I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not asking a "should" question here. I know patient-doctor communications should be encrypted. I know that the meaningful use requirements now in draft reward for Direct Project based communications.
What want to know is, definitively, can healthcare providers have patients sign waivers that allow the doctors to legally email in plain text with them? People seem to read the different HIPAA-HITECH act regulations very differently. Vendors of secure products always say that secure email is legally required. Yet I know several healthcare providers who communicate PHI using plain-text email with their patients, by having their patients sign something that says that the patient understands the issues with plain text email and still considers it "protected" under HIPAA.
So there at least some people who argue that it is illegal (vendors) and some who argue that it is legal and actively send plain text emails.
I am not asking this because I do not have an opinion on this myself. I am asking for someone to make an assertion regarding this issue, and back it up with quotes and corresponding links to the various sections of the laws and federal rules in question. Obviously all of the relevant national level rules and laws should be referenced in an accepted answer.
Because this can be a bit of work, I am putting a bounty on this one.