What HIPAA requires of you, in plain English
If your practice handles Protected Health Information (PHI) — patient charts, X-rays, lab results, intake forms — you need to keep that data private when it's emailed or shared electronically. HIPAA's Security Rule calls these "technical safeguards." Three things matter most:
- Encrypt PHI in transit and at rest. Patient data should never travel over plain email or sit unprotected on a server.
- Authenticate the recipient. Only the intended person should be able to open the message.
- Have a Business Associate Agreement (BAA) in place with anyone who handles PHI on your behalf.
How Lockbin handles each one
Encryption in transit and at rest. Every message body and attachment travels over TLS 1.2 or higher and is stored encrypted with AES-256 on our servers. Each message has its own key, and that key is protected with RSA. Encryption runs on Microsoft's Windows cryptographic library (CNG) on our servers.
Recipient authentication. Recipients open messages from a unique URL plus a password. Without both pieces, the message stays locked. You can also use passwordless secure links for known recipients.
A record of access. Lockbin records when each message is opened, from what IP address, and when messages are deleted.
Business Associate Agreement. Lockbin signs a HIPAA BAA on Premium and Enterprise plans. See below for how to sign it.
Signed HIPAA BAA
Lockbin signs a HIPAA Business Associate Agreement on Premium and Enterprise plans. The BAA isn't available on the free plan. To get yours:
- Sign up for Premium, or Enterprise for an office with several people.
- Open HIPAA BAA in the left menu of your Lockbin inbox, enter your practice details and type your name to sign.
- Lockbin countersigns instantly and emails you the signed PDF.
The BAA commits Lockbin to safeguard your PHI and notify you within 60 days of any breach, per HIPAA rule 45 CFR 164.410(b). More about the BAA.
Tip: keep patient details out of the subject line. Subject lines, file names, and sender and recipient addresses aren't encrypted at the message level, so put patient information in the message body or an attachment.
What you don't have to worry about
- No software installs. Lockbin runs in any modern browser.
- No special training. Your front desk can send a secure message in under a minute.
- No special accounts on your patients' end. They open your message from a link.
- No data sitting on our servers indefinitely. Messages auto-delete after the retention window you set.
Get started
Premium ($10/user/month) and Enterprise ($10/user/month for multiple seats) include the signed BAA, multi-message archive, custom branding, and admin compliance copy. Start a free trial or email support@lockbin.com for help choosing a plan.
Technical details for IT and compliance teams
HIPAA Security Rule, 45 CFR 164.312(a)(2)(iv) and (e)(2)(ii) — covered entities must consider implementing encryption as a method for safeguarding EPHI. DHHS guidance specifies that "valid encryption processes for data in motion are those which comply, as appropriate, with NIST Special Publications 800-52, or others which are FIPS 140-2 validated."
Lockbin encrypts messages and attachments with AES-256 using Microsoft's Windows cryptographic library (CNG). NIST moved all FIPS 140-2 certificates to its historical list in September 2026, and the Windows Server 2025 library Lockbin runs on has not yet been issued a FIPS 140-3 certificate, so Lockbin does not currently claim FIPS validation.
NIST Special Publication 800-88, "Guidelines for Media Sanitization." EPHI must be destroyed in accordance with this guidance. Lockbin deletes expired content on a regular schedule.
HIPAA rule CFR 164.505(e)(2)(ii)(C) and 164.314(a)(2)(i)(C) — covered entities and business associates must establish a contract requiring the BA to report to the CE any uses or disclosures of EPHI not provided by the contract, plus any security incidents. Our BAA satisfies this and commits to breach notification within 60 days, per CFR 164.410(b).
Key management. Each message is encrypted with its own AES key, and that key is protected with RSA.
Hosting. Lockbin is hosted on Amazon Web Services (AWS) in the United States.
Email support@lockbin.com for our risk-analysis document, network diagram, and BAA template.