HIPAA is actually a pretty fuzzy, nonspecific standard. As long as you take 'adequate' technical/physical/administrative safeguards you are basically fine.

Literally a sealed envelope (when dealing with paper documents) satisfies all three.