# HIPAACompare

> Independent comparison of HIPAA-compliant email, fax, texting and video vendors: who signs a Business Associate Agreement (BAA), the cheapest plan that includes one, and the price. Every fact links to the vendor's own page. Data verified 2026-10-27. General information, not legal advice.

HIPAACompare sells none of these products, and affiliate status never changes a table's order. Prices are in USD per month and may assume annual billing. "Not stated" means the vendor's public pages don't confirm a BAA for the product, not that the vendor refuses one. Full facts for every vendor: https://hipaacompare.com/llms-full.txt

## Comparisons

- [HIPAA-compliant email](https://hipaacompare.com/hipaa-compliant-email/): 9 email services compared. Proton for Business is the cheapest HIPAA-compliant email option with a published BAA plan ($6.99/mo per user; BAA from the Free plan); 8 of the 9 email services we compared sign a BAA on a plan you can buy yourself.
- [HIPAA-compliant online fax](https://hipaacompare.com/hipaa-compliant-fax/): 10 online fax services compared. Fax Pigeon is the cheapest HIPAA-compliant fax option with a published BAA plan ($4.99/mo per account; BAA from the Basic plan); 7 of the 10 online fax services we compared sign a BAA on a plan you can buy yourself.
- [HIPAA-compliant texting](https://hipaacompare.com/hipaa-compliant-texting/): 7 texting platforms compared. Weave is the cheapest HIPAA-compliant texting option with a published BAA plan ($199/mo per account; BAA from the Pro plan); 3 of the 7 texting platforms we compared sign a BAA on a plan you can buy yourself.
- [HIPAA-compliant video calls](https://hipaacompare.com/hipaa-compliant-video/): 7 video platforms compared. Doxy.me is the cheapest HIPAA-compliant video option with a published BAA plan (free; BAA from the Free plan); 6 of the 7 video platforms we compared sign a BAA on a plan you can buy yourself.
- [HIPAA-compliant fax for therapists](https://hipaacompare.com/hipaa-compliant-fax-for-therapists/): Low-volume fax with a BAA and no sales call.
- [HIPAA-compliant fax for dental offices](https://hipaacompare.com/hipaa-compliant-fax-for-dental-offices/): Several staff, one number, labs and insurers.
- [HIPAA-compliant fax for physical therapy](https://hipaacompare.com/hipaa-compliant-fax-for-physical-therapy/): Inbound referrals and plans of care from physicians.
- [HIPAA-compliant texting for dental offices](https://hipaacompare.com/hipaa-compliant-texting-for-dental-offices/): Appointment reminders, two-way texting and PMS integrations.
- [HIPAA-compliant video for therapists](https://hipaacompare.com/hipaa-compliant-video-for-therapists/): Free BAA plans, browser join, waiting rooms and recording.
- [HIPAA-compliant email for therapists](https://hipaacompare.com/hipaa-compliant-email-for-therapists/): Encryption to clients' own inboxes, portals and intake forms.
- [HIPAA-compliant tools for a private practice](https://hipaacompare.com/hipaa-compliant-tools-for-private-practice/): one pick per channel for a solo practice, with a calculated total monthly cost.
- [HIPAA-compliant alternatives to Gmail](https://hipaacompare.com/hipaa-compliant-alternative-to-gmail/): our verdict on Gmail, alternatives that sign a BAA, and a switching checklist.
- [HIPAA-compliant alternatives to Zoom](https://hipaacompare.com/hipaa-compliant-alternative-to-zoom/): our verdict on Zoom, alternatives that sign a BAA, and a switching checklist.
- [HIPAA-compliant alternatives to iMessage](https://hipaacompare.com/hipaa-compliant-alternative-to-imessage/): our verdict on iMessage, alternatives that sign a BAA, and a switching checklist.
- [Compare vendors side by side](https://hipaacompare.com/compare/): up to three vendors, every fact with its source.
- Ranking rule: Ranked by our published rules: BAA clarity first, then estimated monthly cost from the vendor's own price. Commission never changes the order.

## Vendors

- [Documo (mFax)](https://hipaacompare.com/vendors/documo-mfax/): Signs BAA: Yes, self-serve; from plan: Solo Cloud Fax; from $25/mo per account
- [Doximity DocFax](https://hipaacompare.com/vendors/doximity-docfax/): Signs BAA: Not stated; from plan: not stated; from Free
- [Doxy.me](https://hipaacompare.com/vendors/doxy-me/): Signs BAA: Yes, self-serve; from plan: Free; from Free
- [eFax (Business / Corporate)](https://hipaacompare.com/vendors/efax/): Signs BAA: Paid plans only; from plan: Business; from $39.99/mo per account
- [Fax Pigeon](https://hipaacompare.com/vendors/fax-pigeon/): Signs BAA: Yes, self-serve; from plan: Basic; from $4.99/mo per account
- [Fax.Plus](https://hipaacompare.com/vendors/fax-plus/): Signs BAA: Enterprise only; from plan: Enterprise; from $79.99/mo per account
- [Google Workspace](https://hipaacompare.com/vendors/google-workspace/): Signs BAA: Paid plans only; from plan: not stated; from $8.40/mo per user
- [Hushmail for Healthcare](https://hipaacompare.com/vendors/hushmail/): Signs BAA: Yes, self-serve; from plan: Healthcare Basic; from $11.99/mo per user
- [iFax](https://hipaacompare.com/vendors/ifax/): Signs BAA: Paid plans only; from plan: Plus; from $24.99/mo per account
- [LuxSci](https://hipaacompare.com/vendors/luxsci/): Signs BAA: Yes, self-serve; from plan: Secure Gateway; from $50/mo per account
- [Mailchimp](https://hipaacompare.com/vendors/mailchimp/): Signs BAA: Not stated; from plan: not stated; from See vendor
- [Microsoft 365](https://hipaacompare.com/vendors/microsoft-365/): Signs BAA: Paid plans only; from plan: Microsoft 365 Business Basic; from $7/mo per user
- [OhMD](https://hipaacompare.com/vendors/ohmd/): Signs BAA: Yes, self-serve; from plan: Core; from $300/mo
- [Paubox](https://hipaacompare.com/vendors/paubox/): Signs BAA: Yes, self-serve; from plan: Standard; from $32/mo per account
- [Proton for Business](https://hipaacompare.com/vendors/proton/): Signs BAA: Yes, self-serve; from plan: Free; from $6.99/mo per user
- [SlickText](https://hipaacompare.com/vendors/slicktext/): Signs BAA: Not stated; from plan: not stated; from Free tier
- [SRFax](https://hipaacompare.com/vendors/srfax/): Signs BAA: Yes, self-serve; from plan: Healthcare Lite; from $10.70/mo per account
- [Textline](https://hipaacompare.com/vendors/textline/): Signs BAA: Paid plans only; from plan: HIPAA Essentials; from See vendor
- [TigerConnect](https://hipaacompare.com/vendors/tigerconnect/): Signs BAA: Yes, through sales; from plan: not stated; from See vendor
- [Twilio](https://hipaacompare.com/vendors/twilio/): Signs BAA: Enterprise only; from plan: Security Edition; from See vendor
- [Updox](https://hipaacompare.com/vendors/updox/): Signs BAA: Yes, through sales; from plan: not stated; from See vendor
- [Virtru](https://hipaacompare.com/vendors/virtru/): Signs BAA: Paid plans only; from plan: Starter; from $119/mo per account
- [VSee Clinic](https://hipaacompare.com/vendors/vsee/): Signs BAA: Yes, self-serve; from plan: Free; from Free
- [Weave](https://hipaacompare.com/vendors/weave/): Signs BAA: Yes, self-serve; from plan: Pro; from $199/mo per account
- [WestFax](https://hipaacompare.com/vendors/westfax/): Signs BAA: Yes, self-serve; from plan: Solo; from $14.99/mo per account
- [Zoho Mail](https://hipaacompare.com/vendors/zoho-mail/): Signs BAA: Yes, self-serve; from plan: not stated; from $1/mo per user
- [Zoom (Workplace / Zoom for Healthcare)](https://hipaacompare.com/vendors/zoom/): Signs BAA: Paid plans only; from plan: Pro; from $14.16/mo per user

## Is it HIPAA compliant?

- [Is Gmail (free) HIPAA compliant?](https://hipaacompare.com/is-gmail-hipaa-compliant/): No. Google offers its HIPAA Business Associate Amendment only to Google Workspace and Cloud Identity customers, and an administrator must accept it in the Admin console. Google says customers who have not signed a BAA 'must not use PHI' in its services. A free personal Gmail account has no Admin console, so it cannot accept the BAA.
- [Is Google Workspace Gmail HIPAA compliant?](https://hipaacompare.com/is-google-workspace-gmail-hipaa-compliant/): Yes, with a signed BAA. Gmail is on Google's list of 'Included Functionality' under the Google Workspace HIPAA BAA, which an admin accepts in the Admin console. Third-party add-ons and 'Additional Google Services' are not covered, and customers must still configure the service appropriately.
- [Is Outlook.com HIPAA compliant?](https://hipaacompare.com/is-outlook-com-hipaa-compliant/): No. Microsoft provides its HIPAA BAA through the Microsoft Online Services Data Protection Addendum to covered-entity and business-associate customers of its in-scope commercial cloud services. The consumer Outlook.com service is not on that in-scope list, so no BAA covers it.
- [Is Microsoft 365 Outlook (Exchange Online) HIPAA compliant?](https://hipaacompare.com/is-microsoft-365-outlook-hipaa-compliant/): Yes, with a signed BAA. Exchange Online and Microsoft Teams are listed as in-scope services, and the HIPAA BAA applies by default through the Microsoft Online Services Data Protection Addendum for covered entities and business associates. Customers remain responsible for configuring encryption and access controls.
- [Is WhatsApp HIPAA compliant?](https://hipaacompare.com/is-whatsapp-hipaa-compliant/): No. We found no Business Associate Agreement offered on WhatsApp's legal or business-terms pages. HHS's COVID-19 telehealth enforcement discretion, which temporarily relaxed BAA enforcement for communication apps, expired on May 11, 2023, and its transition period ended on August 9, 2023.
- [Is iMessage HIPAA compliant?](https://hipaacompare.com/is-imessage-hipaa-compliant/): No. Apple's iCloud terms say covered entities and business associates will not use the service to 'create, receive, maintain or transmit any protected health information' or in any way that would make Apple their business associate. We found no BAA from Apple for Messages.
- [Is Signal HIPAA compliant?](https://hipaacompare.com/is-signal-hipaa-compliant/): No. Signal's legal terms do not offer a Business Associate Agreement. HHS guidance says a BAA is required when a service creates, receives or maintains PHI for a covered entity. The 'conduit' exception applies only to services with transient access to the PHI they transmit, and end-to-end encryption alone does not turn a messaging app into a HIPAA-covered service.
- [Is Zoom (standard) HIPAA compliant?](https://hipaacompare.com/is-zoom-hipaa-compliant/): Only on some plans. Zoom signs BAAs only with customers on paid plans. Pro customers can pick the BAA at checkout, and Business, Business Plus and Enterprise customers go through Sales. The free Basic plan does not come with a BAA.
- [Is FaceTime HIPAA compliant?](https://hipaacompare.com/is-facetime-hipaa-compliant/): No. In March 2020, HHS listed FaceTime as an acceptable non-public-facing app only under COVID-19 enforcement discretion, which expired on May 11, 2023, with a transition period ending on August 9, 2023. Apple's iCloud terms bar covered entities from using iCloud for PHI, and we found no Apple BAA for FaceTime.
- [Is Google Voice HIPAA compliant?](https://hipaacompare.com/is-google-voice-hipaa-compliant/): Only on some plans. Google's HIPAA Included Functionality list covers 'Google Voice (managed users only)'. That means Voice provisioned through a Google Workspace account with a signed BAA. Free personal Google Voice accounts are not managed users and are not covered.
- [Is Dropbox HIPAA compliant?](https://hipaacompare.com/is-dropbox-hipaa-compliant/): Only on some plans. You need a Dropbox team plan and a signed BAA before uploading any PHI. Team admins can sign the BAA electronically in the Admin Console, an option Dropbox limits to US-based customers. Dropbox's HIPAA article applies to certain teams on Standard, Advanced, Enterprise, Education, Business, Business Plus and Dropbox Sign, and says Dash doesn't support HIPAA compliance.
- [Is Slack HIPAA compliant?](https://hipaacompare.com/is-slack-hipaa-compliant/): Only on some plans. Slack supports PHI only on Enterprise plans with an executed BAA. Even then, Slack says you may not use it to communicate with patients or plan members, and PHI is allowed only in messages, files, file names and private channel or DM names. Third-party Slack apps are not covered by Slack's BAA.
- [Is ChatGPT HIPAA compliant?](https://hipaacompare.com/is-chatgpt-hipaa-compliant/): Only on some plans. OpenAI offers a BAA for ChatGPT only on sales-managed ChatGPT Enterprise or Edu accounts, and says it does not offer one for ChatGPT Business. The exception is ChatGPT for Clinicians, a free version for verified US clinicians (currently physicians, nurse practitioners, physician assistants and pharmacists), who can sign a BAA in Settings > Agreements. OpenAI says not to share PHI unless a BAA is in place. API customers can request a separate BAA by email.
- [Is Calendly HIPAA compliant?](https://hipaacompare.com/is-calendly-hipaa-compliant/): No. Calendly's Customer Terms require that customer data does not contain protected health information or information subject to HIPAA. We found no BAA offer in Calendly's terms or on its security pages. If you book patients through Calendly, keep symptoms, diagnoses and other health details out of the booking questions.
- [Is Microsoft Teams HIPAA compliant?](https://hipaacompare.com/is-microsoft-teams-hipaa-compliant/): Only on some plans. Microsoft lists Microsoft Teams as an in-scope Office 365 service, and its HIPAA BAA applies by default through the Microsoft Online Services Data Protection Addendum to customers who are covered entities or business associates. That covers Teams as part of a Microsoft 365 business subscription. Microsoft's HIPAA page covers its enterprise services, not the free personal Teams app.
- [Is Google Meet HIPAA compliant?](https://hipaacompare.com/is-google-meet-hipaa-compliant/): Only on some plans. Google Meet is on Google's HIPAA Included Functionality list, so it is covered once a Google Workspace administrator accepts Google's BAA in the Admin console. Google offers the BAA only to Workspace and Cloud Identity customers, so Meet on a free personal Google account is not covered.
- [Is Google Chat HIPAA compliant?](https://hipaacompare.com/is-google-chat-hipaa-compliant/): Only on some plans. Google Chat is on Google's HIPAA Included Functionality list, so it is covered once a Google Workspace administrator accepts Google's BAA in the Admin console. Google offers the BAA only to Workspace and Cloud Identity customers, so Chat on a free personal Google account is not covered. Third-party apps and add-ons are outside the BAA.
- [Is Google Forms HIPAA compliant?](https://hipaacompare.com/is-google-forms-hipaa-compliant/): Only on some plans. Google Forms is covered as part of Google Drive on Google's HIPAA Included Functionality list, once a Google Workspace administrator accepts Google's BAA in the Admin console. Forms made with a free personal Google account are not covered, and Google says third-party add-ons are outside the BAA, so check any add-on you use to process responses.
- [Is Jotform HIPAA compliant?](https://hipaacompare.com/is-jotform-hipaa-compliant/): Only on some plans. Jotform offers its HIPAA compliance features only on the Gold plan and Jotform Enterprise, and says HIPAA costs nothing extra on Gold. Turning the features on migrates your forms and data to Jotform's isolated HIPAA servers, after which covered entities can sign a BAA from the Data page. Lower plans don't include it.
- [Is SurveyMonkey HIPAA compliant?](https://hipaacompare.com/is-surveymonkey-hipaa-compliant/): Only on some plans. SurveyMonkey offers HIPAA-enabled accounts only to Enterprise customers, through its sales team. Its terms let regulated entities collect PHI only in a HIPAA-enabled account with a BAA in place. Once an account is HIPAA-enabled it can't be switched back, and if the BAA ends, the account is closed.
- [Is Typeform HIPAA compliant?](https://hipaacompare.com/is-typeform-hipaa-compliant/): Only on some plans. Typeform says it can currently provide a BAA only for customers on its Enterprise or Growth Custom plans, requested through its Sales team. Customers on other plans have to contact Typeform for HIPAA pricing first, so standard self-serve plans don't come with a BAA.
- [Is Box HIPAA compliant?](https://hipaacompare.com/is-box-hipaa-compliant/): Only on some plans. Box says HIPAA covered entities and business associates must have an Enterprise, Enterprise Plus or Enterprise Advanced account and sign a BAA; Personal, Starter and Business accounts don't qualify. Enterprise admins can request the BAA in the Admin Console under Account & Billing, and Box emails the addendum in 3 to 5 business days.
- [Is Google Drive HIPAA compliant?](https://hipaacompare.com/is-google-drive-hipaa-compliant/): Only on some plans. Google Drive, including Docs, Sheets, Slides and Forms, is on Google's HIPAA Included Functionality list, so it is covered once a Google Workspace administrator accepts Google's BAA in the Admin console. Google offers the BAA only to Workspace and Cloud Identity customers, so files in a free personal Google account are not covered. Third-party add-ons are outside the BAA.
- [Is OneDrive HIPAA compliant?](https://hipaacompare.com/is-onedrive-hipaa-compliant/): Only on some plans. Microsoft lists OneDrive for Business as an in-scope Office 365 service, and its HIPAA BAA applies by default through the Microsoft Online Services Data Protection Addendum to customers who are covered entities or business associates. That covers OneDrive in a Microsoft 365 business subscription. Microsoft's HIPAA page covers its enterprise services, not personal OneDrive accounts.
- [Is Dropbox Sign HIPAA compliant?](https://hipaacompare.com/is-dropbox-sign-hipaa-compliant/): Only on some plans. Dropbox says Dropbox Sign supports HIPAA compliance for customers on an annual Standard or Premium plan who have a signed BAA and meet the minimum contract value. You arrange it through an account manager or Dropbox's sales contact form. Once HIPAA compliance is on, your team can no longer CC people on signature requests or receive signed PDFs by email.
- [Is SharePoint HIPAA compliant?](https://hipaacompare.com/is-sharepoint-hipaa-compliant/): Only on some plans. Microsoft lists SharePoint Online among the in-scope services covered by its HIPAA Business Associate Agreement. That BAA is available by default, through the Microsoft Online Services Data Protection Addendum, to customers who are covered entities or business associates. Microsoft's HIPAA page covers its enterprise cloud services, so it applies to SharePoint Online in a Microsoft 365 business subscription.
- [Is iCloud HIPAA compliant?](https://hipaacompare.com/is-icloud-hipaa-compliant/): No. Apple's iCloud terms say covered entities and business associates must not use any part of iCloud to create, receive, maintain or transmit protected health information. They also must not use it in a way that would make Apple their business associate. We found no BAA offer for iCloud in those terms.

## About

- [Independence and how we verify](https://hipaacompare.com/about/): method, sourcing rules and how the site is funded.
- [Privacy policy](https://hipaacompare.com/privacy/): no sign-ups, cookieless analytics, affiliate cookies.
- Corrections: hello@hipaacompare.com