Email communication has become an important part of modern mental health practice. Therapists use email to communicate with clients, coordinate care, manage administrative tasks, and share important practice information. However, when emails include protected health information (PHI), mental health professionals must carefully consider privacy, security, and ethical responsibilities.
Many therapists have questions about whether their email communication is HIPAA compliant, what security measures are required, and when additional safeguards are necessary. While using a healthcare-friendly email platform is an important step, HIPAA compliance involves more than adding a confidentiality disclaimer to an email signature or choosing a familiar email provider.
A disclaimer at the bottom of an email does not make an email HIPAA compliant. Protecting client information requires appropriate policies, security practices, technology safeguards, and an understanding of professional responsibilities related to confidentiality.
This guide explores HIPAA compliant email for therapists and the steps mental health professionals can take to protect client information through secure electronic communication. Topics include privacy considerations, security recommendations, Business Associate Agreements (BAAs), client communication policies, and best practices for protecting electronic protected health information (ePHI).
What Is HIPAA-Compliant Email?
HIPAA-compliant email refers to the use of email systems, security practices, and organizational safeguards that help protect electronic protected health information (ePHI) when it is transmitted, received, or stored.
HIPAA does not certify specific email providers as “HIPAA compliant.” Instead, organizations must implement appropriate safeguards based on their role, the type of information being handled, and applicable HIPAA requirements.
For therapists and mental health practices, this may include using secure email services, implementing access controls, maintaining appropriate documentation, training staff, and entering into Business Associate Agreements (BAAs) when required.
Does HIPAA Apply to Therapist Email Communication?
Whether HIPAA applies to a therapist’s email communication depends on whether the practice meets the definition of a covered entity or business associate under HIPAA regulations. Many healthcare organizations, including mental health practices that submit electronic healthcare transactions, are subject to HIPAA requirements.
However, protecting client confidentiality extends beyond HIPAA requirements. Mental health professionals have ethical obligations to protect client privacy, and state laws may impose additional requirements related to client information and electronic communication.
The American Counseling Association (ACA) Code of Ethics and other professional ethical standards emphasize the importance of protecting client confidentiality and using appropriate safeguards when handling sensitive information.
Understanding HIPAA Rules Related to Email Security
Therapists do not need to memorize every HIPAA regulation to practice safely; however, understanding the major HIPAA rules can help mental health professionals make informed decisions about electronic communication.
HIPAA Privacy Rule
The HIPAA Privacy Rule establishes standards for protecting protected health information (PHI) and outlines when health information may be used or disclosed.
For therapists, this includes maintaining confidentiality and limiting access to client information to appropriate individuals who need that information for treatment, payment, or healthcare operations.
HIPAA Security Rule
The HIPAA Security Rule focuses on protecting electronic protected health information (ePHI) through administrative, physical, and technical safeguards.
Examples of security practices related to email communication may include using secure systems, controlling user access, protecting devices, and implementing appropriate security procedures.
HIPAA Breach Notification Rule
The HIPAA Breach Notification Rule establishes requirements for responding to breaches involving unsecured protected health information.
Therapists and practices should have procedures in place for identifying, responding to, and documenting potential privacy incidents.
HIPAA Enforcement Rule
The HIPAA Enforcement Rule outlines compliance responsibilities, investigations, and potential penalties related to HIPAA violations.
Are Gmail and Outlook HIPAA Compliant?
Popular email services such as Gmail and Outlook are not automatically appropriate for sending protected health information simply because they are widely used. Healthcare organizations must ensure that their email services are configured appropriately and that required agreements, such as a Business Associate Agreement (BAA), are in place when applicable.
For example, certain healthcare-focused plans offered by major technology providers may include HIPAA-supporting features when configured correctly. However, therapists should review the specific service terms, security settings, and responsibilities before using any email platform to communicate protected health information.
HIPAA-Compliant Email Best Practices for Therapists
Protecting client information through email requires more than selecting a secure platform. Therapists should consider how information is created, accessed, transmitted, stored, and managed throughout the lifecycle of electronic communication.
The following best practices can help mental health professionals reduce privacy risks and develop safer communication procedures within their practices.
Use a Secure Email Service and Appropriate Safeguards
Therapists who use email to communicate protected health information should select services that provide appropriate security features and support compliance requirements when applicable. This may include encryption options, access controls, audit capabilities, and the ability to enter into a Business Associate Agreement (BAA).
A BAA is a written agreement between a covered entity and a business associate that outlines each party’s responsibilities related to protecting protected health information. Therapists should confirm whether an email provider offers a BAA before using the service to transmit PHI when required under HIPAA.
Limit the Amount of Protected Health Information Sent Through Email
One important privacy practice is minimizing the amount of protected health information included in electronic communication. Therapists should consider whether email is the most appropriate method for sharing sensitive information or whether a secure client portal, phone conversation, or other communication method would be more appropriate.
When email communication is necessary, limiting unnecessary details can help reduce potential privacy risks. For example, therapists may avoid including extensive clinical details, treatment summaries, or sensitive personal information unless there is a clear professional need to do so.
Establish Clear Email Communication Policies With Clients
Therapists should establish clear expectations regarding email communication during the informed consent process. Clients should understand how email will be used, what types of communication are appropriate, response time expectations, and any privacy limitations associated with electronic communication.
A therapist’s communication policy may address topics such as:
- Whether email is used for scheduling, administrative communication, or clinical discussions
- Expected response times for emails
- Whether urgent concerns should be communicated through email
- Alternative options for secure communication
- Potential privacy risks associated with standard email accounts
Verify Email Recipients Before Sending Messages
One of the most common risks associated with email communication is sending information to the wrong recipient. Therapists should carefully verify email addresses before sending messages that contain sensitive information.
Simple practices, such as confirming recipient information, avoiding autofill errors, and reviewing attachments before sending, can help reduce accidental disclosures.
Use Strong Passwords and Multi-Factor Authentication
Protecting email accounts requires strong account security practices. Therapists should use unique passwords, enable multi-factor authentication when available, and avoid sharing account credentials with unauthorized individuals.
Multi-factor authentication adds an additional layer of protection by requiring users to verify their identity through more than one method before accessing an account.
Secure Devices Used to Access Client Information
Email security extends beyond the email provider itself. Devices used to access client information, including computers, tablets, and smartphones, should also be protected.
Therapists should consider security practices such as:
- Using device passwords or biometric authentication
- Keeping operating systems and software updated
- Using encryption when appropriate
- Installing security updates promptly
- Avoiding access to client information on unsecured public devices
Train Staff Members Who Handle Client Information
For group practices and organizations, everyone who has access to client information should understand appropriate privacy and security procedures. Staff members may need training on topics such as secure communication practices, recognizing phishing attempts, and responding to potential privacy concerns.
Regular training helps create consistency and reduces the likelihood of accidental disclosures caused by misunderstandings or human error.
What Should Therapists Avoid Sending Through Email?
While email can be useful for administrative communication, therapists should carefully consider whether it is the appropriate method for sharing sensitive clinical information.
Depending on the circumstances, therapists may want to avoid sending detailed protected health information through standard email communication, including:
- Detailed psychotherapy notes
- Extensive treatment summaries
- Highly sensitive personal information
- Information unrelated to the purpose of the communication
- Emergency or crisis-related information that requires immediate attention
Email should generally not be used as a substitute for crisis services or emergency communication. Therapists should establish clear guidelines with clients regarding what to do if they are experiencing an urgent mental health concern.
Can Therapists Email Clients About Appointments?
Many therapists use email for administrative communication, including appointment reminders, scheduling questions, and practice updates. However, therapists should establish clear policies regarding how email communication will be used and what information may be included.
During the intake process, therapists can discuss communication preferences with clients and explain potential privacy considerations associated with email. Documenting these discussions as part of the practice’s informed consent process can help create transparency around electronic communication.
Email Services and Tools Therapists May Consider for Secure Communication
There are many email services and security tools available to mental health professionals. However, selecting an email provider is only one part of creating a secure communication system. Therapists should evaluate the provider’s security features, available agreements, administrative controls, and whether the service meets the needs of their practice.
When evaluating an email service, therapists may want to consider whether the platform offers features such as encryption options, multi-factor authentication, user access controls, administrative management tools, and the ability to enter into a Business Associate Agreement (BAA) when required.
Editorial Disclosure: TherapyByPro is not sponsored by the software companies mentioned in this article. TherapyByPro participates in affiliate programs, and may receive compensation if you purchase through certain links at no additional cost to you.
Google Workspace
Google Workspace is commonly used by healthcare organizations and businesses that need professional email and productivity tools. Certain Google Workspace plans and configurations support HIPAA-related requirements when appropriate agreements and settings are implemented.
Therapists considering Google Workspace should review available security settings, ensure appropriate account protections are enabled, and confirm that a Business Associate Agreement is in place when required.
Microsoft for Healthcare
Microsoft for Healthcare offers professional email and productivity tools used by many healthcare organizations. Depending on the service plan and configuration, Microsoft provides HIPAA-supporting features and the ability to enter into a Business Associate Agreement.
Therapists using Microsoft services should review their specific plan details and configure appropriate security controls to support privacy and security responsibilities.
Virtru
Virtru provides email encryption and data protection tools designed to help organizations control access to sensitive information shared through email.
Encryption tools may be helpful for practices that need additional control over how sensitive information is shared, accessed, and managed.
Paubox
Paubox provides encrypted email solutions designed specifically for healthcare organizations. The platform integrates with commonly used email systems and focuses on simplifying secure email communication for healthcare providers.
Therapists considering third-party email security tools should review the provider’s security documentation, agreements, and features to determine whether the service aligns with their practice needs.
NeoCertified
NeoCertified offers secure email solutions designed for organizations that need additional protection when communicating sensitive information.
Secure email platforms can provide additional safeguards; however, therapists remain responsible for implementing appropriate policies, training, and procedures within their practice.
Hushmail for Healthcare
Hushmail for Healthcare is an email service designed specifically for healthcare professionals, including therapists and other mental health providers. It offers encrypted email communication, secure forms, and healthcare-focused features intended to help practices protect sensitive client information.
Hushmail may be a practical option for solo therapists and small practices looking for a dedicated healthcare email solution rather than configuring a general business email platform.
HIPAA-Compliant EHR Platforms for Therapists
Many therapists use electronic health record (EHR) platforms that include secure client portals, encrypted messaging, appointment reminders, documentation tools, and other features designed to help practices protect client information. These platforms can reduce the need to send sensitive information through traditional email.
SimplePractice
SimplePractice is a widely used practice management and EHR platform for mental health professionals. It offers tools for documentation, scheduling, billing, telehealth, client portals, and secure communication features designed for private practices.
TherapyNotes
TherapyNotes is an EHR platform built specifically for behavioral health professionals. It provides clinical documentation tools, scheduling, billing features, telehealth capabilities, and secure client communication options for therapy practices.
TheraNest
TheraNest is a practice management and EHR platform designed for therapists and mental health organizations. It includes features such as progress notes, scheduling, billing, client portals, and administrative tools to help streamline practice operations.
Tebra
Tebra provides healthcare practice management and electronic health record solutions that combine clinical documentation, scheduling, billing, and patient communication tools. It is commonly used by healthcare providers who need an integrated practice management system.
Common Email Security Mistakes Therapists Should Avoid
Even when using secure technology, privacy risks can occur when communication practices are inconsistent. Developing clear procedures can help therapists reduce avoidable mistakes.
- Sending client information to the wrong email address due to autocomplete errors
- Including unnecessary protected health information in messages
- Sharing account passwords with others
- Accessing client information on unsecured devices
- Failing to update software or security settings
- Using personal email accounts for professional communication without appropriate safeguards
- Not having clear communication expectations documented with clients
What Should Therapists Do If They Accidentally Send Protected Health Information to the Wrong Person?
If a therapist believes protected health information has been disclosed unintentionally, they should follow their practice’s privacy and incident response procedures. This may include documenting what occurred, evaluating the situation, and determining whether additional steps are required under applicable privacy regulations.
Mental health professionals should consult their compliance officer, privacy officer, supervisor, professional organization, or legal counsel when they are unsure how to respond to a potential privacy incident.
Having a clear plan before an incident occurs can help practices respond more effectively while prioritizing client privacy and ethical responsibilities.
Frequently Asked Questions About HIPAA-Compliant Email for Therapists
Below are frequently asked questions therapists ask about HIPAA Compliant email:
Is Gmail HIPAA compliant for therapists?
Gmail is not automatically HIPAA compliant simply because it is a widely used email service. Therapists who use Google services for professional communication should evaluate the specific Google Workspace plan, available security settings, and whether a Business Associate Agreement (BAA) is available and appropriate for their practice.
Using a secure email platform is only one part of protecting client information. Therapists must also implement appropriate policies, access controls, and privacy practices when handling protected health information.
Can therapists email clients about appointments?
Yes, many therapists use email for administrative communication such as appointment reminders, scheduling, and practice updates. However, therapists should establish clear communication policies that explain how email will be used and what types of information are appropriate to send electronically.
During the intake process, therapists can discuss communication preferences, potential privacy limitations, and alternative secure communication options with clients.
Does adding a HIPAA disclaimer to an email make it compliant?
No. An email confidentiality disclaimer does not make an email HIPAA compliant. A disclaimer may communicate expectations about privacy, but it does not provide encryption, access controls, security protections, or other safeguards required to protect electronic protected health information.
Do therapists need a Business Associate Agreement (BAA) for email?
A Business Associate Agreement may be required when a covered entity uses a vendor or service provider that handles protected health information on its behalf. Whether a BAA is necessary depends on the specific relationship, service, and HIPAA requirements that apply to the practice.
Therapists should review agreements with technology providers and seek professional guidance when they are unsure about their responsibilities.
Should therapists email psychotherapy notes to clients or other providers?
Therapists should carefully consider whether email is the appropriate method for sharing sensitive clinical information. Psychotherapy notes receive special protection under HIPAA, and mental health professionals should follow applicable privacy requirements and professional standards when handling clinical documentation.
When sharing information with other providers, therapists should consider the purpose of the communication, client authorization requirements when applicable, and secure methods of information exchange.
What is the safest way for therapists to communicate electronically with clients?
There is no single communication method that is appropriate for every practice. Many therapists use a combination of secure client portals, encrypted communication tools, and carefully developed email policies to support privacy.
The safest approach is one that considers the sensitivity of the information being shared, the technology being used, and the therapist’s professional and legal responsibilities.
Can therapists use personal email accounts for client communication?
Therapists should carefully evaluate whether personal email accounts are appropriate for professional communication. Personal accounts may lack the security controls, administrative features, and documentation processes needed for managing protected health information in a clinical setting.
Using a professional email system designed for business or healthcare communication can help practices establish clearer boundaries and stronger security practices.
What should therapists include in an email communication policy?
An email communication policy helps clients understand expectations and helps therapists maintain consistent boundaries. A policy may include:
- The types of communication that are appropriate through email
- Expected response times
- Whether email is monitored outside business hours
- Instructions for urgent or emergency situations
- Potential privacy limitations of electronic communication
- Alternative secure communication options
Final Thoughts on HIPAA-Compliant Email for Therapists
Email can be a valuable tool for modern therapy practices, but protecting client confidentiality requires thoughtful planning. HIPAA compliance is not achieved through a single product, email disclaimer, or software purchase. Instead, it involves combining appropriate technology with secure procedures, informed client communication, and ongoing attention to privacy responsibilities.
For therapists, developing secure email practices is an important part of maintaining trust within the therapeutic relationship. Clients share deeply personal information with mental health professionals, and protecting that information extends beyond the therapy session itself.
If you are unsure whether your current email practices adequately protect client information, consider reviewing your policies, consulting with a compliance professional, and evaluating whether your current technology solutions align with your practice needs.
TherapyByPro is a trusted resource for mental health professionals worldwide. Our therapy tools are designed with one mission in mind: to save you time and help you focus on what truly matters-your clients. Every worksheet, counseling script, and therapy poster in our shop is professionally crafted to simplify your workflow, enhance your sessions, reduce stress, and most of all, help your clients.
Want to reach more clients? We can help! TherapyByPro is also a therapist directory designed to help you reach new clients, highlight your expertise, and make a meaningful impact in the lives of others.
References
- U.S. Department of Health & Human Services, Office for Civil Rights. (n.d.). Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients? https://www.hhs.gov/hipaa/for-professionals/faq/570/does-hipaa-permit-health-care-providers-to-use-email-to-discuss-health-issues-with-patients/index.html
- U.S. Department of Health & Human Services, Office for Civil Rights. (n.d.). HIPAA Privacy Rule. https://www.hhs.gov/hipaa/for-professionals/privacy/index.html
- U.S. Department of Health & Human Services, Office for Civil Rights. (n.d.). HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/index.html
- American Counseling Association. (2014). ACA Code of Ethics. American Counseling Association. https://www.counseling.org/docs/default-source/default-document-library/ethics/2014-aca-code-of-ethics.pdf
- U.S. Department of Health & Human Services, Office for Civil Rights. (n.d.). HIPAA Guidance Materials. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/index.html
- Holland & Hart LLP. (2025). E-mailing and Texting PHI: Beware HIPAA. https://www.hollandhart.com/e-mailing-and-texting-phi-beware-hipaa