HIPAA doesn’t exactly make that illegal, but it comes so close that approximately zero doctors would be willing to skirt that line and risk the enormous penalties if they guess wrong.

All major EHRs now have some sort of patient portal with secure (HIPAA compliant) messaging built in.

Sure, but patients don’t want to sign up for yet another portal. Unfortunately, the methods they want to use may not be practicable options.