Standard Internet email provides no security for PHI. Many facilities would choose not to allow transmission of PHI via email at all.

Some facilities may allow transmission of PHI via secure encrypted email, or as password protected email attachments.

You must of course comply with your facilities' policies and procedures regarding any use or disclosure of email for PHI.