How to Automatically Encrypt HIPAA‑Sensitive Email with Microsoft Purview Message Encryption
- Hanna Korotka
- 5 days ago
- 2 min read
A single exposed medical record costs an average of $408 in remediation—while large breaches routinely trigger seven‑figure fines. Email remains the #1 vector for accidental disclosure, so securing messages that contain electronic protected health information (ePHI) is a non‑negotiable part of HIPAA compliance.
Why We Use Microsoft Purview DLP for Automatic Encryption
Microsoft Purview Data Loss Prevention (DLP) policies act as a smart filter that scans every outbound email for HIPAA identifiers—then automatically calls Microsoft Purview Message Encryption when a match is found.
DLP delivers three business wins:
Zero user effort – Encryption applies even if staff forget to click a button.
Central control – One admin‑managed policy covers every mailbox; no add‑ins or scripting.
Audit‑ready logs – DLP records every detection and action, simplifying HIPAA audits and risk assessments.
With DLP handling detection, Message Encryption focuses on what it does best: sealing the message end‑to‑end.
Licensing & Prerequisites for Microsoft Purview Message Encryption
Make sure you have:
Microsoft 365 E3/E5, Microsoft 365 Business Premium, or Azure Information Protection P1 license for each sender.
Exchange Online mailboxes.
Azure Rights Management (RMS) enabled (default in most tenants). Check via Get‑IRMConfiguration in Exchange Online PowerShell.
Step‑by‑Step: Create a HIPAA DLP Policy that Triggers Message Encryption
Sign in to the Microsoft Purview portal.
Navigate to Data loss prevention › Policies and choose + Create policy.
Select the U.S. Health Insurance Act (HIPAA) template under Medical and health.
Name the policy – e.g. Encrypt HIPAA Email.
Locations: choose Exchange email (add Teams or SharePoint later if desired).
Rules:
• Condition – HIPAA info types ≥ 1 match.
• Action – Encrypt email messages
• User notification – add a policy tip so senders know encryption was applied.
Enforce the policy and click Create.
📌 Need the full wizard? See our post: Mastering HIPAA Compliance with Microsoft Purview DLP
Validate Your Policy in 3 Minutes
Send a test email containing dummy PHI (e.g. “Patient ID 123‑45‑6789”) to an external address.
The recipient should receive a branded “You’ve received an encrypted message” notice and must authenticate to read it.
If the email arrives unencrypted, verify policy order, sender licensing, and RMS status.
Best Practices for Ongoing Success
Monitor reports Weekly. Tune thresholds to minimize false positives.
Educate users.
How PlexHosted Can Help
As a Microsoft Cloud Solution Provider and MSSP, PlexHosted designs, deploys, and monitors HIPAA‑aligned DLP + Message Encryption policies—so your clinicians and admin staff can communicate freely without risking a compliance breach.
Ready to "remove the PHI‑email headache?" Contact us for a 30‑minute discovery call.