It's either bullshit(fairly likely) or the rules need to be changed yesterday(actually, at least a couple of administrations ago).
Aside from the obvious issues with complying with transparency, discoverability, and archiving requirements that are legally imposed on official business even at much lower levels(heck, I've done penny-ante IT minion stuff for small municipalities that was subject to public records laws that would have made doing things over personal email grossly unprofessional at best and illegal at worst, and she's the fucking Secretary of State...), what about security?
Given the delightful creep of the Top Secret National Security Stuff blob to cover ever larger swaths of DC, surely the Secretary of State does some emailing about stuff that is, at least for little people, probably supposed to not leave the SCIF, much less be handled by who-knows-who at some random email provider or a DNC mailserver admin.