It's tricky with HIPAA, given that emailing almost anything interesting is a violation, since they can't control whether your email provider discloses it or not

It's tricky with HIPAA, given that emailing almost anything interesting is a violation, since they can't control whether your email provider discloses it or not. The right way to do it is to email people and inform them that a secure system has Very Important Information for them and that they should sign in using pre-arranged credentials to check it. Even that email can be a HIPAA violation if you do it wrong -- for example, "Hiya Jane Smith, Dr. Foo OBGYN has important information for you" has been held to be a violation since Foo should have reasonably anticipated that some patients would be living with family and sharing email with them and disclosing a non-minor's pregnancy/etc to their parents without their consent is a per se violation. Ditto putting similar information into voicemails / SMSes / etc. Technical violations of the rules are rampant and enforcement actions are comparatively rare, particularly at smaller medical providers.