Conditional A BAA is available on all Hushmail for Healthcare plans (Basic, Essentials and Growth); the main exclusion is the Personal Use plan, which has no BAA. Verdict date: 2026-10-20. The signed BAA is provided to U.S. customers.
Disclosure: HIPAA Compliant Wiki is published by Chanty, Inc. Chanty is listed in the directory as one vendor among others, and placement never depends on payment or on Chanty's interest.
Short answer
Hushmail offers a BAA on Healthcare Basic, Healthcare Essentials and Healthcare Growth, for encrypted email and web forms with e-signatures. The Personal Use plan does not include a BAA.
The accurate wording is "BAA available on Hushmail for Healthcare plans for the services listed below." It is not "HIPAA certified," and HIPAA status is not a property of the product. A practice only gets that status from a signed BAA plus its own configuration and policies.
The vendor homepage states a starting price of $11.99 per month for a solo healthcare practice. See All vendor HIPAA checks for other vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Healthcare Basic | Yes | Signed BAA provided with the plan | None; minimum 1 seat |
| Healthcare Essentials | Yes | Signed BAA provided with the plan | None; minimum 1 seat |
| Healthcare Growth | Yes | Signed BAA provided with the plan | None; minimum 1 seat |
| Personal Use | No | Not applicable | Not applicable |
The vendor FAQ states that the Personal Use plan does not include an email archive, a BAA or an IMA.
A one-person practice that signs up for Personal Use because it is cheaper has no BAA with Hushmail. The same is true for a billing clerk who opens a personal account to email statements. Neither setup is covered.
What the BAA covers and what it excludes
Covered under the Healthcare plans:
- Encrypted email
- Web forms with e-signatures
- Email archive
Excluded: no excluded features are recorded in the vendor's published terms. The Personal Use plan is excluded entirely, because it has no BAA.
Coverage should not be extended to anything that is not listed above. If a workflow involves another Hushmail feature, ask the vendor to confirm it in writing before PHI goes through it.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published" does not mean "absent." It means the vendor's pages the vendor pages do not state it. A security officer who needs one of these controls for a vendor inventory should request it from Hushmail directly and record the answer with a date.
How to use Hushmail with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the tool alone. Terms such as BAA and PHI are defined in the HIPAA glossary: BAA and PHI.
- Sign the BAA before anyone sends PHI through Hushmail.
- Use a Healthcare plan, not Personal Use.
- Confirm which services are in scope: encrypted email, web forms with e-signatures and email archive.
- Manage user access and offboarding. When a front-desk employee leaves, remove their account the same day.
- Set staff policies and train staff on what may be sent by email and what may be collected in a web form.
- Verify with the vendor any control that is not published, such as encryption at rest, audit logging or SSO.
- Keep the signed BAA and the check date in your vendor inventory.
Alternatives with a BAA
Each of these also has a BAA available on specific plans or services. Check the linked page for the exact scope.
- Formstack: conditional; BAA tied to the Forms HIPAA add-on.
- Gmail in Google Workspace: conditional; Business Starter.
- GoDaddy: conditional; Microsoft 365 email on plans it represents as HIPAA-compliant.
- Google Forms: conditional.
- Google Workspace: conditional.
For side-by-side tables, see HIPAA-compliant email software and HIPAA-compliant form tools.
Sources
- Hushmail Pricing — Pricing page, checked 2026-10-20. "Business Associate Agreement (BAA)"
- Hushmail for Healthcare — Vendor page, checked 2026-10-20. "Get a signed business associate agreement (BAA) for healthcare providers"
- Hushmail Frequently Asked Questions — Help article, checked 2026-10-20. "It does not include an email archive, Business Associate Agreement (BAA), or Information Manager Agreement (IMA)."
- Hushmail Frequently Asked Questions (Canadian providers) — Help article, checked 2026-10-20. "our U.S. customers get a signed BAA to support their HIPAA compliance"
- Hushmail: Encrypted Email and E-Signable Forms — Pricing page, checked 2026-10-20. "Get HIPAA-compliant email for your practice for as little as $11.99 per month"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does Hushmail sign a BAA, and on which plans?
Yes. A signed BAA is provided with Healthcare Basic, Healthcare Essentials and Healthcare Growth, to U.S. customers. The Personal Use plan does not include one.
Can I use the Personal Use plan for PHI?
No. The vendor FAQ states that Personal Use does not include a BAA, and without a BAA PHI should not be handled there. Move to a Healthcare plan and sign the BAA first.
Is there an extra cost for the BAA?
No extra cost is recorded. The BAA is provided with the Healthcare plans, with a minimum of 1 seat. The vendor homepage states a starting price of $11.99 per month for a solo healthcare practice.
Which Hushmail services does the BAA cover?
Encrypted email, web forms with e-signatures and email archive. No excluded features are recorded in the vendor's published terms. Do not assume coverage for anything outside this list.