Episode 629: Does HIPAA Require TLS 1.2+ for Email? What Practices Actually Need to Know

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we answer a listener question and provide clarification on whether securing outbound email in Google Workspace (as discussed in Episode 623) would constitute a HIPAA violation.

We discuss:

• Why blanket claims about HIPAA violations or HIPAA requirements from service providers or vendors raise our ethical hackles
• Opportunistic vs. forced TLS
• Legacy TLS and how it would be used with the forced TLS setting configured in Google Workspace
• What HIPAA actually requires for email security
• Where NIST (National Institute for Standards of Technology) guidance fits in
• The actual risk analysis for legacy TLS
• Benefits of secure email services, and when it might make sense to cancel
• Data to gather from your secure email service to do your own risk analysis

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

Resources for Listeners

PCT Resources

• Episode 623: Now You Can Secure Outbound Email in Google Workspace
• Our earlier episode explaining the Google Workspace configuration that can require TLS for outbound email, what forced TLS does and does not protect, and how it fits into HIPAA security and risk management.
• PCT Article: A Practical Way to Secure Outbound Email in Google Workspace: What Mental Health Practices Need to Know
  • PCT’s detailed guide to enforced outbound TLS in Google Workspace, including the difference between opportunistic and enforced TLS, appropriate fallback methods, and considerations for deciding when ordinary inbox delivery versus escrow-style messaging is appropriate.
• PCT’s Free Google Workspace Configuration Help Center
  • Step-by-step guidance and video tutorials for configuring Google Workspace for HIPAA-compatible use, including the global outbound routing rule for requiring TLS.
• PCT Article: 3 Kinds of Email Security: How to Make an Informed and HIPAA-Aware Choice
• PCT’s framework for understanding conventional email, TLS-secured email, and escrow/portal-style secure messaging—and choosing safeguards based on the information, client, and practice context.
• HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices — Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You’ll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks.
• PCT’s Comprehensive HIPAA Security Compliance Program bundles:
  • For Group Practices
  • For Solo Practitioners
  • Comprehensive HIPAA Security Policies & Procedures
  • Forms and logs for documenting the implementation and maintenance of Policies & Procedures
  • Device & Workspace Security Suites
  • Direct support and consultation from the PCT team and therapist-attorney Eric Ström, JD, PhD, LMHC
  • HIPAA Risk Analysis & Risk Mitigation Planning service and tool
  • HIPAA Security & Privacy Ethics training
• Group Practice Care Premium — Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Ström, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources.

Resources

• 45 C.F.R. § 164.312 — HIPAA Security Rule Technical Safeguards
  • The regulation itself, including the Transmission Security standard at § 164.312(e).
• HHS: Are Covered Entities Required to Use NIST Guidance Documents?
  • HHS expressly states that NIST guidance can inform implementation, but use of NIST guidance documents is not itself required by the HIPAA Security Rule.
• HHS: Is the Use of Encryption Mandatory in the Security Rule?
  • HHS explains the Security Rule’s risk-based approach to encryption as an addressable implementation specification and the requirement to determine and document reasonable and appropriate safeguards.
• Google Workspace Admin Help: Ciphers for Gmail SMTP TLS Connections
  • Google’s current documentation on Gmail’s support for TLS 1.0–1.3, its preference for newer TLS versions, and its continued support for legacy TLS during outbound negotiation when newer versions are unavailable.
• NIST SP 800-52 Rev. 2: Guidelines for the Selection, Configuration, and Use of TLS Implementations
  • NIST’s technical guidance on TLS versions, configuration, cryptographic standards, and migration to newer TLS protocols.