regular email isn’t supposedly not HIPAA compliant

It isn't.

I work in healthcare, and if anyone in the company sends an email with PHI or PII in it, we're supposed to alert the Security department, or lose our jobs.