From my very surface-level experience with HIPAA, I'd say to just call the whole thing off. All it does is make me irritated that medical providers send me those stupid "secure email" messages - or worse, only accept fax.