Can Microsoft 365 automatically encrypt outgoing emails that contain PHI?

Try an Exchange mail flow rule first if you can narrow the problem to a manageable set of terms. A rule that matches words or patterns in the subject or body can apply Microsoft 365 Message Encryption to outgoing messages.

That's a blunt filter, not a PHI classifier. It can miss wording you didn't anticipate and catch harmless messages. Check the current licensing for the encryption action, then test with sample messages and attachments before relying on it.

You're dealing with two separate features: identifying the information and encrypting the message. Purview DLP is the Microsoft option to investigate for more sophisticated detection, but having an encryption capability doesn't necessarily mean you have every classifier you want.

I'd make a short list of the exact detection and enforcement features you need, then check their current license requirements with Microsoft before buying. The discussion doesn't establish that full E5 is the minimum for this particular setup, and the licensing has been confusing.

Another route is to have senders classify messages with published labels and use the PHI label to trigger encryption. That gives staff an explicit way to protect a message even when a keyword rule wouldn't catch it.

The catch is that it depends on people choosing the right label. It adds friction and isn't the automatic safety net you're asking for, so consider it alongside detection rather than treating it as a substitute.

Don't forget the recipient side when you test. Some external recipients may need to follow a link and authenticate or get a code to read the message. Links can also be blocked or rewritten by their mail systems.

If there's already a patient portal, a generic notification that information is available there may be easier for routine patient updates. It won't solve the separate problem of someone emailing a sensitive spreadsheet to an insurer, though.

Be careful about treating a list of medical words as a complete definition of PHI. Context matters, and even a short appointment message may reveal information about care. A privacy or compliance specialist can help define what the rule needs to catch.

Use realistic test cases for both message text and attachments, including benign messages that shouldn't trigger. An automatic rule can be a useful safety net without catching everything.