Boondoc,
I use simple email just as you suggested above for more than a year now.
When I first asked about this on the forum I got lots of " I wouldn't ever do that" type of response. However, someone did point out that they had never seen a HIPPA policeman.
I concluded that the real liability might be a disgruntled employee who wanted to cause trouble by reporting ( to whom?) that you were violating HIPPA regulations. Or, perhaps an ugly malpractice attorney.
Therefore I consulted with my malpractice carrier and they did not have any issues with using regular email to communicate with patients as long as we had them sign a consent to communicate via email. When I sat down to write out the consent form I realized that there was nothing sacred about the phone communication and messages that we have been using in the past. Thus I made the consent inclusive and covered phone as well as email. There are many patients who love email ( gets the practice brownie points). I also love the email, it can be imported to the chart as a message from the patient and avoids the labor and supply costs associated with receiving a fax, attaching it to the chart, answering it, faxing it back and then shredding a little part of the forest.