HIPAA-compliant email providers: vendors with a BAA compared

Of the eight email services listed here, Paubox is the only "yes": its BAA is included automatically with every account. The other seven are "conditional". A BAA exists, but someone must accept or request it, and it covers only named plans and services. Every row is based on the vendor's own published terms.

HIPAA-compliant email providers at a glance

Email that carries PHI needs a provider that signs a business associate agreement (BAA) for the mailbox service, plus encryption in transit to the recipient. Consumer mailboxes, such as personal Gmail and Outlook.com, are never covered. Marketing email platforms are a separate category, covered in HIPAA-compliant email marketing. For other tool types, see HIPAA-compliant software by category.

This page uses one wording rule: "BAA available on plan X for service Y." It never says "HIPAA certified" or "X is HIPAA compliant" as a property of a product. A signed BAA does not make an organization compliant. The customer still has to configure access, train staff and keep policies.

• Yes: the vendor's own source shows a BAA included for the named plan, with no separate request step.
• Conditional: a BAA is available, but only after acceptance or request, and only for named plans and services.
• No: the vendor's source says it will not sign a BAA for the service.
• Unknown: the vendor publishes no source, so no verdict is given.

Disclosure: HIPAA Compliant Wiki is published by Chanty, Inc. Chanty is internal staff chat, not an email provider, and appears here only as a vendor entry in its own categories. Table order and verdicts never depend on payment or on Chanty's interest.

Comparison table: BAA, plan, how to get it, price

Vendor	Verdict	BAA from plan	How the BAA is obtained	Starting price
Paubox	Yes	Email Suite Standard	Included automatically with every account; BAA text published at paubox.com/business-associate-agreement	$32/month billed annually (minimum subscription, up to 5 email addresses)
Gmail in Google Workspace	Conditional	Business Starter	Super administrator accepts the Business Associate Amendment in Admin console: Account settings > Legal and compliance	€6.80 per user/month, annual commitment (Business Starter)
Google Workspace	Conditional	Paid editions administered in the Admin console (Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits)	Super administrator accepts electronically in the Admin console (path in the next section)	€6.80/user/month (Business Starter, annual commitment)
Microsoft 365	Conditional	Microsoft 365 Business Basic	Included by default in the Microsoft Products and Services Data Protection Addendum (DPA) for covered entities and business associates; no separate signature	$7.00/user/month (Business Basic, paid yearly)
Outlook / Exchange Online in Microsoft 365	Conditional	Microsoft 365 Business (Basic, Standard, Premium)	Included by default in the DPA; no separate signature	Not published by the vendor
Hushmail for Healthcare	Conditional	Healthcare Basic	Signed BAA provided with Hushmail for Healthcare plans	$11.99/month (solo healthcare practice)
Proton Mail	Conditional	All Proton plans (on request)	Email [email protected] with the subject "HIPAA BAA"; model BAA at proton.me/legal/baa-model	$12.99 per user/month billed yearly (Workspace Standard); Mail Plus $3.99/month billed yearly
GoDaddy	Conditional	Microsoft 365 email (plans GoDaddy represents as HIPAA-compliant)	Electronic acceptance of the HIPAA Business Associate Agreement for the Microsoft 365 email services	Not published by the vendor

Controls by vendor

Vendor	Encryption at rest	Audit log	SOC 2	Data residency
Paubox	Yes	Yes	Not published by the vendor	Not published by the vendor
Gmail in Google Workspace	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor
Google Workspace	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor
Microsoft 365	Yes	Not published by the vendor	Yes	Most Office 365 services let customers specify the region; data is not replicated outside the chosen geographic area
Outlook / Exchange Online	Not published by the vendor	Not published by the vendor	Not published by the vendor	Customer-selected region; data not replicated outside the chosen area
Hushmail for Healthcare	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor
Proton Mail	Yes	Not published by the vendor	Not published by the vendor	Switzerland
GoDaddy	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor

Notes on reading the tables:

• "Not published by the vendor" means the vendor states no value. It does not mean the control is absent, so never read it as "no."
• Google's pricing pages display euros, not US dollars. Convert before comparing Google and Microsoft prices.
• SSO is not listed for any row.

How each BAA is actually obtained

For the general mechanics of these agreements, see the business associate agreement guide. Here is how each row works in practice.

Included automatically

• Paubox: the BAA comes with every account on Email Suite Standard, and the text is public on Paubox's BAA page.
• Microsoft 365 and Outlook / Exchange Online: the BAA is part of the Microsoft Products and Services Data Protection Addendum, incorporated into the Product Terms for all customers that are covered entities or business associates. No separate signature or request is needed. Microsoft does not sign customer-provided BAAs, so a clinic's own template will not be accepted.

Accepted by an administrator

• Google Workspace and Gmail: a super administrator goes to Admin console > Account > Account settings > Legal and compliance > Security and Privacy Additional Terms. There they open the Google Workspace/Cloud Identity HIPAA Business Associate Amendment and choose Review and Accept. They answer three questions confirming covered-entity status and click OK. A staff member without super administrator rights cannot do this.

On request or tied to the plan

• Proton Mail: email [email protected] with the subject "HIPAA BAA." All Proton plans are listed as eligible on request.
• Hushmail for Healthcare: a signed BAA comes with Hushmail for Healthcare plans, starting at Healthcare Basic.
• GoDaddy: acceptance is electronic and covers the Microsoft 365 email services on plans GoDaddy represents as HIPAA-compliant.

"Conditional" dominates because the agreement is not in force until someone accepts or requests it, and it covers only named services. A Google Workspace tenant where no one has accepted the amendment has no BAA, however reassuring the product page sounds.

Email archiving and retention: what the BAA does and does not cover

This section covers HIPAA-compliant email archiving and archive migration. The table shows mailbox-service BAAs only. It does not show whether a vendor's BAA extends to a journaling, archiving or e-discovery add-on. Google's Workspace HIPAA Implementation Guide lists Google Vault, its archiving and e-discovery tool, among the core services where PHI is permitted under its BAA. Archiving coverage for the other vendors is not published in the sources used here.

Treat a third-party archive as a separate business associate. It needs its own BAA, or it must be named in the mailbox provider's covered services.

Migration checklist for moving a mailbox archive

1. Confirm a BAA is in force with the source provider before export, and with the destination provider before import.
2. If a migration tool or consultant touches the mail, get a BAA with that party too.
3. Confirm retention periods in your own policy before deleting anything at the source. 45 CFR 164.316(b)(2)(i) requires six years of retention for HIPAA Security Rule documentation such as policies, procedures and assessments. It does not set a period for email content itself, and state law or payer contracts may require longer.
4. Keep the export files encrypted and in storage covered by a BAA. See HIPAA-compliant backup for archive storage and the storage category.
5. Record the cutover date and the date the source account is closed.

Email APIs and automation, including AI triage

For developers. No row vendor has a published source showing that an email API or transactional email service falls under its BAA. API coverage is "unknown" for every row until a vendor source exists.

A mailbox BAA does not by itself cover a developer's use of SMTP relay, webhooks or a sending API. Check the vendor's covered-services list before putting PHI in a payload. For cloud and API vendors that sign BAAs, see HIPAA-compliant software development and the hosting category.

AI triage. Add-on AI features are a typical exclusion. A clinic that routes patient email through an AI feature must confirm two things: the feature is within the provider's BAA scope, and the underlying model provider is too. For example, an AI inbox summary in a clinic mailbox may be covered while a connected third-party assistant is not. Microsoft lists Copilot and Copilot Chat as in-scope services. Google covers Gemini features in Gmail such as help me write and smart replies, and excludes third-party apps and add-ons.

Decision rule. No vendor source means "unknown," not "conditional." The verdicts above are for the mailbox service only. They do not extend to APIs or AI features.

Email plus phone for therapists and small practices

An email BAA does not extend to phone or VoIP. Check the HIPAA-compliant phone systems and VoIP category separately, and get a separate BAA for any voicemail-to-email or call-recording feature.

Options in the table that suit a solo or very small practice:

• Hushmail for Healthcare: from $11.99/month for a solo healthcare practice, with a signed BAA included.
• Paubox: a minimum subscription of $32/month billed annually for up to 5 email addresses, with the BAA included.
• Proton Mail: Mail Plus from $3.99/month billed yearly. All Proton plans are listed as eligible for a BAA on request.

No vendor's free tier is treated as safe for PHI.

A small practice must still sign or request the BAA, restrict who can read the mailbox, and train anyone who sends client email. An all-in-one setup breaks down where one service sits outside the BAA, such as a texting app or a personal voicemail transcription service attached to the same email address.

Common exclusions and traps

• Consumer accounts and free tiers. Personal Gmail and Outlook.com are never covered. A BAA applies to the paid business tenant, not to an employee's personal address.
• Marketing mail. Newsletters and reminder campaigns are a separate category. See HIPAA-compliant email marketing.
• Add-on AI features. Confirm each one is named in the provider's BAA scope.
• Third-party apps and connectors. A plug-in that reads the mailbox is outside the provider's BAA unless the provider says otherwise.
• Attachments. Large files sent by link may live in a different service. Check HIPAA-compliant file sharing.
• Recipient-side encryption. Encryption in transit to the recipient depends on the recipient's server. The HIPAA transmission security standard requires technical measures to guard against unauthorized access to ePHI sent over an electronic communications network. A mailbox BAA does not address files linked from elsewhere. End-to-end encryption is a different property from BAA coverage, and no end-to-end security claim is made for any row.
• Reseller BAAs. GoDaddy's BAA applies only to the Microsoft 365 email plans GoDaddy names. A Microsoft 365 plan bought elsewhere falls under Microsoft's own DPA.

How to verify a vendor yourself and how this page is maintained

1. Find the vendor's BAA or trust page, not a blog post or reseller summary.
2. Confirm the plan and the covered services. Note what the BAA excludes.
3. Record the date you reviewed it and who accepted or requested the BAA.
4. Add the vendor to your vendor inventory, and recheck it when the vendor changes terms.

Every row on this page is reviewed against the vendor's published terms, and changes are logged under recent changes in vendor HIPAA status. This directory reports published vendor terms. It does not audit vendors and is not legal advice.

For the full explainer on HIPAA-compliant email, see HIPAA-compliant email on chanty.health. Chanty is internal staff chat with a BAA from the Business plan, not an email provider. Other tool types are listed under HIPAA-compliant software by category.

FAQ

Is Gmail HIPAA compliant?

Gmail in Google Workspace has a BAA available from Business Starter. A super administrator must accept the Business Associate Amendment in the Admin console. Personal Gmail is never covered. The verdict is conditional.

Does Microsoft 365 sign a BAA, and do I need to request it?

The BAA is included by default in the Microsoft Products and Services Data Protection Addendum for covered entities and business associates, listed from Microsoft 365 Business Basic. No separate signature or request is needed. Microsoft does not sign customer-provided BAAs. Exchange Online is on Microsoft's in-scope services list. Microsoft's HIPAA page does not name Business Basic specifically.

Which email providers include a BAA on every plan?

Paubox includes its BAA automatically with every account, starting at Email Suite Standard. Proton Mail lists all Proton plans, but only on request. Hushmail's BAA comes with its Healthcare plans. Google and Microsoft BAAs apply to paid business editions, not to free consumer accounts.

Can I use HIPAA-compliant email archiving with a separate vendor?

Yes, if that vendor signs its own BAA or is named in your mailbox provider's covered services. The BAAs in the table cover mailbox services only, so check each vendor's covered-services list for archiving and compliance add-ons.

Is there a HIPAA-compliant email API for developers?

API coverage is unknown for every listed vendor because none publishes a source for it. Check the vendor's covered-services list before sending PHI through an API.

Can AI tools triage patient email under a BAA?

Only if the AI feature and its model provider are both within the BAA scope. No vendor source covers model-provider coverage, so no claim is made. Microsoft lists Copilot and Copilot Chat as in scope, and Google covers Gemini features in Gmail but not third-party add-ons. Check the vendor's scope list.

What email and phone setup works for a solo therapist?

Pick a mailbox with a BAA you have signed or requested, for example Hushmail for Healthcare from $11.99/month. Then choose the phone service separately, because the email BAA does not cover it. See HIPAA-compliant phone systems and VoIP.

Is Outlook.com covered by a BAA?

No. Outlook.com is a consumer mailbox. The BAA applies to Outlook and Exchange Online in Microsoft 365 Business plans through the DPA.

Sources