This is my understanding as well. Additionally, I believe you can send encrypted attachments over an unencrypted connection. Furthermore, https://www.gpo.gov/fd

This is my understanding as well. Additionally, I believe you can send encrypted attachments over an unencrypted connection. Furthermore, https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.p... suggests that it's acceptable to send patients unencrypted PHI if they've explicitly agreed to accept the risks associated with that (although I'd be extremely cautious in those situations)