Email Archiving for Healthcare: Protecting Patient Data

Few sectors face a more demanding regulatory environment than healthcare - and few rely on email as heavily as healthcare does in daily operations. Referral letters, laboratory results, discharge summaries, prescription requests: a significant share of clinical and administrative communication travels by email. At the same time, the information contained in those messages belongs to the most sensitive category of personal data recognised by EU law.

For hospitals, GP practices, medical centres, diagnostic laboratories and other healthcare providers, this creates a layered set of obligations. Beyond the general commercial and tax retention rules that apply to any business, healthcare organisations must contend with professional documentation duties, strict data protection requirements for health data, and - since 2024 - the cybersecurity obligations introduced by the NIS2 Directive. This article sets out what those requirements mean in practice and what a compliant email archiving system must deliver.

The starting point under data protection law is Article 9(1) GDPR. Health data is explicitly classified as a special category of personal data - alongside genetic data, biometric data, data revealing racial or ethnic origin, religious beliefs, and data concerning a person's sex life or sexual orientation. Processing data in these categories is prohibited by default. The prohibition lifts only where one of the narrowly defined exceptions in Article 9(2) GDPR applies.

For healthcare providers the most relevant exception is Article 9(2)(h): processing is permissible where it is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care, or the management of health or social care systems - provided that processing is carried out by or under the responsibility of a professional subject to an obligation of professional secrecy.

What does this mean for email archiving? Any email that contains a patient's name together with a diagnosis, test result, medication plan or treatment note is special category data. Storing that email in an archive is itself a processing operation under the GDPR and must be covered by a lawful basis. Retention for documentation purposes - required under national medical practice legislation and civil liability rules - generally satisfies this requirement, but only if the archiving is limited to what is necessary and if appropriate technical and organisational measures have been applied as required by Article 32 GDPR.

For a Data Protection Officer (DPO) in a healthcare organisation, email archiving is therefore not a purely technical matter. It must appear in the Records of Processing Activities (ROPA) under Article 30 GDPR, with the lawful basis, purpose limitation, access controls and security measures all documented.

Email in Healthcare: What Is Actually Being Archived?

Before turning to the legal requirements in detail, it helps to consider the range of emails that healthcare providers actually send and receive - and which of them carry archiving obligations.

Referral letters and discharge summaries are still frequently transmitted by email between referring GPs and specialist clinics, between hospitals and community care teams, or between departments within the same institution. These documents contain full diagnoses, medication lists, operative reports and treatment histories. They are medical records and must be retained for the periods prescribed by national medical law - typically ten years from the end of treatment, and in some cases considerably longer.

Laboratory results and imaging reports are routinely delivered by email or through email-connected portals. They form part of the patient record held by the requesting clinician and are subject to the same retention obligations.

Prescription requests and medication queries - particularly from patients with chronic conditions who request repeat prescriptions by email - generate correspondence that carries documentation value. If a prescribing decision is later questioned, the archived exchange between patient and clinician may be the only evidence of what was communicated and what was prescribed.

Administrative correspondence with insurers, health authorities, regulatory bodies and suppliers may not always contain individual patient data, but it frequently constitutes commercial correspondence subject to standard tax retention rules.

Internal communications between departments or between clinical and administrative staff that concern specific patient cases are medical documentation, even when conducted informally by email.

The practical conclusion is that in most healthcare organisations, nearly every inbound and outbound email is either subject to medical documentation requirements, commercial retention rules, or both. A selective approach - archiving only invoices, or only certain senders - is rarely adequate.

Article 35: Data Protection Impact Assessment

Article 35(3)(b) GDPR states that a Data Protection Impact Assessment (DPIA) is mandatory where processing on a large scale involves special categories of data as referred to in Article 9. The European Data Protection Board (EDPB) has confirmed in its guidelines on DPIAs that systematic processing of health data by healthcare providers meets this threshold.

This means that establishing or significantly modifying an email archiving system in a healthcare setting requires a DPIA before the processing begins. The DPIA must assess the necessity and proportionality of the archiving, the risks to the rights and freedoms of patients and staff, and the measures taken to address those risks. It must be documented and kept up to date.

Organisations that have been archiving emails for years without ever conducting a DPIA for that processing activity are in a compliance gap that should be addressed.

Article 32: Encryption as a Required Measure

Article 32 GDPR requires controllers to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. For special category data, the bar is high. The EDPB and several national supervisory authorities have indicated that encryption of health data - both in transit and at rest - is a baseline expectation rather than an optional measure.

The German Data Protection Conference (DSK), in its 2021 guidance on email encryption, drew a clear distinction between two levels of protection relevant to healthcare email:

Transport encryption (TLS) secures the transmission of an email between mail servers. It is the minimum standard and is widely deployed. However, TLS protects the message only while it is in transit; it does not protect the content once it is stored on a server or in an archive.

Content encryption or end-to-end encryption goes further by ensuring that the email content is not readable in plaintext by the email provider, the archiving provider, or any other intermediary. The DSK guidance states that for emails containing sensitive personal data - including health data - transport encryption alone is insufficient. Organisations should implement S/MIME or PGP for end-to-end encryption, or alternatively ensure that the archiving system stores messages in encrypted form with access strictly limited to authorised personnel.

For email archiving this means: the archive must store message content and attachments in encrypted form at rest. An archiving system that holds emails in plaintext on a server - even a well-secured server - does not meet the standard expected for health data. Encryption keys must be managed so that only authorised individuals can decrypt archived messages.

Article 5(1)(c): Data Minimisation

The principle of data minimisation under Article 5(1)(c) GDPR requires that personal data be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed. Applied to email archiving, this means that emails with no medical documentation value and no commercial retention requirement should not be held indefinitely. A compliant archiving policy distinguishes between categories of email and applies the shortest retention period consistent with the applicable obligation.

Access Controls and Audit Logging

Article 32 GDPR, read alongside Article 25 (data protection by design and by default), requires that access to archived health data be limited to those who need it. In a hospital or large practice, this means role-based access controls: administrative staff should be able to access commercial correspondence but not clinical records; clinical staff should access only the patient records relevant to their area. Every access to archived emails should be logged with a timestamp, user identity and the message retrieved. Those access logs are themselves personal data and must be stored securely.

NIS2: Healthcare as an Essential Entity

The NIS2 Directive (EU 2022/2555), which EU member states were required to transpose into national law by October 2024, designates healthcare as a sector of essential entities in Annex I. This brings healthcare organisations above defined size thresholds within the scope of mandatory cybersecurity obligations.

In most member states the thresholds follow the NIS2 framework: organisations with 50 or more employees or an annual turnover exceeding EUR 10 million are classified as essential or important entities and must implement a risk management programme covering their information systems and communication infrastructure. Obligations include:

Cybersecurity risk management for all IT systems, including email infrastructure
Incident reporting to the national competent authority within prescribed timeframes
Security measures for electronic communications, including encryption and integrity protection for email
Documentation of security measures to demonstrate compliance to supervisory authorities

An email archiving system that provides tamper-evident storage, access logging and encrypted retention directly supports NIS2 compliance. The audit trail generated by a compliant archive - recording who accessed what and when, with cryptographic proof that archived messages have not been altered - constitutes evidence of security measures for NIS2 purposes.

Smaller practices below the NIS2 thresholds are not directly bound by the directive, but national health authorities and digital health programmes across the EU increasingly reference NIS2 standards as the baseline for healthcare IT security. Practices connected to national health IT infrastructure (such as the German Telematikinfrastruktur or equivalent systems in other member states) may face contractual or regulatory security requirements that effectively mirror NIS2.

Cross-Border Considerations: Patient Data Within the EU

Healthcare is increasingly cross-border. Patients treated in another EU member state, referrals between clinics in different countries, telemedicine consultations: all generate email correspondence that may contain health data flowing across national borders within the EU.

Within the European Economic Area (EEA), the transfer of personal data between member states is not a "third country transfer" under the GDPR and does not require additional safeguards. Data can flow freely between EEA countries. However, Article 9 GDPR still applies to health data regardless of where within the EEA it is processed. The national law of each member state may also impose additional requirements for health data processing - some member states have stricter national rules under Article 9(4) GDPR.

For email archiving, the key implication is that the archiving infrastructure itself must remain within the EEA. Storing archived health data on servers outside the EEA - including with US-based cloud providers unless an appropriate transfer mechanism under Article 46 GDPR is in place and documented - creates a compliance risk that is difficult to justify for special category data.

Healthcare organisations working with an external archiving provider must also ensure that a Data Processing Agreement (DPA) under Article 28 GDPR is in place. The provider processes patient data on behalf of the healthcare organisation and must commit contractually to processing only on documented instructions, implementing adequate security measures, and not subcontracting to parties outside the EEA without prior authorisation.

What a Compliant Archiving System Must Deliver

Drawing together the requirements described above, a healthcare email archiving system must provide the following:

Automatic and complete capture: the system must archive every inbound and outbound email without manual intervention and without allowing users to bypass archiving. Selective capture (only certain accounts, only certain senders) creates documentation gaps.

Tamper-evident storage: archived messages must be stored in a form that makes any subsequent alteration detectable. Cryptographic hashing at the point of ingestion, with hashes stored independently of the message content, is the standard approach. The system must be able to prove that a retrieved message is identical to the original.

Encryption at rest: message content and attachments must be encrypted in the archive. Key management should ensure that the healthcare organisation retains control over access, with customer-managed keys preferable to keys held exclusively by the provider.

Role-based access controls: access to the archive must be configurable by role and by organisational unit, so that clinical and administrative access can be separated.

Comprehensive access logging: every query and every retrieval from the archive must be logged with a timestamp and user identity, and those logs must themselves be retained securely.

Configurable retention periods: the system must support different retention rules for different categories of email. Shorter periods apply to general commercial correspondence, longer periods to medical documentation, and extended periods to specific regulated categories such as radiation dose records or clinical trial documentation.

EEA-only data storage: all archived data, including backups, must be stored within the EEA. The provider must be able to document this and must notify the healthcare organisation of any change in storage location.

A signed Data Processing Agreement: before any patient data is processed by the archiving system, a DPA complying with Article 28 GDPR must be executed between the healthcare organisation and the provider.

Compliance Checklist for Healthcare Organisations

The following questions provide a starting point for assessing your current position:

Has a DPIA been conducted for email archiving as a processing activity involving health data?
Is the email archiving activity documented in your Records of Processing Activities under Article 30 GDPR?
Are all inbound and outbound emails captured automatically, without the possibility of user bypass?
Are archived emails stored with tamper-evident protection (cryptographic hashing)?
Are archived emails encrypted at rest?
Are retention periods configured separately for medical documentation, commercial correspondence and accounting records?
Is access to the archive controlled by role and by organisational unit?
Are all archive access events logged with timestamp and user identity?
Is a Data Processing Agreement in place with the archiving provider?
Is all archived data stored exclusively within the EEA?
Does the archiving setup meet the security standards expected under NIS2 for your organisation's classification?

Healthcare Email Archiving with EasyMailArchive

EasyMailArchive was designed for data protection environments where the stakes are high. Every archived message is stored with cryptographic tamper-evidence and AES-256 encryption at rest. All data is held exclusively on EU-based infrastructure. Retention periods are fully configurable - you can define separate rules for clinical documentation, accounting records and general correspondence, and have messages deleted automatically when their retention period expires.

A Data Processing Agreement under Article 28 GDPR is concluded with every customer as a standard part of onboarding. Role-based access controls and comprehensive access logging are built in, not optional add-ons. EasyMailArchive can be connected to your email infrastructure within a few hours, with no server installation at your practice or clinic.

Try EasyMailArchive free for 30 days and speak with us about your specific compliance requirements in healthcare.