This sounds terrible, but who cares about HIPAA compliance. I am still waiting for the HIPAA police to actually declare themselves.
But, Wayne, there is a guideline in the hugeh HIPAA document which outlines step by step how you can send and receive email which meets with HIPAA regulations. It just involves sending a couple of emails back and forth between you and the patient.
I use CertifiedMail, which is $9.95 per month and works perfectly for HIPAA compliance. The only problem is most doctors cannot figure out how to make up a password and type it in. I mean it's so easy it is ridiculous. But, then again, I imagine the average patient is more tech savvy than most doctors.