How to Encrypt Outbound Medical Emails in Microsoft 365

The core problem

Your clinic runs on Microsoft 365. You have 15 users on Business Premium. Someone in the office wants to automatically encrypt any outbound email that mentions a patient name, a diagnosis, or a treatment term. They are not trying to be difficult. They are trying to stay HIPAA-compliant.

The reality is that M365 built-in DLP catches credit card numbers and Social Security numbers out of the box. It does not catch "hypertension" or "physical therapy referral." That specific gap trips up a lot of small healthcare teams, and the path to fixing it is not obvious from Microsoft's own licensing pages.

Here is what each M365 tier actually offers, and what you can realistically do today without spending $50 per user per month extra on E5.

---

What M365 DLP covers at each license tier

Microsoft 365 DLP is not one feature. It is a set of capabilities that vary significantly by license.

Business Basic and Business Premium give you access to the DLP dashboard and basic policies. You can detect financial PII like credit card numbers, Social Security numbers, and passport numbers using built-in sensitive information types. Medical terminology is not included. These tiers also include Exchange Online Protection, but no meaningful content inspection for clinical terms.

Exchange Plan 2 (standalone) adds extended DLP policies and the ability to create custom sensitive information types using exact data matches or keyword dictionaries. You still do not get trainable classifiers or the full Purview sensitivity label engine. For a team of 15, this is often the most cost-effective standalone Exchange tier, but you are still limited to what you can pattern-match manually.

E3 includes the same DLP capabilities as Exchange Plan 2, plus endpoint DLP and Microsoft 365 compliance center access. Still no built-in medical terminology dictionaries. Still limited to rule-based matching.

E5 and E5 Purview are where things change. E5 adds the full Purview compliance suite, including:

Trainable classifiers that can recognize clinical document types
Custom sensitive information types with fuzzy matching
The ability to create policies that trigger encryption based on phrase lists you define
Microsoft 365 sensitivity labels with auto-labeling

E5 runs $57 per user per month on top of E3 pricing. For a 15-person practice, that is $855 per month, or roughly $10,260 per year just for the upgrade.

---

Why medical terminology detection specifically requires E5

The gap is not accidental. Microsoft built its default sensitive information types around the categories that generate the most regulatory attention across the widest range of customers: financial PII. Credit cards, bank accounts, national ID numbers.

Medical terminology does not appear in any default M365 DLP dictionary because clinical language is vast, contextual, and highly specialized. A policy that triggers on "cancer" would fire on a newsletter about a cancer charity. A policy that triggers on "diabetes" would fire on a health insurance benefits explanation. Microsoft decided this category required customer-specific tuning via E5/Purview tools rather than a default rule that would generate false positives across millions of tenants.

This is a real gap. E5 Purview's trainable classifiers can be trained on your own clinical terminology, but that training process takes time, sample data, and someone who understands both the data and the Purview interface.

---

Getting close to automatic PHI encryption on a budget

You do not have to buy E5 to make real progress. Here is what you can do with what you likely already have.

Exchange Transport Rules with keyword filtering

If you are on Exchange Plan 2 or higher, you can create Exchange mail flow rules that act on specific keywords. In the Exchange admin center, go to Mail flow > Rules > Add a rule.

You can create a rule that:

Looks for specific words in the subject or body
Applies an action like redirect to a manager, add a disclaimer, or reject the message

The limitation is that this is pattern-based, not context-aware. It will not understand that "The patient in room 3 is stable" is clinical and "I recommended this restaurant to my brother" is not. You will need to maintain the keyword list, and you will get some false positives.

For many small practices, a manually curated keyword list covering the 50 most common terms in your specialty is good enough to catch routine outbound PHI before it leaves the organization.

Microsoft Secure Message Encryption (OME)

OME is available on most M365 commercial plans. It lets you send encrypted messages to external recipients through the Microsoft Secure Portal. The recipient clicks a link, authenticates, and reads the message in a web interface.

OME encrypts the message, but it does not automatically trigger based on content without DLP backing it. You can create a DLP policy that matches specific conditions and then apply an OME protection action, but without E5 you are working with pattern matching, not intelligent classification.

OME is useful as a patient-facing communication tool on its own. A small practice that sends referral letters or test results to patients outside the organization can use OME manually or via a DLP rule that matches specific recipients.

What you cannot do without E5

Without E5 Purview, you cannot:

Use trainable classifiers to detect clinical document types automatically
Create custom sensitive information types with contextual understanding
Auto-classify documents in SharePoint Online based on content
Get the full audit and data classification reporting that compliance auditors often request

---

The email security gap DLP cannot fill

Here is the part that does not appear in most HIPAA email guides. DLP controls what happens to emails you send. It does not control what happens to emails sent using your domain by someone else.

If an attacker obtains your domain and sends spoofed appointment reminders to your patients, M365 DLP will never see those messages. They are not passing through your server. They are being sent from a completely different infrastructure, using your From address to lend credibility to a phishing or social engineering attack.

This is not a hypothetical. Healthcare organizations are frequent targets for domain spoofing because patient communication tends to be trusted. A spoofed appointment confirmation that appears to come from your domain will pass SPF and DKIM checks from the attacker's server, because from a protocol perspective, the attacker's server is authorized to send for that domain.

DMARC aggregate reports show you when this is happening. Those reports are XML files delivered to a hardcoded mailbox, and most small teams never look at them. DMARCFlow processes those reports and sends you alerts when your domain appears in spoofing campaigns targeting your patients.

This is a different layer of protection than DLP, and it costs a flat monthly fee rather than per-user. For a small healthcare team, it is the most cost-effective complement to M365 DLP you can add today.

---

Cost comparison at a glance

Solution	Monthly cost	What you get
M365 Business Premium (15 users)	~$225/month	Basic DLP, financial PII only
Exchange Plan 2 + Business Premium	~$300/month	Extended DLP, Transport Rules, pattern matching
M365 E5 (15 users)	~$855/month + base costs	Full Purview, trainable classifiers, medical term detection
DMARCFlow	Flat fee	Domain spoofing detection, aggregate report analysis, alerting

The honest recommendation: if you are a 15-person clinic and your compliance officer is asking for automatic PHI detection, start with Exchange Transport Rules and a curated keyword list. It will not be perfect, but it will catch the obvious cases. Then add DMARC monitoring to handle the spoofing problem that DLP cannot see.

Only move to E5 Purview if your risk assessment or a compliance audit specifically requires contextual document classification that you cannot achieve any other way.

---

Step-by-step: Setting up keyword-based PHI detection without E5

In the Exchange admin center, go to Mail flow > Rules > Add a rule
Name the rule something like "PHI keyword catch"
Set the conditions: "Subject or body includes specific words or phrases"
Add your keyword list. Common starting points: patient name patterns, condition names, medication lists, referral terminology specific to your specialty
Set the action: redirect to a manager for review, or apply an encryption template if you have OME configured
Set the rule to run in test mode first. Run it for two weeks and review the matches before turning it on fully
Review and trim the keyword list monthly. Clinical language changes and your false positive rate will shift over time

This is imperfect. It will generate some false positives. But it is a working starting point that costs nothing beyond your existing license.

---

Frequently asked questions

Does M365 Business Premium include DLP for medical terms?

No. Business Premium DLP covers financial PII out of the box: credit card numbers, Social Security numbers, bank account numbers. Medical terminology requires E5 or manual keyword rules that you build and maintain yourself.

What is the minimum license for automatic PHI email encryption in Exchange Online?

Exchange Online Plan 2 is the minimum for extended DLP rules and custom sensitive information types. You can build keyword-based Transport Rules on Plan 2, but you cannot use Purview trainable classifiers without E5.

Can I use Exchange Transport Rules instead of DLP for medical terminology?

Yes, with limitations. Transport Rules can match specific words and phrases and apply actions like redirection or encryption. The downside is that this is not context-aware. You maintain the keyword list manually and accept some false positives. For a small team with a limited vocabulary of sensitive terms, this approach is often good enough to meet basic HIPAA workflow requirements.

Does Microsoft Secure Message Encryption meet HIPAA requirements?

OME provides encryption for messages sent outside your organization, which is a required safeguard under HIPAA for electronic PHI in transit. Whether OME alone satisfies your specific compliance requirements depends on your risk analysis and what your compliance officer expects. OME does not automatically detect or classify content. It encrypts what you tell it to encrypt.

How does DMARC help with healthcare email compliance?

DMARC does not encrypt email. It authenticates that emails claiming to come from your domain actually originated from your mail servers. If an attacker sends spoofed appointment reminders to your patients, DMARC aggregate reports will show you that this is happening, even though the emails never touched your server. DMARCFlow processes those reports and sends you alerts, so you do not have to parse XML files manually. This is a different control than DLP, and it addresses a different threat vector.

What is the actual cost difference between E5 Purview and DMARCFlow for a 15-person practice?

E5 is roughly $57 per user per month extra, which is about $10,260 per year for 15 users. DMARCFlow costs a flat monthly fee that does not scale with headcount. For teams that need domain spoofing protection alongside M365 DLP, DMARCFlow is significantly less expensive and covers a gap that E5 does not address.

---

The short version

Microsoft 365 built-in DLP does not detect medical terminology without E5. You can get partial protection today using Exchange Transport Rules and a manually maintained keyword list. E5 Purview gives you the trainable classifiers for clinical language, but it costs $57 per user per month extra. For small healthcare teams, the practical path is: start with what you have, layer DMARC monitoring for domain spoofing, and only buy E5 if your compliance situation genuinely requires it.