If the email server was provided by his workplace, then it was likely secured and HIPAA compliant. Most hospital email services are. Once the file is on his h

If the email server was provided by his workplace, then it was likely secured and HIPAA compliant. Most hospital email services are. Once the file is on his hard drive, most hospitals will require that the user uses some kind of encryption if it contains PHI. They enforce this by training and recertification procedures every year or so.