Thanks for writing!

No – “The HIPAA Security Rule does not expressly prohibit the use of email for sending electronic
PHI. However, the standards for access control, (45 CFR § 164.312(a)) integrity (45
CFR § 164.312(c)(1)), and transmission security (45 CFR § 164.312(e)(1)) require
covered entities to implement policies and procedures to restrict access to, protect the
integrity of, and guard against the unauthorized access to electronic PHI. The standard for
transmission security (§ 164.312(e)) also includes addressable specifications for integrity
controls and encryption. This means that the covered entity must assess its use of open
networks, identify the available and appropriate means to protect electronic PHI as it is
transmitted, select a solution, and document the decision. The Security Rule allows for
electronic PHI to be sent over an electronic open network as long as it is adequately
protected.”

And

“The U.S. Department of the Health and Human Services (HHS) issued guidance wherein “unsecure protected health information (PHI)” is essentially any PHI that is not encrypted or destroyed. Under this definition, it doesn’t matter how many chains, walls, doors, biometric gizmos and guards with lethal weapons you have at your service. As long as PHI is not encrypted, it is considered unsecured.”

So while they don’t say you must encrypt “with” or “how” – they are saying that you had better protect, encrypt, or destroy. Since you can’t send an email with PHI in a fashion that is both unencrypted AND secure – the logical necessity is that it is encrypted.