Email Data Breaches in Healthcare and What HIPAA Requires

Email is still one of the easiest ways for patient data to leak out of a practice. A wrong autocomplete, a phished password, or a vendor's compromised mailbox can expose years of correspondence in an afternoon. This guide covers what recent breach data shows, what the HIPAA Security Rule actually says about email, and the controls practices commonly put in place.

What the 2025 breach data shows

Paubox, an email security vendor, publishes an annual analysis of email-related breaches reported to the HHS Office for Civil Rights (OCR). Its 2026 Healthcare Email Security Report looked at breaches reported from January through December 2025. The headline numbers:

170 email-related breaches reported to HHS in 2025, down slightly from 180 in 2024.
About 2.5 million people had information exposed in those incidents.
53% of breaches happened on Microsoft 365, up from 43% in 2024. Paubox points to misconfiguration rather than the platform itself.
74% of breached domains had ineffective DMARC protection (the setting that tells receiving servers to reject spoofed mail from your domain), up from 65% the year before.
28% of breaches involved email exposure at a vendor or business associate, and 17% were phishing-driven mailbox takeovers, according to Paubox's breakdown of the top 2025 attack types.

Two caveats. Paubox sells email encryption, so read its recommendations with that in mind. And its counts come from HHS breach filings, which only capture breaches affecting 500 or more people and which can change as investigations close. Smaller incidents are reported to HHS annually and don't show up in these totals.

How email breaches usually happen

The patterns are familiar, and most are preventable:

Phishing and account takeover. A staff member enters credentials on a fake login page. Without multi-factor authentication (MFA), the attacker now has the whole mailbox, including old messages with lab results, referrals and billing details.
Business email compromise. Attackers impersonate a vendor, executive or patient to request records or redirect payments.
Vendor and business associate exposure. A billing company, answering service or IT provider gets breached, and your patients' data goes with it.
Misdirected email. Autocomplete picks the wrong "Sarah," or a reply-all goes to an outside list.
Spoofing. Without SPF, DKIM and an enforced DMARC policy, attackers can send mail that looks like it came from your practice's domain.

What HIPAA says about email

HIPAA does not ban email, and it does not require one specific encryption product. The rules work in layers.

The Privacy Rule permits email with patients. HHS's own FAQ says covered providers may email patients as long as they apply reasonable safeguards under 45 CFR 164.530(c), such as double-checking addresses and limiting what goes into an unencrypted message. If a patient prefers email and is told about the risks of unencrypted email, the patient can choose to keep using it. Patients can also request confidential communications by alternative means under 164.522(b).

The Security Rule governs electronic PHI in transit and at rest. The technical safeguards are in 45 CFR 164.312:

Access control (164.312(a)), including unique user IDs (required) and encryption and decryption of stored ePHI at 164.312(a)(2)(iv), which is addressable.
Audit controls (164.312(b)) to record and examine activity in systems that hold ePHI.
Person or entity authentication (164.312(d)) to confirm users are who they claim to be.
Transmission security (164.312(e)), including encryption of transmitted ePHI at 164.312(e)(2)(ii), also addressable.

"Addressable" does not mean optional. The rule requires an organization to assess whether a safeguard is reasonable and appropriate, implement it if so, and if not, document why and put an equivalent measure in place. That decision flows from the risk analysis the administrative safeguards require at 164.308(a)(1). In practice, few practices can document a good reason to send PHI over email with no encryption at all.

Encryption also matters after a breach. Under the Breach Notification Rule, notification duties apply to "unsecured" PHI. HHS guidance names encryption that meets its standards as one way to make PHI unusable to unauthorized people, which can take an incident out of the notification requirements.

The proposed Security Rule update

On January 6, 2025, HHS published a proposed rule to strengthen the Security Rule. Among other changes, the HHS fact sheet says it would remove the distinction between required and addressable specifications, require encryption of ePHI at rest and in transit, and require MFA, each with limited exceptions. The comment period closed March 7, 2025.

As of late October 2026 the proposal is not final. The federal regulatory agenda lists it as a long-term action with final action targeted for July 2027. The current Security Rule stays in force until a final rule is published. Many practices are already adopting encryption and MFA anyway, since both are cheap compared with a breach and would likely be required if the rule is finalized.

Penalties

HIPAA civil penalties are tiered by culpability. The current amounts come from HHS's 2025 inflation adjustment, published January 28, 2026. HHS later announced no adjustment for 2026, so these figures remain in effect.

Tier	Per violation (2025 figures)
Did not know, and with reasonable diligence would not have known	$145 to $73,011
Reasonable cause, not willful neglect	$1,461 to $73,011
Willful neglect, corrected within 30 days	$14,602 to $73,011
Willful neglect, not corrected within 30 days	$73,011 to $2,190,294

The calendar-year cap for identical violations is $2,190,294. Under HHS's 2019 Notice of Enforcement Discretion, OCR applies lower annual caps to the first three tiers: $25,000, $100,000 and $250,000 before inflation adjustment (roughly $36,506, $146,053 and $365,052 at 2025 levels). Criminal penalties under the statute are separate and handled by the Department of Justice.

A practical email security checklist

These are controls healthcare organizations commonly use. Your risk analysis should decide which apply and how.

Technical controls

Turn on MFA for every mailbox, including shared inboxes and admin accounts.
Publish SPF and DKIM records and move DMARC to an enforced policy (quarantine or reject), not just monitoring.
Use encryption for outbound PHI: enforced TLS for server-to-server delivery, plus a secure portal or message-level encryption when the recipient's server can't be trusted.
Turn on audit logging and alerts for unusual sign-ins, mailbox forwarding rules and bulk downloads.
Set data loss prevention rules to flag messages that contain record numbers, dates of birth or diagnosis codes.
Disable legacy authentication protocols that bypass MFA.

Administrative controls

Include email in the risk analysis, and update it when systems change.
Sign business associate agreements with your email provider and any vendor that sends mail on your behalf, such as reminder or marketing tools.
Keep a written policy on what can go in email, what goes through a portal, and how to handle patients who prefer unencrypted email.
Write an incident response plan for a compromised mailbox: reset credentials, revoke sessions, remove forwarding rules, preserve logs, and assess notification duties.

People

Train staff on hire and regularly after that, with real examples of phishing aimed at healthcare.
Make reporting a suspicious email easy and blame-free.
Ask staff to verify any request for records or payment changes by phone, using a number you already have.

Vendors

Ask vendors how they protect email, whether they use MFA, and how fast they will notify you of a breach.
Limit what PHI vendors receive by email in the first place.

When something goes wrong

The Breach Notification Rule requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people also go to HHS within that 60-day window, and to prominent media if more than 500 residents of a state are involved. Smaller breaches can be logged and reported to HHS within 60 days after the end of the calendar year. Business associates must notify the covered entity within 60 days of discovery. Talk to counsel early, because the risk assessment that decides whether an incident is a reportable breach has specific factors.

Where NutriCove fits

NutriCove sets up AI automation for medical offices, including an AI receptionist, missed-call text back, follow-ups and booking. Those systems send messages to patients, so where PHI is involved, our medical page notes that GoHighLevel needs its HIPAA add-on and a signed BAA before any PHI goes in. If you're planning patient messaging, see how we set up automation for medical offices.

Sources

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.