We use Office 365, which might make a difference.
Can I (legally) send an MRN, with no other demographic or health information, from email@example.com to firstname.lastname@example.org?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
DISCLAIMER: I am not a legal expert and I strongly believe you should consult one. This answer is based on my reading of the rules. Others may read them differently.
First, note that Microsoft claims that Office 365 can be made HIPAA compliant if you have a "Business Associate Agreement" (BAA) with them. See the Microsoft Trust Center - HIPAA for details.
The HIPAA Privacy Rule explicitly lists an MRN as Protected (PHI), meaning that the Security Rule disallows sending it over an insecure system. By default, Office 365 would be considered insecure for this purpose.
However, if you have set up a BAA with Microsoft, which Microsoft's marketing literature says will make your Microsoft Office 365 be HIPAA Security Rule compliant, then sending PHI over this properly secured system would not be a problem.
NOTE: You still need to make sure that any computers or mobile devices which access the email server are set up for HIPAA compliance, but that is outside the scope of this question.