What is the best HIPAA compliant email in 2026?
No email service is HIPAA compliant on its own. You need a signed BAA, encryption that reaches the patient, and the right settings switched on.
Your front desk emails a lab result. Your billing vendor sends a statement. Your app fires off appointment reminders. Each message carries protected health information (PHI), sometimes just the fact that someone is your patient. HIPAA then requires a Business Associate Agreement (BAA) with your email provider and safeguards that fit your risk. Nobody certifies a brand: "HIPAA compliant" means the vendor signs that BAA and gives you the tools to protect messages.
Free Gmail and Outlook.com don't qualify, since there's no BAA. Paid Google Workspace and Microsoft 365 do, once the BAA is in place and encryption is configured. Dedicated services like Paubox, Hushmail, LuxSci and Virtru add encryption that is on by default, each with a different trade-off for the person reading the email.
The short answer. Google Workspace is the best overall pick: you accept the BAA in the Admin console, and it costs $7 per user. Proton Mail has the strictest encryption and offers a BAA to every customer. Microsoft 365 includes its BAA by default. Hushmail suits small practices that want intake forms. Paubox encrypts every email with no patient portal. LuxSci handles high-volume sends and campaigns. Virtru lets you revoke a message after it's sent, from 5 users.
The ranking is editorial: a sponsored spot is always labeled on its card, and no affiliate link changes a score.
The best HIPAA compliant email for your situation
BAA in the Admin console, $7 per user
Strictest encryptionZero-access, BAA for every customer
Best for Outlook shopsBAA included by default
Best for small practicesEncrypted email and forms from $11.99
No patient portalEvery email encrypted, BAA included
Best for high volumeBulk sends with a BAA from $99
7 HIPAA compliant email services compared
The ranking targets anyone who emails PHI: a solo practice, a clinic, a lab, a health tech vendor, a billing company. Every ranked service states its BAA, or how to get one, on an official page, and shows a public price.
| Best for | What sets it apart | Free plan | Team size | Visit | ||||
|---|---|---|---|---|---|---|---|---|
| 1 | Google Workspace | Best overall | BAA accepted in the Admin console | 4.5/5 | $7/user/month, annual | — | Practices and clinics on Gmail | Visit → |
| 2 | Proton Mail | Strictest encryption | Zero-access encryption, BAA for every customer | 4.4/5 | $6.99/user/month, annual | — | Privacy-first small teams | Visit → |
| 3 | Microsoft 365 | Best for Outlook shops | BAA included by default | 4.4/5 | $7/user/month, annual | — | Organizations on Outlook | Visit → |
| 4 | Hushmail | Best for small practices | Encrypted email, BAA and intake forms | 4.3/5 | $11.99/month for 1 user | — | Solo and small practices | Visit → |
| 5 | Paubox | No patient portal | Encrypts every email, no portal | 4.0/5 | $32/month for 1 to 5 senders | — | Practices on Gmail or Outlook | Visit → |
| 6 | LuxSci | Best for high volume | Bulk email and campaigns with a BAA | 3.8/5 | $50/month up to 5 users | — | Vendors, high volume | Visit → |
| 7 | Virtru | Best for control after sending | Revoke and expire sent messages | 3.6/5 | $119/month for 5 users | — | Teams sharing files | Visit → |
Scores on five weighted criteria, explained in the method. Prices checked in 2026 on each vendor's official pricing page.
Is your tool missing from this page? Email us: hello@hackceleration.com
How we compared and scored
This page is for anyone who sends PHI by email: the solo practice, the multi-site clinic, the lab, the health tech company, the billing or transcription vendor working for a covered entity. It doesn't cover EHR portals or telehealth platforms, which have their own messaging.
The first filter is the BAA. A ranked service must publish it, or say exactly how to get it, on an official page. A claim on a review site doesn't count. The second filter is price: a service with no public pricing can't be compared honestly, so it sits outside the ranking.
Weights follow risk. Message protection counts for 30%: encryption all the way to the recipient, and whether the vendor can read your mail. Documented legal cover counts for 25%. Real price counts for 20%, for 1 and 5 users, including minimum seats. The recipient's experience counts for 15%, team tools for 10%.
A tool keeps the same score on every Labs page, so Google Workspace, Proton, Microsoft 365, Hushmail, Paubox and Virtru carry the scores from our other comparisons. Then we read user reviews, starting with the negative ones. They rarely talk about encryption. They talk about patients who can't find the passcode, per-seat pricing, and support you can't reach by phone.
- Message protectionEncryption to the recipient, encryption at rest, vendor access to your mail.30%
- Documented legal coverBAA published and how to get it, scope of covered services.25%
- Real pricePrice for 1 and 5 users, minimum seats billed, paid add-ons.20%
- Ease for the recipientDoes the patient read in their usual inbox, or open a portal and type a code?15%
- Team toolsForms, archiving, filtering, data loss prevention, bulk sending.10%
No affiliate link changes a score or a rank.
BAA terms and pricing change. Get the updates
Google Workspace
Google Workspace is the simplest base for most healthcare teams. A super admin accepts the BAA in the Admin console under Account, then Legal and compliance. Google says that electronic acceptance is as binding as paper. The BAA covers only services on Google's HIPAA Included Functionality list, and third-party Marketplace apps are out.
Pricing stays low. Business Starter costs $7 per user per month on an annual plan, Business Standard $14. Five users on Starter come to $35 a month.
Its limit: out of the box, Gmail encrypts the connection (TLS) but not the message itself. If the receiving server refuses TLS, the email can still go out unless you enforce it. That's why many practices add Paubox or Virtru on top. A few clinicians we read on r/therapists run Workspace alone and say it's cheap and reliable; that works only with the BAA signed and access locked down.
- BAA accepted in the console
- Familiar for staff and patients
- Low per-seat price
- ✓$7 per user
- ✓BAA at no extra cost
- ✓Patients read in their usual inbox
- ✗No end-to-end encryption by default
- ✗Third-party apps outside the BAA
- ✗Settings are on you
The best starting point for a healthcare team: a BAA in two clicks and a low price. Enforce TLS and ban unapproved apps on day one.
Proton Mail
Proton is a Swiss company. Its zero-access encryption means Proton can't read your stored mail. Between two Proton accounts, messages are end-to-end encrypted with nothing to set up.
Its BAA is the most open in this ranking. Proton says it offers a BAA to all users. You request it by emailing privacy@support.proton.me with the subject "HIPAA BAA", and a model BAA is published online.
Mail Essentials costs $6.99 per user per month on an annual plan, Workspace Standard $12.99.
Its limit: email to a Gmail or Yahoo address isn't end-to-end encrypted unless you set a password on the message. The patient opens it in a browser with that password, and their reply comes back encrypted. You'll need to share the password another way, like a text.
- Zero-access encryption
- BAA for every customer
- Swiss company
- ✓$6.99 per user
- ✓Model BAA published
- ✓Encrypted patient replies
- ✗Password needed for each outside email
- ✗More friction for patients
- ✗Fewer admin tools than Google or Microsoft
The strongest encryption on a small budget. Pick it if privacy beats patient convenience, and make the message password a habit.
Microsoft 365
Microsoft 365's edge is that the BAA is automatic. It's part of Microsoft's data protection terms by default for customers covered by HIPAA. Exchange Online, Teams and OneDrive are in scope. Microsoft says plainly that using its services doesn't, on its own, make you compliant.
Business Basic costs $7 per user per month on an annual plan, Business Standard $14.
Its limit: Purview Message Encryption, which protects the email all the way to the patient, isn't in every plan. Microsoft's guidance places it in Business Premium and the E3 and E5 suites. Patients usually get a link and then a one-time passcode that expires after 15 minutes, and that passcode email sometimes lands in spam.
- BAA by default
- Exchange, Teams and OneDrive covered
- Fits existing Outlook setups
- ✓$7 per user
- ✓No paperwork for the BAA
- ✓Deep admin and compliance tools
- ✗Purview encryption on higher plans only
- ✗Passcode step for patients
- ✗Complex to configure well
The obvious pick if you already live in Outlook. Check that your plan includes Purview encryption, and tell patients about the passcode before the first message.
Hushmail
Hushmail is a Canadian company with a plan built for clinicians. It signs a BAA for healthcare providers and adds archiving.
Its real edge is forms. From Essentials, at $14.99 a month, you build intake, consent and questionnaire forms with e-signatures, and replies land encrypted in your inbox. Basic, at $11.99 a month, keeps email and the BAA without forms. On r/therapists, several clinicians say they've used it for years, one at $11 a month in a group practice.
Its limit: reviewers rate the mobile experience as weak, and a lost password can lock you out of old messages. Some Trustpilot reviewers also say they couldn't reach a person by phone.
- Encrypted patient forms
- BAA for clinicians
- Built for small practices
- ✓$11.99 a month for one user
- ✓E-signature from Essentials
- ✓Archiving included
- ✗Weak mobile app
- ✗Hard account recovery
- ✗Phone support hard to reach
The best mix of simplicity and price for a small practice. Take Essentials if you send intake forms, Basic if not. See also our ranking for therapists.
Paubox
Paubox doesn't replace your email. It plugs into Google Workspace, Microsoft 365 or Exchange and encrypts every outgoing message. Patients read it in their own inbox, with no portal and no password. That's the biggest difference from Virtru, LuxSci or Microsoft's encryption.
The BAA is included in every plan at no extra cost. Standard costs $32 a month billed annually for 1 to 5 senders. Plus, at $65, adds inbound filtering against phishing. Premium, at $75, adds data loss prevention and unlimited archiving. For an app that sends reminders or results, the Email API is free up to 300 emails a month, then $104 a month billed annually up to 9,999.
Its limit: you still pay for Google Workspace or Microsoft 365, and the 5-sender base means a solo clinician pays $32 too. In G2 reviews, "expensive" is the most common complaint.
- No portal for patients
- BAA in every plan
- API for app emails
- ✓Encrypts every email automatically
- ✓Works with Gmail and Outlook
- ✓14-day free trial
- ✗Paid on top of your email suite
- ✗5-sender base price
- ✗Reviewers call it expensive
The smoothest experience for patients. Pick Standard if you're on Gmail or Outlook and your patients get lost in portals.
LuxSci
LuxSci, founded in 1999, serves a different need: volume. Its gateway encrypts your team's email, but its home turf is bulk sending and campaigns that carry PHI.
Prices are public and every product includes a BAA. Secure Gateway costs $50 a month for up to 5 users. Secure High Volume Email starts at $99 a month for up to 9,999 emails. Secure Marketing starts at $129 a month for up to 4,999 contacts.
Its limit: reviewers praise the support but call the interface dated and the price high. Recipients also hit a portal more often than with Paubox.
- Bulk email with a BAA
- Healthcare campaigns
- Public volume pricing
- ✓BAA in every product
- ✓Support praised in reviews
- ✓Clear volume tiers
- ✗Dated interface
- ✗Portal more common for recipients
- ✗High price for small teams
The right call when PHI goes out by the thousands from an app or a campaign. For a small team typing emails by hand, Paubox or Google Workspace is enough.
Virtru
Virtru adds encryption to Gmail and Outlook, with a control the others lack: you can revoke a sent message or set it to expire. A signed BAA is listed from Starter.
Starter costs $119 a month billed annually for 5 users, Business $219, Compliance $499.
Its limit: the entry price is the highest in this ranking, and recipients without Virtru sometimes have to sign in to read. Those are the top complaints in G2 reviews, often about older patients who can't open the message or the attachment.
- Revoke sent messages
- Expiring messages
- Works with Gmail and Outlook
- ✓Control after sending
- ✓BAA from Starter
- ✓Encrypted attachments
- ✗$119 a month minimum
- ✗Sign-in sometimes needed for recipients
- ✗Overkill for a solo practice
Useful when you need to pull back a file sent by mistake. For routine patient email, Paubox costs less and gets in the way less.
Which HIPAA compliant email fits your situation
The right service depends on your size and on who reads your email. Here is our pick per profile, at official prices.
Solo clinician
Hushmail Basic at $11.99 a month, or Essentials at $14.99 if you need intake forms. On a tight budget and fine with passwords, Proton Mail Essentials at $6.99.
Small practice already on Gmail
Google Workspace with the BAA accepted, then Paubox Standard at $32 a month for 1 to 5 senders so patients never see a portal.
Clinic or group of 20+
Microsoft 365 or Google Workspace as the base, with Paubox Plus for phishing filtering. Add Virtru if you must be able to revoke file shares.
Health tech vendor or app
Paubox Email API, free up to 300 emails a month, or LuxSci Secure High Volume from $99 a month. Your customers will ask for your BAA, so sign one with your own email provider too.
Billing, coding or transcription vendor
You're a business associate. Google Workspace or Microsoft 365 with the BAA covers staff mail for about $7 per user. Keep a dated copy of the BAA for your clients' audits.
Team that wants maximum privacy
Proton Mail: the vendor can't read your mail, the BAA is one email away, $6.99 per user. Plan a password on every outside email.
Want to send patient reminders from your software without exposing PHI? Get our guides
Other options worth knowing
These come up in searches. They aren't ranked because they don't publish prices, don't sign a BAA, or serve another job. Here's when they matter.
Zoho Mail: BAA on request, check the scope
BAAZoho offers a BAA template you request at legal@zohocorp.com. Its HIPAA page doesn't say which Zoho Mail plans it covers, and Zoho notes that not all its services are built for HIPAA. Confirm Zoho Mail is listed in the signed BAA before any PHI goes through it.
- BAA
- Template on request
- Check
- Zoho Mail listed in the agreement
EHR patient portals: often the better channel
ChannelSeveral clinicians on r/therapists say patients find encrypted email links annoying, so clinical messages go through the EHR portal and plain business email handles scheduling. If your EHR has a portal, use it for results and keep email for logistics.
- Best for
- Results and clinical messages
Free Gmail and Outlook.com: never for PHI
PitfallFree @gmail.com and Outlook.com accounts come with no BAA. Keep them for personal mail. The paid versions, Google Workspace and Microsoft 365, are the ones that can sign.
- BAA
- None
- Fix
- Google Workspace from $7
What makes HIPAA email fail
These mistakes show up in official guides and user reviews. None of them is visible on a pricing page.
Paying for email without signing the BAA
ContractGoogle's BAA doesn't switch on by itself: a super admin must accept it in the console. Proton's comes by email. Skip that step and you're paying for secure email that isn't covered.
- Console, Legal and compliance
- Proton
- Email "HIPAA BAA"
Plugging third-party apps into your mailbox
ScopeGoogle's BAA doesn't cover Marketplace apps. A signature tool, open tracker or AI assistant that reads your mail falls outside it. List everything that touches Gmail before you sign.
- Covered
- Google's official list
- Not covered
- Third-party apps and extensions
Putting PHI in the subject line
LeakThe subject line isn't always encrypted, even when the body is. Write "Your document is ready", not the name of a test or a diagnosis.
- Rule
- Neutral subject lines
Emailing several patients in visible copy
LeakA visible list of addresses tells everyone who else is a patient. Use BCC, or better, send one email per patient.
- Rule
- One email per patient
Make your email actually compliant
Settings pulled from official documentation and user feedback. Most live in your admin console.
Enforce TLS on outgoing mail
SettingIn Google Workspace and Microsoft 365, a rule can block delivery when the receiving server won't accept TLS. Without it, mail can go out unencrypted to an old server.
- Where
- Admin console, routing rules
Warn patients about the passcode
PatientWith Purview encryption, patients get a passcode that expires after 15 minutes and sometimes lands in spam. Tell them at check-in to look for it there.
- Passcode life
- 15 minutes
Send the Proton password by text
PatientA password-protected email is useless if the password travels in the same email. Agree on a simple rule with the patient, or text it.
- Channel
- Anything but email
Record the patient's email preference
RecordIf a patient asks for plain email anyway, note the request and the risks you explained in their file. It's the documentation an auditor will ask for.
- Where
- Patient file
Go further
These pages pick up where this one stops.
The ranking built for solo clinicians.
You want messaging inside your patient recordsMedical practice softwareRecords, scheduling and messages in one place.
Your app sends reminders and receiptsTransactional email servicesAPIs for automated email.
Your questions about HIPAA compliant email
Is Gmail HIPAA compliant?
Free Gmail isn't: Google won't sign a BAA for @gmail.com accounts. Gmail inside paid Google Workspace can be, once a super admin accepts the BAA and you configure it. Enforced TLS and a ban on unapproved third-party apps are the two settings that matter most.
Is Outlook HIPAA compliant?
Outlook.com isn't. Outlook in Microsoft 365 can be: the BAA is included by default in Microsoft's data protection terms. For encryption all the way to the patient, you need Purview Message Encryption, found in Business Premium and E3 or E5.
What is a BAA, and how do I get one?
It's the contract where a vendor commits to protect PHI under HIPAA. Google has you accept it in the Admin console, Microsoft includes it by default, Proton sends it on request by email, and Paubox, Hushmail, LuxSci and Virtru include it in their plans. Keep a dated copy.
Is TLS encryption enough for HIPAA?
TLS protects email in transit between servers that both support it, but not the message once it lands. For results or reports, add message-level encryption like Paubox, Purview, or a Proton password.
Do I need patient consent to email PHI?
You should document it. If a patient prefers plain email after you explain the risks, record that choice in their file. It protects you in an audit and makes the patient's preference clear to your whole team.
How much does HIPAA compliant email cost?
About $7 per user per month for a suite with a BAA (Google Workspace, Microsoft 365, Proton at $6.99). Paubox adds $32 a month for 1 to 5 senders. Virtru starts at $119 a month for 5 users.
What about sending thousands of patient emails?
Use a bulk service with a BAA, not your inbox. Paubox Email API is free up to 300 emails a month, then $104 a month billed annually up to 9,999. LuxSci starts at $99 a month for the same volume, billed monthly.