box under File, Options, Trust Center for patient mail: it uses S/MIME, and Microsoft says every recipient must have your digital ID to read the messages.

Outlook on the web

Microsoft's usage-rights documentation lists the Encrypt option in Outlook on the web for tenants using Purview Message Encryption. The support article's web steps (More options, then Message options, "Encrypt this message (S/MIME)") are for S/MIME, which needs certificates on both sides, so for patients and outside offices use the Purview Encrypt option.

Encrypt or Do Not Forward: which one should the front desk pick?

Microsoft's usage-rights page explains the difference. With Do Not Forward, "the recipients can't forward it, print it, or copy from it." With Encrypt-only, recipients "can copy from the email, print it, and forward it" but cannot remove the encryption. For a patient who needs to print a treatment plan or forward X-rays to a new dentist, Encrypt is usually the kinder choice. For a referral letter you do not want passed on, Do Not Forward fits.

The shared mailbox catch

Many dental offices send from a shared front-desk or billing mailbox. Microsoft's shared mailbox documentation states: "Email sent from a shared mailbox can't be encrypted because the mailbox doesn't have its own security context." Test this in your own tenant before you rely on a shared address for patient records, and plan a named, licensed mailbox or the patient portal for encrypted sends if it fails.

How does a hacked vendor or lab mailbox turn into a breach at your practice?

An attacker phishes one mailbox, a vendor's, a lab's or a staff member's, then reads patient threads, sets forwarding rules and sends convincing requests from a trusted address. Multifactor authentication, SPF, DKIM and DMARC, external-sender tags, blocked auto-forwarding and a call-back rule for payment changes stop most of these attacks.

This is not a hypothetical for dentistry. HIPAA Journal reported on 10 June 2026 that an unnamed third-party vendor's email accounts were accessed between 15 and 23 October 2025 after a phishing attack. Practices including Stafford Oral Surgery (7,019 people), Garrisonville Dental (5,204) and two Triangle Family Dentistry locations then notified patients. The same report describes Aldrich Pediatric Dentistry: an employee's email account was compromised on 16 January 2026 after a response to a phishing email, affecting 5,900 people.

Patient information sits in old threads and attachments, so one stolen password exposes years of conversations, and your exposure includes the mailboxes of the people you email. Our guide to phishing and ransomware risks for dental practices covers the wider attack picture, and the eAssist claim and the vendor risk it exposed shows the same lesson with a billing partner.

The six settings that stop most email takeovers

The links behind those cards: CISA's page on why to require multifactor authentication, Microsoft's guide to controlling external email forwarding in Microsoft 365, and the FTC's small business cybersecurity guidance on business email imposters, which also says to make sure your email provider offers email authentication technology. Our article on managing passwords across a dental office covers the password side.

SPF, DKIM and DMARC in one line each

Patient reminder platforms and online forms often send email "as" the practice. If they are missing from SPF or DKIM, tightening DMARC can block your own reminders, so list every sender first.

What happens to email when someone leaves the front desk?

When front-desk staff change, each departure leaves a mailbox full of patient threads. On the last day, block the person's sign-in, reset the password, remove their devices and mail apps, then convert the mailbox to a shared mailbox the office manager controls, so patient history stays with the practice.

Shared mailboxes are the right home for front-desk, billing and referral addresses. Microsoft's documentation says a shared mailbox can store up to 50 GB without a licence, supports a maximum of 25 users, and should never be signed into directly: "Always block sign-in for the shared mailbox account and keep it blocked." People reach it through their own licensed, MFA-protected accounts, so there is no shared password to pass between staff. Our guide to dental employee IT onboarding and offboarding puts email into the wider leaver process.

How can an office manager audit the practice's email in 30 minutes?

Set aside half an hour with your admin login or your IT provider on the phone. Check that every account is named and protected by MFA, the BAA exists, encryption works, forwarding is off, SPF, DKIM and DMARC are published, and no former staff account is still active. Write down what fails.

If several rows fail, start with MFA and old accounts; those two address the account-takeover pattern in the cases above. Our HIPAA compliance checklist for dental practices puts email alongside the rest of your Security Rule safeguards, and the cyber insurance requirements dental practices are asked to prove include several of the same email controls.

What should you do if patient information went to the wrong email address?

Act the same day. Ask the recipient to delete the message and confirm in writing, record what was sent, to whom and when, and tell your privacy officer. Under HIPAA a misdirected email is presumed to be a breach unless a documented four-factor risk assessment shows a low probability of compromise. Talk to counsel.

The breach definition in 45 CFR 164.402 says an impermissible disclosure "is presumed to be a breach unless the covered entity … demonstrates that there is a low probability that the protected health information has been compromised," based on at least four factors: the nature and extent of the information, the unauthorized person who received it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated. A recipient's written confirmation of deletion is evidence for the last two factors.

The 60-day limit comes from 45 CFR 164.404 on notifying individuals: notice must go "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach." State breach laws can add their own deadlines. If you carry cyber insurance, read its notice requirements the same day.

What is changing in HIPAA email rules in 2026 and 2027?

Nothing is final yet. HHS proposed a stronger Security Rule in January 2025, including more specific encryption and MFA expectations, but the federal Unified Agenda now lists it as a long-term action with final action targeted for July 2027. The current rule, including the addressable encryption standard, is what applies today.

Our article on HIPAA Security Rule updates for dental practices follows the proposal in more detail. If staff have started pasting patient questions into AI assistants to draft replies, read whether free AI tools create HIPAA risk in dental practices too; the same BAA question applies.

What to ask your IT provider about HIPAA email

Bring the 30-minute audit table to the conversation. A provider who manages your email should answer each of these with a setting, a date or a document, not a reassurance. If the answer is "we don't manage that", find out who does.

How Legend Networking can help

Legend Networking works on the systems a dental office's email depends on: Microsoft 365, mailboxes and shared mailboxes, MFA, encryption settings, email authentication records and the workstations staff send from. Our HIPAA IT support for dental practices covers email as one of the safeguards in a wider Security Rule program, and our dental cybersecurity services cover phishing and account-takeover defenses.

A few facts about us:

• • 22+ years in dental IT (since 2004).
• • Served over 3,500 practices since 2004.
• • In-house engineers; no outsourced first-level triage.
• • 24/7 monitoring.
• • 4.8 rating · 173 Google reviews.
• • Ian Lynch — 22 years in dental IT; oversees the NOC, onsite dispatch and client technology roadmaps.

For the policy side, including risk analysis and documentation, see our HIPAA and PCI compliance services for dental practices, and for day-to-day help across the office, our managed dental IT support. The wider picture of threats and defenses is in our dental cybersecurity guide, and the mistakes that most often lead to complaints are in common HIPAA violations in dental practices.