I've got a new client (doctor's office) that is in need of a private messaging system that is HIPAA-compliant. Does anyone know of a module that meets those privacy and security standards? I'm still in the early stages of researching this and haven't delved into the details of what the HIPAA  requirements are yet, but I'm hoping that someone else has some experience with medical sites already and can point me towards an existing solution. Thanks!

I think that's probably great advice. I am no longer entertaining the idea of writing this from scratch and I'm leaning towards making them go outside DNN for their secure "email" (as they call it) solution.

The only other solution that I was considering was to use a forums module and install a different instance of the forum for each patient (it's a VERY small practice). The patient and doctor could go back and forth in private (as long as there is an SSL cert), and the email notification would have to let each know when there's a new post without revealing the contents of the post. I think Active Forums can do that. The other kind of cool thing about that would be that the doctor could provide other personalized content on the page for each patient (documents, links, etc...).

I'll have to do some more research to see if that is sufficient, but that's basically how the secure email system that my wife's doctor uses works. This project is actually for my wife's client, so if I don't seem fully up to speed on this, that's probably why!

Thanks again!