The emails that extendedReach sends and receives support SSL/TLS encryption, as it is the standard and virtually universally supported. It provides in-transit encryption to prevent access to the email and its contents.

You can check that an email server supports TLS with the following tool:
https://www.checktls.com/perl/live/TestReceiver.pl

The email notifications that extendedReach sends, can be setup and configured under Administration » System » Email Alerts (Active).  You can control whether these contain PHI or not with the settings, depending upon if recipients of the alerts are using a TLS email server.