We need to maintain HIPPA compliance for forms on our website that are currently mailed to an internal email address. While the user/customers provides the info over HTTPS, we still want to make sure that we remain compliant...

Are there any plugins for ensuring that emails sent from the Wordpress application to a recipient are encrypted?

Essentially, I want to make sure that the data is secured from the time a customer gives us the data to the time it arrives on our encrypted mail server.

Update on HIPPA Compliance

Disclaimer: I am not an attorney nor a compliance official. What follows is my interpretation of the rules and laws and it may not be accurate. I would encourage you to exhaust your resources to make sure that your organization is meeting all compliance requirements where applicable by law or morals.

From a quick read of the above 2 links, it seems that the requirement is to simply try to ensure all possible and appropriate safeguards are in place. If the data can be encrypted, then it should. I am seeking further guidance from a compliance officer to ensure that we are doing everything possible to safely transport customer data to our staff.

  • Define "this." Which rules in particular are you trying to follow? If data is sent to the server over HTTPS it's already encrypted. Do you just need the server to encrypt it when sending out to some other location? Please explain, in detail, what regulations you're trying to follow. Not everyone here is familiar with HIPPA :-) – EAMann Mar 6 '12 at 23:39
  • Hopefully that helps clarify. – RSolberg Mar 6 '12 at 23:44
  • Yes. See my answer below. – EAMann Mar 6 '12 at 23:44

Your best bet would be a plugin called WP Mail SMTP, though it's only marked as being compatible as of WP 3.2.1 (but it should reasonably work with WP 3.3.1).

Just to define the process ...

  1. Visitor enters site and fills out form on your page.
  2. User submits the form, which is transmitted to your server via a secure connection (HTTPS).
  3. Your server packages the submitted form data and sends it in an email to another location.

Step #3 is where you need some added security. By default WP uses mail() to send messages. But the plugin I mentioned above overrides this and allows you to send messages using SMTP. It further allows you to specify SSL/TLS encryption.

I can't guarantee this will stand up to a HIPPA security audit, it's your responsibility to conduct the due diligence there. But if you want to be sure submitted data is encrypted and secure from the time the browser submits the data to when it appears in your inbox, this is your best off-the-shelf bet.

  • Thank you sir! We will seek assistance from a compliance department to confirm this meets the requirements! – RSolberg Mar 6 '12 at 23:52
  • 2
    @RSolberg Please report back for later readers. Thanks. – kaiser Mar 7 '12 at 8:00
  • 1
    @kaiser - I'll update my post above with information as I learn. So far, it appears that using SSL to send the email may be all that is required. – RSolberg Mar 7 '12 at 15:46
  • @RSolberg If you really want to check for SSL, then take a look at my gist. Sadly core doesn't offer a satisfying function, plus: It's not pluggable. But as long as you're dealing with 3rd party libs and APIs, you can use it. – kaiser Mar 7 '12 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.