Sending PHI via email is permissible under HIPAA, but it must be done securely. This means using encryption, ensuring that emails are sent to the correct recipient, and implementing other necessary safeguards. Additionally, patients must be informed about the risks of email communication and provide their consent.