We email records to labs and specialists. Is that a problem?

Encryption is what the Security Rule calls an addressable specification, which does not mean optional. It means you either implement it or document why a reasonable alternative is sufficient, and "we have always done it this way" is not that documentation. Ordinary email between your practice and an outside lab is not encrypted end to end and should not carry patient information.

Practical options, roughly in order of how little they disrupt your front desk:

• Encrypted email through your existing Microsoft 365 or Google Workspace, which can be triggered automatically by rules that detect patient information, so nobody has to remember
• A secure portal or link-based delivery for larger files and imaging
• Using the lab's or specialist's own portal where they have one, which most now do

Patients are a separate case. A patient may ask you to send their records by ordinary email, and you can do that if you have warned them of the risk and documented their preference. That exception applies to patients, not to labs, specialists, or insurers.

The bigger finding during onboarding is usually not how records go out. It is that years of patient information sitting in mailboxes has become the practice's largest unmanaged store of protected health information.