10 O'clock Postman

From Search Security comes this piece on e-mail encryption. As the writer points out, there is really no longer any excuse:

Given the availability and affordability of encryption technology today, it is difficult for a healthcare organization to justify not using some form of it when transmitting PHI. A number of vendors offer a variety of reasonably priced encryption hardware and software, as well as outsourcing options.

For a smaller practice, there are a number of free or nearly free options, and for larger enterprises, if you don't already have some way to encrypt your e-mail, you better not be sending PHI. Though this is an adressable, I would find it difficult to defend any decision concerning PHI sent over e-mail that doesn't include encryption.