HIPAA-compliant email for therapists

Feature by feature: 8 email services

Checked on the vendors' own sites on 2026-09-26. "Not stated by vendor" means the vendor's site doesn't say, not that the feature is missing. Each fact links to its source.

• Zoho Mail

  BAA: Yes, self-serve

  What clients see

  Normal inbox via TLS for standard mail. SecurePass (confidential) emails require external recipients to enter an OTP sent to their email. S/MIME and PGP need recipient keys or certificates OTP sent to their email Source: Zoho Mail What clients see

  Encryption

  TLS in transit (admins can request forced TLS through support), S/MIME and PGP on Mail Premium and Workplace Professional, and SecurePass confidential email (Zoho's page does not state that SecurePass encrypts content) forced TLS for both incoming and outgoing emails from/ to external domains Source: Zoho Mail Encryption

  Encryption on the cheapest BAA plan

  Not stated by vendor Sources checked: Zoho Mail

  Your own domain

  Yes Source: Zoho Mail Your own domain

  Secure forms or intake

  Not stated by vendor Sources checked: Zoho Mail

  Therapy-specific

  Not stated by vendor Sources checked: Zoho Mail

  Setup

  Self-serve plans on the pricing page (including Mail Free). The BAA is requested by email from Zoho Legal Source: Zoho Mail Setup

  BAA

  Request the BAA template by emailing legal@zohocorp.com. No plan named. The pricing FAQ says: "In the Workplace suite, Zoho Mail and Zoho WorkDrive comply with HIPAA." Contact legal@zohocorp.com to request Zoho's BAA template. Source: Zoho Mail BAA

  Cheapest plan with a BAA

  Not stated by vendor. The site does not state which plan qualifies for the BAA. Pricing-page structured data lists Mail Lite $1, Workplace Standard $3, Mail Premium $4 and Workplace Professional $6 (USD, per user/month; billing term not shown). The existing vendors.json uses Mail Lite $1, billed annually In the Workplace suite, Zoho Mail and Zoho WorkDrive comply with HIPAA. Source: Zoho Mail Cheapest plan with a BAA

  Note: Forced TLS needs a support request. S/MIME/PGP only on higher tiers and hard for clients to use. Confirm in writing which plan the BAA covers.

  Visit Zoho Mail → (opens in a new tab) Compare
  Sources (5)

  • zoho.com/mail/hipaa.html (BAA via legal@zohocorp.com, TLS, S/MIME)
  • zoho.com/hipaa.html (BAA template request, Zoho Mail listed as supporting HIPAA)
  • zoho.com/mail/zohomail-pricing.html (plans, custom domain, S/MIME/PGP tiers, HIPAA FAQ, schema prices)
  • zoho.com/mail/help/confidential-email.html (SecurePass OTP for external recipients)
  • zoho.com/mail/help/email-encryption.html (forced TLS by contacting support)

• Proton for Business

  BAA: Yes, self-serve

  What clients see

  Password portal for non-Proton clients. The client clicks "Unlock message", enters a password the therapist sent separately, reads in the browser, and can reply up to five times before the message expires Enter the password and click Read message Source: Proton for Business What clients see

  Encryption

  End-to-end encryption between Proton users. Password-protected (end-to-end) emails to external recipients. Otherwise standard delivery Source: Proton for Business Encryption

  Encryption on the cheapest BAA plan

  Included. Password-protected email is "available on all Proton Mail plans, including Proton Free." This feature is available on all Proton Mail plans, including Proton Free. Source: Proton for Business Encryption on the cheapest BAA plan

  Your own domain

  Yes Source: Proton for Business Your own domain

  Secure forms or intake

  Not stated by vendor Sources checked: Proton for Business

  Therapy-specific

  Blog guide only: proton.me Source: Proton for Business Therapy-specific

  Setup

  Not stated by vendor Sources checked: Proton for Business

  BAA

  Offered to all users on request. The healthcare page says to email privacy@support.proton.me (subject 'HIPAA BAA'); the therapist blog says to email enterprise@proton.me We offer BAAs to all Proton users. Source: Proton for Business BAA

  Cheapest plan with a BAA

  Mail Essentials: $6.99 per user/month billed yearly ($83.88/user/year). Confirmed in Chrome 2026-09-26 on proton.me/business/plans (Mail tab). Workspace Standard $12.99 Source: Proton for Business Cheapest plan with a BAA

  Note: Clients need a separately shared password and messages expire, which is awkward for ongoing therapy correspondence. The two BAA contact addresses conflict.

  Visit Proton for Business → (opens in a new tab) Compare
  Sources (4)

  • proton.me/business/healthcare (BAA offered to all users, request via privacy@support.proton.me, password-protected emails)
  • proton.me/business/blog/hipaa-compliant-email-for-therapists (therapist content, BAA via enterprise@proton.me, portal login)
  • proton.me/support/password-protected-emails (recipient unlock flow, 5-reply limit, available on all plans)
  • proton.me/business/plans (custom domains per plan; prices not rendered)

• Hushmail for Healthcare

  BAA: Yes, self-serve

  What clients see

  Portal and login. The client gets an email with a link, clicks "Read your secure email", then signs in with a Google, Microsoft or Apple account or a custom password, and reads and replies in a secure webpage Read your secure email Source: Hushmail for Healthcare What clients see

  Encryption

  Message-level encryption. Non-Hushmail recipients read and reply through a secure web page. Hushmail is a standalone email host, not an add-on Source: Hushmail for Healthcare Encryption

  Encryption on the cheapest BAA plan

  Included. Healthcare Basic is HIPAA-compliant email with a BAA, but no forms Source: Hushmail for Healthcare Encryption on the cheapest BAA plan

  Your own domain

  Yes Source: Hushmail for Healthcare Your own domain

  Secure forms or intake

  Yes on Healthcare Essentials and higher: secure web forms, e-signatures and templates (e.g. PHQ-9, informed consent). Healthcare Basic has no forms. Custom form builds cost $25 per form Source: Hushmail for Healthcare Secure forms or intake

  Therapy-specific

  Yes, dedicated page: hushmail.com ("Designed for therapists who need simple, HIPAA-compliant email and forms") Designed for therapists who need simple, HIPAA-compliant email and forms Source: Hushmail for Healthcare Therapy-specific

  Setup

  Self-serve signup: "Try 14 days free". Support will set up the custom domain Source: Hushmail for Healthcare Setup

  BAA

  Signed BAA listed as a feature on all Healthcare plans Get a signed business associate agreement (BAA) for healthcare providers Source: Hushmail for Healthcare BAA

  Cheapest plan with a BAA

  Healthcare Basic: $11.99 per month, 1 user, monthly term (annual $131.89/year). Essentials $14.99/mo, Growth $17.99/mo for 1 user, monthly term. Taken from the price JSON in the pricing page HTML. The therapy page gives group plans from $24.99/mo (5 accounts) Plans for as little as $11.99 per month Source: Hushmail for Healthcare Cheapest plan with a BAA

  Note: Clients must open messages in a web portal. A client who forgets a custom password cannot recover it and loses access to past secure emails.

  Visit Hushmail for Healthcare → (opens in a new tab, affiliate link)Affiliate link. It doesn't change our order. Compare
  Sources (4)

  • hushmail.com/pricing (Healthcare plan tiers, forms on Essentials+, prices in page JSON)
  • hushmail.com/plans/healthcare-hipaa-compliant-email (BAA, custom domain, starting price $11.99, 14-day trial)
  • hushmail.com/therapy-hipaa-compliant-email (therapist-specific features, solo/group pricing)
  • blog.hushmail.com/blog/what-your-clients-experience-when-you-send-an-encrypted-email (recipient portal and sign-in flow, password non-recoverable)

• Paubox

  BAA: Yes, self-serve

  What clients see

  Lands in client's normal inbox, no portal or password. If the recipient server lacks TLS, the message goes to Paubox's secure web app (one extra click) No portals or passwords needed for recipients Source: Paubox What clients see

  Encryption

  Blanket (enforced) TLS by default, with fallback to a Paubox secure web app when TLS is unavailable; works on top of Google Workspace or Microsoft 365 blanket TLS encryption Source: Paubox Encryption

  Encryption on the cheapest BAA plan

  Included on Standard, the cheapest plan. All plans include HIPAA email encryption and a BAA Source: Paubox Encryption on the cheapest BAA plan

  Your own domain

  Yes Sources: Paubox

  Secure forms or intake

  Yes. "Signable, encrypted forms" are free with any paid plan (Standard plan: "HIPAA compliant email + forms") Signable, encrypted forms Source: Paubox Secure forms or intake

  Therapy-specific

  Therapist-focused blog content only; no dedicated therapist product page found. paubox.com Source: Paubox Therapy-specific

  Setup

  Self-serve signup ("Start for free", 14-day trial) plus free guided setup: "Complimentary setup. We'll help you get your HIPAA compliant email set up." Complimentary setup Source: Paubox Setup

  BAA

  Included with every account at no extra fee Paubox includes a BAA with all accounts Source: Paubox BAA

  Cheapest plan with a BAA

  Standard: $32 per month for up to 5 senders, billed annually ($41.60/month billed monthly). Confirmed in Chrome 2026-09-26: Standard $32/month, up to 5 senders (annual). Plus $65, Premium $75 Source: Paubox Cheapest plan with a BAA

  Note: Needs an existing Google Workspace or Microsoft 365 mailbox. Clients read mail normally, but messages are protected by TLS in transit, not end-to-end.

  Visit Paubox → (opens in a new tab) Compare
  Sources (3)

  • paubox.com/pricing/paubox-email-suite (plans, BAA with all accounts, no portals, forms free with paid plan, complimentary setup, price data)
  • paubox.com/ (no portals or passcodes; works with Google and Microsoft)
  • paubox.com/blog/what-therapists-need-to-know-about-hipaa-compliant-email (therapist-targeted content; no extra logins for clients; unencrypted email with client consent)

• LuxSci

  BAA: Yes, self-serve

  What clients see

  Varies by recipient. LuxSci automatically picks TLS (normal inbox), a secure portal, PGP or S/MIME. With the SecureLine Escrow portal, the recipient gets a notice with a link and password and must enter a secret answer The recipient is sent a notice that an email is waiting. This contains a link and password. Source: LuxSci What clients see

  Encryption

  Automatic SecureLine encryption, chosen per recipient (TLS, portal, PGP or S/MIME), run as a gateway on top of Microsoft 365 or Google Workspace Selects TLS, secure portal, PGP, or S/MIME on a per-recipient basis Source: LuxSci Encryption

  Encryption on the cheapest BAA plan

  Included on the Secure Gateway plan ("Automatic SecureLine encryption" plus BAA) Automatic SecureLine™ encryption Source: LuxSci Encryption on the cheapest BAA plan

  Your own domain

  Not stated by vendor Sources checked: LuxSci

  Secure forms or intake

  Offered as a separate product (LuxSci Secure Forms), not part of the Secure Gateway plan Source: LuxSci Secure forms or intake

  Therapy-specific

  Not stated by vendor Sources checked: LuxSci

  Setup

  Unclear. The pricing page has a "Get Started" button, but the homepage pushes "Talk to an Expert" and "Get a Demo" and shows no visible self-serve signup Source: LuxSci Setup

  BAA

  Pricing page lists "HIPAA compliant BAA included" on each plan HIPAA compliant BAA included Source: LuxSci BAA

  Cheapest plan with a BAA

  Secure Gateway: $50 per month for up to 5 users. 10 users $70/mo, 20 users $140/mo; 50+ users by quote. Billing term not stated Source: LuxSci Cheapest plan with a BAA

  Note: Aimed at larger healthcare organizations. The Gateway needs an existing M365 or Google mailbox, and some clients may get portal messages instead of inbox delivery.

  Visit LuxSci → (opens in a new tab) Compare
  Sources (4)

  • luxsci.com/pricing/ (Secure Gateway price, BAA included, per-recipient encryption selection, 'No portals, plugins, or workflow changes')
  • luxsci.com/ (small-practice gateway, Secure Forms as separate product, demo-led CTAs)
  • luxsci.com/blog/send-a-secure-email-to-anyone/ (SecureLine Escrow recipient flow (link + password + secret answer))
  • luxsci.com/secure-email-gateway/ (automatically encrypt email sent from Microsoft 365 / Google Workspace)

• Microsoft 365

  BAA: Paid plans only

  What clients see

  With Purview Message Encryption, external recipients such as Gmail or Yahoo users read and reply on the web. They sign in to the encrypted message portal with a one-time passcode sent by email can read and reply to encrypted messages on the web through your web browser Source: Microsoft 365 What clients see

  Encryption

  Microsoft Purview Message Encryption (OME), with TLS for ordinary mail Source: Microsoft 365 Encryption

  Encryption on the cheapest BAA plan

  Not included. The BAA covers Office 365 by default, but Business Basic and Business Standard need the Azure Information Protection Plan 1 add-on for message encryption. Business Premium includes it Each user benefiting from Microsoft Purview Message Encryption needs a license Source: Microsoft 365 Encryption on the cheapest BAA plan

  Your own domain

  Yes Custom business email (you@yourbusiness.com) Source: Microsoft 365 Your own domain

  Secure forms or intake

  Not stated by vendor Sources checked: Microsoft 365

  Therapy-specific

  Not stated by vendor Sources checked: Microsoft 365

  Setup

  Self-serve signup ("Try for free" / "Buy now", credit card required) Source: Microsoft 365 Setup

  BAA

  Automatic, provided through the Online Services Data Protection Addendum available through the Microsoft Online Services Data Protection Addendum by default Source: Microsoft 365 BAA

  Cheapest plan with a BAA

  Business Basic (BAA covered, encryption needs add-on): $7 per user/month, paid yearly ($8.40 monthly). Business Premium (includes Purview Message Encryption) is $22.00 user/month paid yearly ($26.40 monthly). The $32 figure is Business Premium with Copilot. Confirmed in Chrome 2026-09-26. Business Standard $14.00 paid yearly $7.00 user/month, paid yearly Source: Microsoft 365 Cheapest plan with a BAA

  Note: Solo therapists on Basic or Standard have a BAA but no encryption to clients unless they upgrade or add a license. Clients need a one-time code to read.

  Visit Microsoft 365 → (opens in a new tab) Compare
  Sources (5)

  • learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech (BAA via DPA by default; Office 365 in scope)
  • learn.microsoft.com/en-us/purview/ome-faq (plans including OME, add-on requirement, recipient one-time passcode/web portal)
  • microsoft.com/en-us/microsoft-365/business/microsoft-365-business-basic (Basic price, custom domain email)
  • microsoft.com/en-us/microsoft-365/business/microsoft-365-business-premium (Premium price, trial/buy now)
  • microsoft.com/en-us/microsoft-365/business/microsoft-365-business-standard (Standard price)

• Google Workspace

  BAA: Paid plans only

  What clients see

  By default the email lands in the client's normal inbox, protected only by TLS in transit when both providers support it. With client-side encryption (Enterprise Plus only), external recipients must create a Google guest account or sign in to read create a Google Guest Account and log in to a third-party service to read the message Source: Google Workspace What clients see

  Encryption

  Opportunistic TLS by default. Client-side encryption (S/MIME-based) only on Enterprise Plus, Education Plus/Standard and Frontline Plus. Hosted S/MIME is available but needs recipient certificates All Gmail messages use TLS automatically. Source: Google Workspace Encryption

  Encryption on the cheapest BAA plan

  TLS in transit only. Message-level encryption to external recipients (CSE) needs Enterprise Plus or a third-party add-on Enterprise Plus, Education Plus, Education Standard, Frontline Plus Source: Google Workspace Encryption on the cheapest BAA plan

  Your own domain

  Yes Source: Google Workspace Your own domain

  Secure forms or intake

  Not stated by vendor Sources checked: Google Workspace

  Therapy-specific

  Not stated by vendor Sources checked: Google Workspace

  Setup

  Self-serve signup ("Get started" on the Gmail product page) Source: Google Workspace Setup

  BAA

  A super admin reviews and accepts the BAA in the Admin console under Account settings > Legal and compliance. Gmail is listed as HIPAA Included Functionality go to Account settings > Legal and compliance Source: Google Workspace BAA

  Cheapest plan with a BAA

  Business Starter: $8.40 per user/month, Flexible (monthly) plan. From Google's Flexible Plan help page. Annual-commitment USD price not shown (the pricing page is geo-priced). Google doesn't name a minimum edition for the BAA. Source: knowledge.workspace.google.com

  Note: Signing the BAA does not encrypt messages beyond TLS. A red open-lock icon means a message went unencrypted, so a therapist has to configure settings or add a tool.

  Visit Google Workspace → (opens in a new tab) Compare
  Sources (5)

  • knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity (BAA acceptance path in Admin console)
  • docs.cloud.google.com/docs/security/compliance/hipaa (Gmail listed as HIPAA included functionality)
  • support.google.com/mail/answer/6330403 (TLS by default; red lock = unencrypted)
  • support.google.com/mail/answer/13317990 (CSE editions and external guest-account flow)
  • workspace.google.com/products/gmail/ (custom domain email, self-serve Get started)

• Virtru

  BAA: Paid plans only

  What clients see

  Extra step. The client clicks "Unlock Message", verifies with Google, Microsoft or Outlook sign-in or a verification email from verify@virtru.com, then reads in the Virtru Secure Reader in the browser. The pricing page says "No usernames or passwords required for recipients" Open the secure email in your inbox and click Unlock Message. Source: Virtru What clients see

  Encryption

  End-to-end encryption of email and attachments through a Gmail or Outlook integration (Microsoft 365 or Google Workspace), with expiration and revoke controls Securely send end-to-end encrypted email & attachments Source: Virtru Encryption

  Encryption on the cheapest BAA plan

  Included on Starter ("Securely send end-to-end encrypted email & attachments" plus signed BAA) Source: Virtru Encryption on the cheapest BAA plan

  Your own domain

  Not stated by vendor Sources checked: Virtru

  Secure forms or intake

  Not stated by vendor Sources checked: Virtru

  Therapy-specific

  Blog content only: virtru.com Source: Virtru Therapy-specific

  Setup

  Sales-led. The pricing page CTA is "Book a Demo", and the BAA is requested from support Source: Virtru Setup

  BAA

  Signed BAA with most paid packages, requested through the Support Team. Takes up to 1-2 weeks to countersign. Not available on free Personal accounts Virtru offers a signed BAA with most of its paid packages. Please contact our Support Team to receive the necessary documentation. Source: Virtru BAA

  Cheapest plan with a BAA

  Starter: $119 per month, includes 5 users, billed annually $119 /month (includes 5 users) Source: Virtru Cheapest plan with a BAA

  Note: Add-on for an existing Google Workspace or Microsoft 365 account. Clients must verify their identity before reading. The 5-user minimum is costly for a solo practice.

  Visit Virtru → (opens in a new tab) Compare
  Sources (4)

  • virtru.com/data-security-platform/pricing-packages (Starter price, E2E encryption, BAA, no recipient usernames/passwords, Book a Demo)
  • support.virtru.com/hc/en-us/articles/360005927613-HIPAA-Compliance-BAAs (BAA eligibility and process)
  • support.virtru.com/hc/en-us/articles/115012284147-Read-a-Virtru-Encrypted-Email-without-Virtru-Installed (recipient unlock and verification steps)
  • virtru.com/blog/compliance/hipaa-email-for-therapists (therapist-targeted content)

What vendors don't publish

We couldn't confirm these on the vendors' sites, so we leave them unresolved rather than guess.

• workspace.google.com/pricing: USD prices for Business Starter/Standard/Plus (JavaScript-rendered); also which editions can sign the BAA
• zoho.com/mail/zohomail-pricing.html: Which plan the BAA covers, whether encryption to external recipients is on that plan, and the billing term for schema prices
• hushmail.com/pricing: Visible prices JavaScript-rendered; prices came from embedded JSON. Healthcare Basic JSON lists number_of_forms 3 while copy says 'Does not include forms'.
• luxsci.com/pricing/: Billing term, custom domain statement, self-serve vs sales onboarding, therapist-specific content
• virtru.com/data-security-platform/pricing-packages: Custom domain statement and secure forms