And as we've seen, even a person's name or email address may be considered protected health information when it's linked with a medical condition. Covered organisations are required to take reasonable precautions to secure protected health information (PHI) that is delivered by email all the way to the mailbox of the recipient.