Is Outlook HIPAA compliant?

Is Outlook HIPAA compliant? Yes, it can be. But setting it up correctly can be complicated.

If you already use Outlook in your practice, you might be wondering whether it's safe to use for client communication.

Many healthcare professionals stick with Outlook because it's familiar and part of the tools they already rely on.

The good news is, you don't necessarily have to replace it.

In this article, we'll walk you through what it takes to make Outlook HIPAA-compliant, including setup and limitations to be aware of.

We'll also look at a simpler way to handle secure messages and forms, without changing how you use Outlook for everyday communication.

By the end, you'll have a clear understanding of your options and what will work best for your practice.

Which Outlook should you use?

The approach you take depends on how you plan to use Outlook. There are three different things people often mean by "Outlook," and each plays a different role in HIPAA compliance.

Let's look at the three main options. You can find different variations of each, but for this article, let's keep it simple.

	This is Microsoft's free email service (similar to Gmail). It's not HIPAA compliant because Microsoft does not offer a Business Associate Agreement (BAA) for personal accounts. That said, many healthcare professionals still use it for everyday communication, and use a separate secure messaging solution when they need to send sensitive information.
	This is Microsoft's paid service for businesses. It can be made HIPAA compliant if you choose the right plan and configure it correctly.
	The Outlook email application, which comes with Office, is simply a tool for accessing your email. It's not an email service itself, and it doesn't determine whether your messages are HIPAA compliant.

So when people ask whether Outlook is HIPAA-compliant, they're usually referring to Microsoft 365. But even then, getting it set up correctly takes some work.

How to make Outlook HIPAA compliant

Setting up Outlook to meet HIPAA requirements takes time and careful configuration.

We'll walk you through the key steps so you can understand what's involved and decide whether this approach is right for your practice.

We'll also look at a simpler way to handle secure messaging later on.

How to set up Outlook (Microsoft 365) for HIPAA compliance

Setting up Outlook (Microsoft 365) to meet HIPAA requirements can take some time. There are multiple plans and settings to choose from, and it's not always clear which ones you need.

To keep things simple, here are the three key things to look for in a HIPAA-compliant email setup:

• Encryption to protect messages
• Archiving to meet record-keeping requirements
• A Business Associate Agreement (BAA)

Encryption makes information unreadable to anyone other than the intended recipient.

It's important to understand how your email provider protects messages, both while they're being sent and after they're delivered.

Some services protect messages in transit, but once the message reaches your client's inbox, that protection may not continue.

If you'd like to understand how email encryption protects messages at different stages, you can read more about email encryption.

How secure messages are delivered

With secure messaging, sensitive information is not sent as a regular email.

Instead, your client receives a notification and clicks a secure link to view the message.

They can read, reply, and complete forms on a secure page.

They do not need a paid account to access it.

Learn more about how secure messages work.

An archive helps you meet the HIPAA requirement to demonstrate that you've been implementing security safeguards, such as encryption, when communicating online with your clients.

And a Business Associate Agreement (BAA) affirms that an email service accepts responsibility for the safety of your clients' information. With a BAA, you can feel confident that they'll comply with HIPAA requirements on your behalf.

Let's take a look at the Microsoft 365 plan that best meets these needs.

Choose the right Microsoft 365 plan for your healthcare practice

We recommend Microsoft 365 Business Premium for most small healthcare practices. It includes the features needed to support HIPAA compliance, such as encryption, archiving, and a Business Associate Agreement (BAA), when set up correctly.

Other plans may not include all of these features or may require additional configuration.

Unfortunately, Microsoft doesn't hand you a HIPAA-compliant cheat sheet. You have to figure out how to make Outlook HIPAA-compliant on your own. And it gets complicated if you aren't tech-savvy.

We've interpreted the Microsoft guides the best we can, so we can give you the best advice on setting up and using Outlook.

Sign up for Microsoft 365 Business Premium

1. Go to Microsoft 365 for business. Select the Microsoft 365 Business Premium subscription. Be sure to choose the "Try free for 1 month" option if you want to try it.

2. Enter your current email address.

3. Click "Set up account."

4. They'll want to find out a little more about you and your business.

5. And they'll want to make sure that you're you by giving you a secret code, either by text or with a phone call.

6. Once you get the verification code, enter it in the field.

At this point, if you haven't purchased your own domain, Microsoft will give you something like MatthewWatsonLCSW5.onmicrosoft.com.

You can customize the part before onmicrosoft.com (e.g., MatthewWatsonLCSW5) or connect your own domain (like yourpractice.com) to create a more professional email address.

7. Next, come up with a strong password. We advise using a random set of memorable words. You might consider a phrase with a specific meaning to you or about a family member, hobby, or personal belief. For example: "chess is very hard" or "anna goes to nursery."

8. Then you'll be asked to add a payment method. Be sure to note the trial expiration date. You might need to cancel if you decide Outlook doesn't meet your needs.

And there you have it. The steps to signing up for your account. You're on your way!

Sign a Microsoft 365 business associate agreement (BAA)

The first step after you sign into your account for the first time is to find and read the Business Associate Agreement (BAA).

A note about signing in – you can sign in and get to Outlook either through Microsoft 365 or Office. It's a little confusing, but basically, once you're on a Microsoft page, find the "Sign in to your account" icon in the top right corner. That will get you there.

The BAA affirms that Microsoft will protect your clients' information when it's in its hands.

HIPAA requires that you get a BAA from every business that has access to your clients' information. Not having one could result in a fine.

"It's important to obtain BAAs from the third-party services you use in your practice. But it's equally important to understand that they don't guarantee HIPAA compliance. It's up to you to use the service in a compliant manner."

Steven O. Youngman, VP of Legal and Compliance at Hushmail

Here are the steps to finding and signing the BAA. Get ready, it's a little hidden…

1. Sign in to your account. When you first get started, your homepage will look something like this:

2. Click on the square of dots in the top left corner.

3. Find and click on the compliance icon.

4. Once you're on the compliance page, which is called Microsoft Purview, scroll down the menu on the left and click on "More resources."

5. Then find and open the Service Trust Portal.

6. Scroll down until you see "White Papers, FAQs, & Compliance Guides." Click on those words.

7. Click on "Compliance Guides."

8. Scroll down until you find the "MicrosoftHIPAABAA."

You might be asked to sign in to your account again. Once you're signed in, accept the terms for receiving their BAA. At that point, you'll either automatically download the BAA or be prompted to download it, depending on your web browser.

As you can see, this wasn't designed for healthcare practitioners who need easy access to their BAA.

It's a good idea to read through your BAA to make sure you understand what it covers. Check with your attorney if you're unsure about anything. Unfortunately, Microsoft won't customize its BAA.

Get the Outlook license

When you first get a Microsoft 365 account, it doesn't automatically come with Outlook. You have to assign a license to yourself.

Click "Assign Products" in the red banner at the top of the page.

If you don't see that banner, you can navigate to the correct page in the Microsoft 365 Admin Center. You can access the center by clicking the Admin icon in the left-hand menu or the square of dots.

1. Once you're in the Admin Center, choose "Active users" from the menu on the left. You'll find this under "Users."

2. Click on the three dots next to the user you want to use Outlook (at this point, it's probably just you) and click on "Manage product licenses."

3. Then, turn on Exchange Online, Office for the Web, and SharePoint.

Exchange Online - The email server necessary for Outlook to work. It will also provide you with the archive you need for HIPAA compliance.

Office for the Web - The suite of applications containing Outlook.

SharePoint - A collaboration system that lets you easily work with people on your team. This might not be something you need right now. However, you must assign a SharePoint license to assign an Office license. An error will appear if you try to turn on Office and not SharePoint:

Enable your archive

While you're in this section, let's go ahead and enable your archive. You need it for your HIPAA compliance. It's important to note that the archive is not turned on by default. You have to figure out how to do it yourself. (Really? Why is Microsoft making this so hard?)

1. Click on "Mail."

2. Then, click on "Edit Exchange Properties."

3. In the left-hand menu, click "mailbox features," scroll down, and find and enable archiving.

Set up Outlook for HIPAA compliance

How's it going so far?

You've spent a lot of time setting up your account. You're almost ready to send your first email, but you're not quite there yet. You need to set up a few more things to make sure your account is secure. Microsoft has created a guide with all the details: HIPAA/HITECH Act Customer Considerations for Microsoft Office 365 and Microsoft Dynamics CRM Online

Beware. This guide is not for the faint of heart. 😧

Sadly, you still need to dig through a lot of technical information to find what's important to your practice:

• Learn about how the encryption works and where it's safe to put your clients' information
• Set access controls to limit who can access your clients' information
• Make sure you're using strong passwords
• Set up two-step verification if you haven't already

How to use Outlook for HIPAA compliance

You're ready to send your first encrypted email!

1. Open up Outlook by clicking on the Outlook icon in the left-hand menu. If you've assigned the correct licenses, this icon should be there now.

2. Once you're in Outlook, click on "New message."

3. Then click "Encrypt" at the top. You can do this before or after you compose your message. You should consider doing it first, so you don't forget.

You'll see this message:

When you send the message, your client will receive an email with a link to view it on a secure web page.

Your message never actually leaves Microsoft 365, which is why it's secure. If your client has a Microsoft account, they'll securely receive and reply to your email from their account, just as they would with any email.

However, if they don't have a Microsoft account, they'll need to sign in with Google or with a one-time passcode.

Finally, you've done it! You can read more about how Outlook encryption works here.

Keep in mind that turning on encryption doesn't automatically make an email HIPAA compliant. It's up to you to make sure you send it to the right person and don't include sensitive information in subject lines.

Also, don't forget that getting a BAA doesn't automatically mean HIPAA compliance. It depends on how you use the service.

Advantages of using Outlook for HIPAA compliance

Now that we've gone through how to make Outlook HIPAA compliant, let's take a look at the pros and cons.

There are advantages to using Outlook that might make the extra effort to make it HIPAA-compliant worthwhile.

• Outlook is familiar
• Microsoft is a household name
• A Business Premium account comes with a lot of different services that could be useful. Just make sure you carefully read the BAA to make sure they're covered under it. Not all of them are – and therefore not all of them are HIPAA-compliant.

• There's a 30-day trial so you can test it out before committing

Disadvantages of using Outlook and an alternative: Hushmail

However, there are several disadvantages to using Outlook as well.

Not purpose-built for healthcare

Microsoft has been around for a long time and offers a stunning array of tools and services for everyone. But it wasn't built just for healthcare. The specific tools and information you need for your practice can be difficult to find when they're mixed in with everything else. Just think about how hard it was to find the BAA.

No special features like practice forms

Microsoft wasn't built for healthcare, and it doesn't provide healthcare-specific features. Such as practice forms. You do get forms with your Microsoft 365 account, but they don't include templates for the forms you need, like intake forms or Good Faith Estimates. You use a lot of forms, and it would be nice to have these included!

Up to you to figure out HIPAA compliance

The language in the Microsoft HIPAA compliance guide and on the website is confusing and not written for a healthcare practitioner running a busy practice. You can make your account HIPAA compliant, but the setup is complicated, and there isn't an easy-to-understand cheat sheet. We did our best to make one for you (this blog post). 😄

Requires a domain purchase to look professional

If you want a more professional email address than the default onmicrosoft.com address, you'll need to use your own domain (like yourpractice.com).

This usually means purchasing a domain and connecting it to your Microsoft 365 account.

Locks you into a plan for a year

One more thing – once you start using Microsoft, after the 30-day trial, you're stuck with it for a year. There's no month-to-month plan, which is a nice-to-have flexibility.

A simpler way to handle secure communication

Setting up Outlook for HIPAA compliance can take time, and there are several steps to manage along the way.

Because of this, many healthcare professionals choose a simpler approach.

They continue using Outlook for everyday communication, and use Hushmail for sending secure messages and forms.

Hushmail is built for healthcare, so you don't need to worry about configuring encryption, archiving, or compliance settings yourself.

As regulations change, Hushmail continues to update its tools to help healthcare practices stay compliant, so you don't have to keep up with every new requirement on your own.

If you ever need help, you can reach a real person who understands healthcare and can guide you through it.

Take a look at some of the advantages of using Hushmail:

• Built for healthcare
• HIPAA compliance included
• Secure messages and forms in one place
• Built-in e-signatures
• Helpful, responsive customer support

FAQs about Outlook

What's the difference between Microsoft 365 and Office 365?

It's a bit confusing, but Microsoft 365 used to include Office 365. However, in 2020, Office 365 was renamed Microsoft 365. Now it's simply Office as part of a Microsoft 365 subscription.

Is Office the same thing as Outlook?

No. Office is a collection of productivity applications that includes the email app called Outlook. You can get it as a one-time purchase that lets you install the apps on one computer. Or you can get Office as part of a Microsoft 365 subscription, which offers more flexibility and access to upgrades.

Is a BAA all I need to be HIPAA compliant?

No. As Microsoft clearly states, "By offering a Business Associate Agreement, Microsoft helps support your HIPAA compliance. However, using Microsoft services does not, on its own, achieve HIPAA compliance. Your organization is responsible for ensuring that you have an adequate compliance program and internal processes in place, and that your particular use of Microsoft services aligns with your obligations under HIPAA and the HITECH Act."

Conclusion: Is Outlook HIPAA compliant?

Outlook can be made HIPAA compliant, but it takes time and careful setup.

For many healthcare professionals, it's easier to keep using Outlook for everyday communication and use a separate solution for sending sensitive information.

Hushmail is designed for secure messaging and forms, so you can send messages and forms without configuring encryption or managing compliance settings yourself.

This approach lets you keep the tools you're familiar with while ensuring your client communication stays protected.