Hippa is a complicated process. mostly bureaucracy gone mad, with a dash of security. I understand email sent using s/mime is hippa compliant. But as a non American I am no expert in US law. You might want to seek information from a local consultant. S/Mime is encrypted email and is supported by most major email clients outlook and Thunderbird being among them. For S/Mime to be used you must have email certificates for all email addreses used and enforce the strict use of encryption on sending. While it is possible to require encryption when sending from an email address, software will never be a cure for stupidity. Most consultants I have spoken to about s/mime basically say their average user is not competent to use it. (I think the exact phrase is usually too stupid, but these are valuable and skilled employees they are talking about.)