What is the best HIPAA compliant email for therapists in 2026?
No email service is HIPAA compliant on its own. You need a signed BAA, encryption that holds up to the client's inbox, and habits that don't leak PHI.
You send intake paperwork to a new client, confirm a session, answer a question about a superbill. Every one of those emails carries protected health information, sometimes just the fact that this person sees a therapist. Free Gmail and Outlook.com won't sign a Business Associate Agreement, so they're out. The question is which paid service to pick, and the answer depends on how much friction your clients will accept.
The short answer. Google Workspace comes out on top: a BAA you accept in the Admin console, a familiar inbox for clients and a low price, as long as you encrypt clinical attachments. Proton Mail is the best pick for a solo practice: zero-access encryption, a BAA for any user who asks, and the lowest entry price we found. Microsoft 365 applies its BAA by default. Hushmail is the most therapist-focused, with intake forms and a PHQ-9 calculator in the same plan. Paubox gives clients the smoothest experience, no portal and no password, but it bills a base of up to five senders. Virtru fits a group practice that already lives in Gmail or Outlook.
What the vendor guides skip: most of them are written by one of the vendors. We compared official pricing pages for a single clinician, how each BAA is actually obtained, and where encryption stops before it reaches the client.
The ranking is editorial: a sponsored spot is always labeled on its card, and no affiliate link changes a score.
The best HIPAA compliant email for each situation
BAA accepted in the Admin console
Best for a solo practiceZero-access, BAA on request, $6.99/mo
BAA with no paperworkBAA built into Microsoft's terms
Most built for therapistsEncrypted email, intake forms, BAA included
No portal for clientsClients read encrypted email in their inbox
For an equipped group practiceEncryption on top of Gmail or Outlook
6 HIPAA compliant email services compared
Rank follows the score. Google Workspace and Microsoft 365 keep the overall score they carry in our other comparisons (one score per tool across the site); the five criteria below show what matters for a therapist. Prices are the entry price a single therapist would pay, read on each vendor's official pricing page. The middle column says where each service is strongest.
| Best for | What sets it apart | Free plan | Team size | Visit | ||||
|---|---|---|---|---|---|---|---|---|
| 1 | Google Workspace | If you already use Gmail | BAA accepted online, familiar inbox | 4.5/5 | $7/user/mo, annual | — | Group practice on Gmail | Visit → |
| 2 | Proton Mail | Best for a solo practice | Zero-access encryption, BAA for any user, Swiss company | 4.4/5 | $6.99/user/mo, billed annually | — | Solo therapist | Visit → |
| 3 | Microsoft 365 | BAA with no paperwork | BAA included by default for Exchange Online | 4.4/5 | $7/user/mo, annual | — | Practice on Outlook | Visit → |
| 4 | Hushmail | Most built for therapists | Encrypted email, intake forms and BAA in one plan | 4.3/5 | $11.99/mo, billed monthly | — | Solo therapist with paper intake | Visit → |
| 5 | Paubox | No portal for clients | Automatic encryption, readable with no password | 4.0/5 | $32/mo annual, 1 to 5 senders | — | Group practice on Google or Microsoft | Visit → |
| 6 | Virtru | For an equipped group practice | One-click encryption in Gmail or Outlook, BAA from Starter | 3.6/5 | $119/mo annual for 5 users | — | Practices of 5 or more | Visit → |
Prices read on each vendor's official page in 2026. Google Workspace and Microsoft 365 prices match our Google Workspace comparison.
Is your tool missing from this page? Email us: hello@hackceleration.com
How we compared and scored
This page answers one question: which email service lets a therapist in private practice (LPC, LCSW, LMFT, psychologist) write to clients without exposing their health information? It's written for the solo clinician or small practice with no IT person and no compliance officer.
We checked the core criterion for every ranked service on the vendor's own pages: does it encrypt the message all the way to the client, and how exactly do you get a signed BAA? When a vendor page doesn't state something, we don't assume it.
Each service gets a score on five criteria. Message protection weighs most, 30%, because it is what protects your client when an email goes to the wrong place. Documented legal cover counts for 25%. Price for a solo practitioner weighs 20%, because several plans bill five users minimum. Ease for the client (reading without creating an account) counts for 15%, practice tools such as intake forms and e-signature for 10%.
We also read user feedback, starting with the negative: public reviews of Hushmail and Paubox, and a privacy forum thread where a psychologist weighed leaving Microsoft 365. What keeps coming up: account recovery after a lost password, the mobile app, and clients who can't open a protected message.
- Message protectionEncryption to the recipient, encryption at rest, vendor access to your mail.30%
- Documented legal coverBAA availability and how you get it, what it covers and excludes.25%
- Price for a solo practitionerPublished price for one person, minimum number of billed users.20%
- Ease for the clientDoes the client read in their usual inbox, or open a portal or type a password?15%
- Practice toolsIntake forms, questionnaires, e-signature, templates.10%
No affiliate link changes a score or a rank.
Pricing and BAA terms change. Get an email when the ranking moves
Google Workspace
Google Workspace is paid Gmail with your own domain. Google offers a BAA, but you accept it yourself: a super admin signs it in the Admin console under Account, then Legal and compliance. The BAA covers the services on Google's HIPAA Included Functionality list. Third-party add-ons you install are not covered.
The limit is the message itself. By default, Gmail encrypts the connection between mail servers, not the message end to end. That's why many practices add Paubox or Virtru on top.
Pricing: Business Starter runs $7 per user per month on an annual plan, Business Standard $14, which takes storage from 30 GB to 2 TB per user.
- BAA accepted online in minutes
- Inbox your staff already knows
- Calendar, video and docs in one plan
- ✓Low price per user
- ✓BAA accepted online in the Admin console
- ✓Easy to add Paubox or Virtru on top
- ✗No end-to-end encryption to clients by default
- ✗You must accept the BAA yourself
- ✗Add-ons fall outside the BAA
A solid base if your practice already runs on Gmail. Sign the BAA before the first client email, and audit every add-on.
Proton Mail
Proton is a Swiss company. Your mailbox is stored with zero-access encryption: Proton can't read what's inside. Mail between two Proton accounts is end-to-end encrypted with no setup. For one clinician, it's the best protection-for-price ratio in this ranking, at $6.99 per user per month on an annual plan.
Proton states it can provide a BAA to any Proton user. It isn't automatic: you email privacy@support.proton.me with the subject "HIPAA BAA". Proton also publishes its BAA template, so you can read it first.
The catch that matters for therapy: an email from Proton to a Gmail, Yahoo or Outlook address is not end-to-end encrypted by default. To protect it, turn on password protection for that message. Your client gets a link, opens the message in a browser with the password you shared another way, and can reply encrypted. Very safe, a little less smooth for a client who struggles with technology.
In a privacy forum thread, a psychologist leaving Microsoft 365 got one recurring piece of advice: since most of your correspondents have no end-to-end encryption anyway, zero-access storage of your own mailbox is the real gain.
- Zero-access encryption: the provider can't read your mail
- BAA offered to any user, template published
- Lowest entry price in the ranking
- ✓Swiss company
- ✓Password-protected messages to any address
- ✓Model BAA published, so you can read it first
- ✗External mail encrypted only when you set a password
- ✗BAA requested by email
- ✗Clients open protected mail in a browser
The best pick for a solo therapist who wants strong protection on a tight budget. Make the password a habit on every client email, or encryption stops at your own mailbox.
Microsoft 365
Microsoft includes its BAA by default, through its Data Protection Addendum, for customers who are covered entities or business associates. Nothing to sign: Exchange Online, Teams, OneDrive and Forms are in scope. The flip side: Microsoft uses its own BAA and won't sign yours.
Microsoft says it plainly: using its services doesn't on its own achieve HIPAA compliance. The BAA covers the platform, not how you use it.
Pricing: Business Basic is $7 per user per month on an annual plan, with web apps only. Business Standard, $14, adds installed Word, Excel and Outlook.
- BAA included by default
- Exchange, Teams and OneDrive in scope
- Same price as Google at entry
- ✓Outlook and Teams many referral partners already use
- ✓Desktop apps from Business Standard
- ✓No BAA request to send
- ✗Microsoft's BAA, not yours
- ✗No end-to-end encryption to clients by default
- ✗Configuration left to you
The easiest BAA in the ranking for a practice already on Outlook. Pair it with an encryption habit for anything clinical.
Hushmail
Hushmail describes its healthcare plans as "designed for therapists who need simple, HIPAA-compliant email and forms." The BAA is signed for healthcare providers and comes with the plan, no separate request.
Three tiers for one person. Basic, $11.99 a month billed monthly ($131.89 a year on annual), gives encrypted email, the BAA, archiving and 10 GB. Essentials, $14.99 a month, adds what changes daily practice: HIPAA intake forms, e-signature, templates and scheduling, with 15 GB. Growth, $17.99 a month, adds your branding, enforced two-factor authentication, country-based login limits and priority support. Annual billing gives one month free, two-year billing three.
Forms are the real draw. Hushmail supports calculated forms such as the PHQ-9 depression screener, body diagrams and PDF export. If you don't have time to build them, Hushmail builds them for you at $25 each.
Public reviews often praise support and onboarding. Complaints cluster around three things: a mobile experience that could be better, price increases and charges reported after cancelling, and above all a lost password, which can leave your older mail unreadable.
- Intake forms and a calculated PHQ-9
- BAA included with healthcare plans
- 14-day free trial
- ✓Built around a solo therapist
- ✓E-signature and scheduling from Essentials
- ✓Email and phone support
- ✗Lost password can lock old mail
- ✗Mobile app could be better
- ✗Price increases reported by users
The best choice if you want to replace paper intake and your email in one move. If you only need email, Proton costs less.
Paubox
Paubox fixes what the others leave to the client: your client reads the encrypted email in their usual inbox, with no portal and no password. Outbound encryption happens automatically. The BAA is included on every plan at no extra cost.
Paubox doesn't replace your mail service: it plugs into Google Workspace, Microsoft 365 or Exchange, so you still need one of them with its BAA. Standard adds SSO and MFA. Plus adds AI-based inbound filtering against phishing. Premium adds data loss prevention and unlimited archiving. Paubox Forms come with any paid plan.
The trap for a solo practitioner: pricing uses a base of 1 to 5 senders, so you pay $32 a month on annual billing even alone, $42 month to month. Paubox Mailbox, a hosted inbox at $20 a month ($240 a year), avoids the extra subscription, but the address ends in @pauboxmail.com.
- No portal or password for the client
- Automatic outbound encryption
- BAA on every plan
- ✓Works with Google Workspace, Microsoft 365, Exchange
- ✓Forms included in paid plans
- ✓14-day trial
- ✗5-sender base: pricey for a solo
- ✗Needs a mail subscription too
- ✗Mailbox address ends in @pauboxmail.com
The best client experience, at small-practice prices. Worth it for a group practice; a solo therapist pays for four empty seats.
Virtru
Virtru adds encryption to Gmail or Outlook: you keep your mail service and encrypt an email or attachment in one click. It works with Google Workspace and Microsoft 365. A signed BAA is listed from the Starter plan.
Price is the hurdle. Starter is $119 a month on annual billing, for 5 users. Business is $219 a month, also for 5 users. For a solo therapist, it's oversized.
Like Paubox, Virtru sits on top of your mail service: you still need Google Workspace or Microsoft 365 and its own BAA.
- One-click encryption in Gmail or Outlook
- BAA from the entry plan
- Encrypted attachments
- ✓Keep your current mail service
- ✓Works with Google Workspace and Microsoft 365
- ✓Published pricing
- ✗$119 a month minimum, for 5 users
- ✗Mail subscription on top
- ✗Oversized for a solo practice
Worth a look for a group practice already set up on Google or Microsoft. A solo therapist pays here for four seats they don't use.
Solo, group, or client-first: three different picks
The right service depends less on features than on who you are and what your clients will tolerate.
You practice solo
Watch the minimums. Proton at $6.99 or Hushmail at $11.99 cover one person. Paubox and Virtru bill a base of five. If you also want intake forms, Hushmail Essentials at $14.99 replaces a separate forms tool.
You run a group practice
Start from the inbox your team already uses. Google Workspace or Microsoft 365 with the BAA in place, then Paubox for automatic encryption or Virtru for one-click encryption. The five-user base stops hurting once you have five clinicians.
Your clients won't create accounts
Older clients, clients in crisis, clients on a phone: a password or a portal is a barrier. Paubox is the only ranked service where the client reads encrypted mail in their own inbox. Otherwise, keep clinical content in your practice portal and use email only for logistics.
- Does the provider sign a BAA, and how do you get it?
- Is the email encrypted all the way to the client, or only between servers?
- Does the client need a password, a portal, or nothing?
- How many users are billed at minimum?
- What happens if you lose your password?
- Are add-ons and integrations covered by the BAA?
Other options worth knowing
These come up in therapist searches. They aren't ranked because we couldn't read official pricing, or because they serve another need.
LuxSci: secure email for high volume
VolumeLuxSci shows up in many HIPAA email guides. Its offers aim at organizations sending large volumes, and we couldn't read a clear price on its official pages. Ask for a written quote before comparing it with the ranked services.
- Price
- Quote on request
- Best for
- High-volume organizations
MailHippo and HIPAA Vault
UnrankedBoth appear in therapist search results. We didn't rank them because we couldn't read their pricing on an official page. If you look at them, check the same things as above: BAA, encryption to the client, and minimum users.
- Price
- Check on the vendor site
- Best for
- Practices comparing more options
Free Gmail and Outlook.com: what not to do
AvoidFree consumer mail services don't sign a BAA. They're fine for personal mail, not for anything with PHI. If you still use a free address for your practice, keep it to scheduling with no clinical detail while you move.
- Price
- Free
- Best for
- Nobody, for PHI
Your practice management software's messaging
AlternativeMany practice management platforms include a client portal with secure messaging. It's often the simplest route: clients find documents next to their appointments. Compare options in our practice management software ranking, and ask each vendor for its BAA.
- Price
- Depends on the platform
- Best for
- Practices that want one place
How therapists leak PHI by email
None of these appear on a pricing page. They come from complaints, professional guidance and user reviews.
Group emails without BCC
FrequentA client's email address is PHI. A group email with visible addresses tells every recipient who else sees you. Never email clients as a group. For an announcement (vacation, new office), send one message per person or use BCC.
- Do
- One email per client
Assuming the email is encrypted to the client
Proton, GmailWith Proton, mail to an outside address is end-to-end encrypted only if you set a password. With Google and Microsoft, the connection is encrypted, not the message. For anything clinical, encrypt the message or attachment and share the password another way.
- Do
- Share passwords separately
Thinking the BAA makes you compliant
LegalMicrosoft says it plainly: using its services doesn't on its own achieve HIPAA compliance. The BAA covers the vendor. Your settings, your add-ons and your habits are still on you. On Google Workspace, third-party add-ons sit outside the BAA.
- Check
- Add-ons and settings
Getting locked out of an encrypted mailbox
Hushmail, ProtonWith encrypted email, a lost password can make older mail unreadable. It's the most common complaint in Hushmail reviews. Set up the provider's recovery option on day one and store the recovery key away from your computer.
- Do
- Recovery set up on day 1
Set up HIPAA compliant email in a week
Five steps that work whatever service you pick.
Get the BAA before the first client email
LegalGoogle: accept it in the Admin console. Proton: email privacy@support.proton.me with the subject "HIPAA BAA". Microsoft, Hushmail, Paubox: it's included. Keep a copy with your practice records.
- Time
- 30 minutes
Get and document client consent
ClientAdd a line to your intake paperwork: the client agrees to receive email, knows what you will and won't send that way, and can opt out. Professional guidance recommends documenting this consent in writing.
- Where
- Intake paperwork
Write neutral subject lines
TipSubject lines show on a locked phone screen, sometimes in front of family. "Your Thursday appointment" beats "Follow-up on your anxiety". Even with encryption, subjects aren't always protected: keep clinical detail out.
- Example
- "Document for our session"
Send the minimum necessary
TipEmail for logistics; portal or encrypted attachment for clinical content. A client who forwards your email or reads it on a shared computer can't leak what you didn't write.
- Rule
- Logistics only in the body
Test the client experience
MethodSend a protected message to a personal Gmail and a personal Outlook address, open it on a phone, reply. If it takes you more than a minute, your least tech-savvy client will call you instead. That's when Paubox earns its price.
- Time
- 15 minutes
Running a practice on your own? Get our next software comparisons for clinicians
Go further
These pages pick up where this one stops.
Records, scheduling, client messaging.
You're torn between Google Workspace and Microsoft 365Switching from Google WorkspacePricing, storage and alternatives.
You want clients to sign intake forms onlineElectronic signature toolsConsents and agreements signed remotely.
Your questions about HIPAA compliant email
Is Gmail HIPAA compliant for therapists?
Free Gmail is not: Google doesn't sign a BAA for it. Google Workspace, the paid version, offers a BAA you accept in the Admin console. Even then, mail to a client isn't end-to-end encrypted by default, and third-party add-ons fall outside the BAA, so many practices add Paubox or Virtru.
Do therapists need a BAA with their email provider?
Yes, if you're a covered entity sending PHI by email. Each ranked service offers one: Hushmail and Paubox include it, Microsoft 365 applies it by default, Google has you accept it online, Proton signs it on request by email. Keep a copy with your records.
Is Proton Mail HIPAA compliant?
Proton signs a BAA with any user who asks. The BAA isn't enough on its own: mail from Proton to a Gmail or Outlook address is only end-to-end encrypted if you add a password. Make that a habit for every client message.
Do I need written consent to email clients?
Professional guidance recommends getting and documenting consent before emailing clients, and written consent is the safest way to document it. Tell clients what you will and won't send by email and let them opt out.
Is a client's email address PHI?
It can be. Linked to care, a client's email address counts as PHI, and in therapy knowing someone emails you reveals they're in treatment. That's why a group email with visible addresses counts as a disclosure. Always send one message per client or use BCC.
What's the cheapest HIPAA compliant email for a solo therapist?
In our comparison, Proton Mail Essentials at $6.99 per user per month on annual billing, with a BAA on request. Google Workspace and Microsoft 365 start at $7 a month but need configuration. Paubox and Virtru bill a base of five users, so they cost more for one person.
Can clients read encrypted email without creating an account?
With Paubox, yes: the email lands in their usual inbox, no portal or password. With Proton, they open a link and type a password you gave them. Hushmail and Virtru also add a step on the client side. Test it from a personal address before you roll it out.