Individuals have to give authorization before they receive email notifications because email is not a secure communication channel. Covered Entities must obtain the authorization of an individual before sending an email that contains PHI; and, because breach notifications inform individuals what PHI was accessed, Covered Entities can only communicate a breach by email if they have a prior authorization.