When to encrypt
Encrypt any email that contains information you’d be uncomfortable seeing on a postcard: patient details, Social Security numbers, bank or card details, tax documents, or confidential legal material. For large files, a secure sharing link is often better than an attachment (see Share files with clients securely from OneDrive).
What you need
Encryption in Outlook uses Microsoft Purview Message Encryption.
- Microsoft 365 Business Premium and the Microsoft 365 / Office 365 E3 and E5 plans include it.
- Business Basic and Business Standard don’t include it on their own; it needs an add-on. Check what’s currently offered in the admin center under Billing > Purchase services, or ask your IT provider.
If you don’t see an Encrypt button, your plan may not include it, or it hasn’t been turned on for your organization.
New Outlook and Outlook on the web
- Start a new email.
- Open the Options tab (in some layouts, click … at the top of the message).
- Click Encrypt and choose Encrypt or Do Not Forward.
- A banner at the top of the message confirms it’s encrypted. Write and send as normal.
Classic Outlook for Windows
- Start a new email.
- On the Options tab, click Encrypt and pick an option from the list.
- Check the banner, then send.
Outlook on iPhone and Android
When writing an email, tap … (or the options icon) and look for the encryption or sensitivity option. If it isn’t there, send the message from your computer instead.
What the recipient sees
- Outlook and Microsoft 365 users usually open it like any other email.
- Gmail, Yahoo and others get a message with a link. They sign in or request a one-time passcode by email, then read it in their browser.
Encrypt or Do Not Forward?
| Option | What it does | Use it for |
|---|---|---|
| Encrypt | Encrypts the message and attachments. The recipient can still forward or print it. | Most sensitive email to clients and patients |
| Do Not Forward | Encrypts it and stops the recipient forwarding, printing or copying it | Anything that should go no further than the person you sent it to |
Good to know
- Double-check the recipient’s address before you send. Encryption doesn’t help if it goes to the wrong person.
- Never put a password in the same email as the file it opens.
- Encryption protects the message in transit and in storage. It’s one part of protecting health information, alongside access controls, multi-factor sign-in, audit logs and staff training.
Related
- IT for medical and dental practices
- Email security services
- Share files with clients securely from OneDrive
More guides
- Microsoft 365 admin: add staff, reset passwords and offboard someone who leaves
- Microsoft 365 Copilot: what it does, where to find it, and how to use it safely
- Set up Microsoft Authenticator and Outlook on your phone (iPhone and Android)
- How to check your email's SPF, DKIM and DMARC records (and what the results mean)
- What goes in a WISP: a checklist for small tax offices
- Share files with clients securely from OneDrive (expiring links, no attachments)
- Hand over HOA or office email when a board member or manager changes
- How to spot and report a phishing email in Outlook
Microsoft changes its menus from time to time, so a button may have moved. These guides are general information for small businesses; check with your IT provider before changing settings that affect everyone.