A Business Associate Agreement (BAA) is available from Proton on request, but Proton does not publicly tie it to specific plans, so the answer is conditional. A clinic should not put PHI into any Proton account until it holds a signed BAA that names the plan and services in use. HIPAA Compliant Wiki is published by Chanty, Inc.; Chanty has no relationship to this vendor entry and does not appear in it.
Is ProtonMail HIPAA compliant? BAA by plan, covered services and exclusions
Conditional Checked 2026-10-20. Proton makes a BAA available on request to all Proton users and lists it for Workspace Standard, Workspace Premium and Enterprise. Proton does not publicly tie the BAA to specific plans. Proton's model BAA says it is not intended to replace a signed Business Associate Agreement.
Short answer
A BAA is available on request for Proton Mail, Proton Calendar and Proton Drive. It is listed for the Workspace Standard, Workspace Premium and Enterprise plans, and Proton says it is available to all Proton users on request. No HIPAA certification exists for software, and this page does not describe any Proton product as certified. What matters is the signed agreement, the plan and services it names, and how your practice configures and uses the accounts. See All vendor HIPAA checks for how other vendors compare.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| All Proton plans | On request | Email [email protected] with the subject "HIPAA BAA"; model BAA at proton.me/legal/baa-model | Not published by the vendor |
| Workspace Standard | Listed | Same request process | Not published by the vendor. Pricing from $12.99 per user/month billed yearly |
| Workspace Premium | Listed | Same request process | Not published by the vendor |
| Enterprise | Listed | Same request process | Not published by the vendor |
Mail Plus is priced at $3.99/month billed yearly. No excluded plans are listed on the pages checked. That is not confirmation that every plan qualifies, because a BAA on request is not the same as a BAA included in the plan. Confirm the plan in writing with Proton before use.
What the BAA covers and what it excludes
Covered services:
- Proton Mail
- Proton Calendar
- Proton Drive
Excluded services: Proton publishes no excluded features on the pages checked. This does not mean none exist. Other Proton products, such as Proton VPN, are not named as covered, so treat them as out of scope until the signed BAA says otherwise.
The model BAA is a template. Only the signed copy defines the actual terms, so read the services clause and any exclusions in your copy.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Switzerland |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Proton's security page says:. This is a description of Proton's design. It is not a HIPAA control, and it does not replace a BAA or your own safeguards.
If your privacy officer's vendor review requires audit logs, SSO or third-party attestations, Proton does not publish them. You would have to ask Proton directly and record the answer.
How to use ProtonMail with PHI
Proton's published terms leave several decisions with you. A working checklist for a clinic or its MSP:
- Request the BAA and sign it before any PHI enters a Proton account. A front-desk mailbox that already receives patient forms counts.
- Confirm that the signed copy names your plan and the services you use.
- Use only the covered services (Mail, Calendar, Drive). Do not move PHI into other Proton products unless the signed BAA lists them.
- Configure accounts and manage user access yourself. Proton publishes no audit log, SSO or access-control details, so document who has access and how you review it.
- Handle offboarding: remove departing staff and recover shared mailboxes and Drive folders.
- Set a staff policy on PHI in email, such as what may be sent, to whom, and with what subject-line rules.
- Keep any third party that touches PHI, such as a billing vendor receiving mailed attachments, under its own BAA.
Whether a practice meets HIPAA depends on the signed BAA, its configuration and its policies. For terms such as BAA and PHI, see the HIPAA glossary (BAA, PHI).
Alternatives with a BAA
All of the following are conditional verdicts, each with its own plan and scope. Compare them in HIPAA-compliant email by category.
- Gmail in Google Workspace: conditional, from Business Starter.
- GoDaddy: conditional, Microsoft 365 email on plans GoDaddy represents as HIPAA-compliant.
- Google Workspace: conditional.
- Hushmail for Healthcare: conditional, from Healthcare Basic.
- Microsoft 365: conditional, from Business Basic.
Sources
- Use Proton for HIPAA-compliant email, calendar, and VPN — Vendor page, checked 2026-10-20. "We offer BAAs to all Proton users."
- Use Proton for HIPAA-compliant email, calendar, and VPN — Vendor page, checked 2026-10-20. "To request a validly signed copy, please contact [email protected] with the subject "HIPAA BAA"."
- Proton Business Associate Agreement (model) — BAA page, checked 2026-10-20. "This Statement is not intended to take the place of a Business Associate Agreement."
- Proton for Business FAQ — Help article, checked 2026-10-20. "HIPAA — Yes. Learn more about HIPAA compliance or download our business associate agreement (BAA)."
- Proton for Business plans — Pricing page, checked 2026-10-20. "Easy data protection compliance, including GDPR and HIPAA"
- Proton Mail security — Trust center, checked 2026-10-20. "The content of your emails is encrypted on your device before being sent to our servers"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
Changes: No changes recorded since first verification on 2026-10-20.
Does Proton sign a BAA for every plan?
Proton says a BAA is available on request to all Proton users and lists it for Workspace Standard, Workspace Premium and Enterprise. It does not publicly tie the BAA to specific plans, and it does not say a BAA is included automatically. Get the plan named in writing.
How do I request a Proton BAA?
Email [email protected] with the subject "HIPAA BAA". Proton's model BAA is at proton.me/legal/baa-model. Review the signed copy before you handle PHI.
Which Proton services does the BAA cover?
Proton Mail, Proton Calendar and Proton Drive. Proton publishes no excluded features on the pages checked, and does not name other services such as Proton VPN as covered.
Does Proton publish SOC 2, HITRUST or ISO 27001 reports?
Not published by the vendor, on the pages checked. If your vendor review requires them, ask Proton directly.
Is ProtonMail end-to-end encrypted, so no BAA is needed?
Proton's security page describes content being encrypted on the device before it reaches Proton's servers. None of the sources checked say this removes the need for a BAA, so a signed BAA remains the question to resolve before PHI goes into any Proton account.