Paubox signs a business associate agreement (BAA) with every account, at no additional charge, and the vendor lists no excluded plans or features. The details by plan, service and control are below, each tied to a vendor page and the date it was checked.
Yes BAA included with all accounts (Email Suite Standard, Plus and Premium; Marketing Free and Pro); the vendor lists no excluded plans or features. Verdict date: 2026-10-20, based on Paubox's pricing pages and its published BAA.
This directory is published by Chanty, Inc. Paubox has no relationship to Chanty. Placement in this directory never depends on payment. We report the vendor's published terms and do not audit the vendor.
Short answer
Paubox includes a BAA at no additional charge for Email Suite, Marketing (including the free tier) and Forms. The Email API is also listed as covered. Pricing starts from $32/month billed annually, with a minimum subscription and up to 5 email addresses.
A signed business associate agreement (BAA) is necessary before PHI moves through any tool, but it does not make your use compliant on its own. Configuration, access management and staff policies still sit with your organization; see the checklist below. For other tools, see all vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Email Suite Standard | Included | Included automatically with every account | None |
| Email Suite Plus | Included | Included automatically with every account | None |
| Email Suite Premium | Included | Included automatically with every account | None |
| Marketing Free | Included | Included automatically with every account | None |
| Marketing Pro | Included | Included automatically with every account | None |
The BAA text is published at paubox.com/business-associate-agreement. Minimum seats for the BAA: Not published by the vendor. Excluded plans: none listed by the vendor.
What the BAA covers and what it excludes
Covered services listed by the vendor:
- Paubox Email Suite (encrypted email)
- Paubox Marketing
- Paubox Forms
- Paubox Email API
Excluded services: no exclusions are published by the vendor on the pages checked. This reflects Paubox's published BAA scope as reported on 2026-10-20; the directory has not audited it. A practical example: a clinic that sends appointment reminders through Paubox Marketing should confirm that the specific workflow runs inside a covered service, not just inside the same vendor.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Yes |
| ISO 27001 | Not published by the vendor |
The vendor's security page describes transport encryption (TLS) for network traffic:. That is encryption in transit, not an end-to-end encryption claim.
How to use Paubox with PHI
Compliance depends on the signed BAA, your configuration and your policies. Work through this checklist and keep the results in your vendor inventory:
- Confirm the BAA is in place before any PHI is sent, and file the signed copy.
- Confirm that each workflow (email, newsletters, intake forms, API calls) uses a Paubox service named in the BAA.
- Configure accounts and decide who gets access, using the minimum necessary.
- Remove access when staff leave. A front-desk mailbox that nobody reassigns is a common gap.
- Keep written policies and train staff on what may be sent by email and what may not.
- Assess any third-party tool connected to Paubox separately; it needs its own BAA if it touches PHI.
- Re-check the vendor's terms periodically.
More walkthroughs are in the HIPAA guides.
Alternatives with a BAA
Verdicts below are the directory's current entries. Order is alphabetical and not a ranking.
- Constant Contact: conditional; BAA on all plans on request.
- Gmail in Google Workspace: conditional; BAA covers Business Starter.
- GoDaddy: conditional; Microsoft 365 email plans.
- Google Workspace: conditional; paid editions, accepted in the Admin console.
- Hushmail for Healthcare: conditional; Healthcare Basic plan.
Browse HIPAA-compliant software by category for the email and email marketing tables.
Sources
- Paubox Email Suite pricing — Pricing page, checked 2026-10-20. "Paubox includes a BAA with all accounts."
- Paubox pricing (FAQ) — Pricing page, checked 2026-10-20. "No. All customers receive a business associate agreement at no additional charge."
- Paubox Marketing pricing — Pricing page, checked 2026-10-20. "Paubox includes BAAs with all accounts."
- FAQ for new customers (Paubox Support) — Help article, checked 2026-10-20. "Our minimum subscription is $32/month (billed annually), which covers up to 5 email addresses."
- Paubox Security — Trust center, checked 2026-10-20. "All Paubox network traffic, whether it contains PHI or not, is encrypted using industry-standard transport encryption (TLS)."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is Paubox HIPAA compliant?
HIPAA compliance depends on how an organization uses a tool, not on the tool alone. What can be stated is that a BAA is available on every Paubox plan for Email Suite, Marketing, Forms and Email API, at no extra charge. Verdict: yes, as of 2026-10-20. Your organization must still configure access, set policies and train staff.
Does Paubox sign a BAA, and does it cost extra?
Yes. The BAA is included with all accounts at no additional charge, and its text is published at paubox.com/business-associate-agreement. The vendor does not publish a minimum seat count for the BAA.
Does the free Paubox Marketing tier include a BAA?
Yes. According to Paubox's pricing page, the BAA is included with Marketing Free as well as Marketing Pro.
Which Paubox services are covered by the BAA?
Paubox Email Suite (encrypted email), Paubox Marketing, Paubox Forms and Paubox Email API. The vendor publishes no exclusions on the pages checked. Pricing starts from $32/month billed annually, with up to 5 email addresses.