Most email providers do offer encryption in transit and at rest email. Email sent by any modern provider is sent over TLS. As proof both Gmail and office365 are HIPAA compliant. There are also additional protections such as DKIM that can be enabled. Or as otherwise mentioned, you can encrypt your emails with an additional layer of encryption using keys that you manage so that if Google/Microsoft/etc are exploited your emails are still encrypted.