7 Best HIPAA-Compliant Email Services for Therapists & Counselors (2027)

The best HIPAA-compliant email for therapists is one whose vendor signs a Business Associate Agreement (BAA), works on your own practice domain, and costs little for one or two users. For a solo or group therapy practice, the seven worth shortlisting in 2027 are ClinikMail (free with ClinikEHR), Hushmail for Healthcare (from $11.99/month for one account), Proton Mail (from $6.99/user/month billed yearly), Google Workspace and Microsoft 365 (from $7/user/month on annual terms), Paubox (from $32/month for up to 5 senders, on top of Google or Microsoft) and Virtru (from $119/month for 5 users). We checked every price and BAA statement on the vendor's own site in September 2026.

ClinikEHR makes ClinikMail. Here's how we judged every option, including ours.

Quick Answer

• Solo therapist who wants email tied to client records: ClinikMail, included on ClinikEHR's Free plan with 3 mailboxes, 5 GB and your own domain.
• Solo therapist who only wants a secure mailbox: Hushmail Healthcare Basic at $11.99/month, BAA included.
• Lowest per-user price with a BAA: Proton Mail Essentials at $6.99/user/month billed yearly. Proton says it offers BAAs to all users, on request.
• Already on Gmail or Outlook for business: accept Google's or Microsoft's BAA and configure it properly, then add Paubox or Virtru if you want encryption without changing providers.

This is a shortlist for therapy practices specifically. If you're comparing email for a larger medical clinic, our HIPAA-compliant email buyer's guide covers that ground in more depth.

Why Email Is Different for Therapists

Therapy practices use email in ways most small businesses don't. A prospective client writes in about anxiety before you've ever met. A current client replies to an appointment reminder with something personal. A parent emails about a teenager's sessions. Every one of those messages can contain protected health information (PHI), and much of it arrives before you've had a chance to set expectations.

HHS says covered providers may email patients "provided they apply reasonable safeguards when doing so," and that the Privacy Rule "does not prohibit the use of unencrypted e-mail for treatment-related communications," as long as other safeguards are in place, such as limiting what the message discloses (HHS FAQ, opened September 2026). HHS also says a client can ask to receive their own records by unencrypted email once you've warned them of the risk, and that you can't force a client to accept an insecure method (HHS FAQ 2060, opened September 2026).

In practice that means a therapist's email tool needs three things beyond a BAA: a secure option for anything sensitive, a way to record a client's preference, and a habit of keeping clinical detail out of ordinary email. That's our interpretation for planning purposes, not legal advice.

How We Evaluated

We scored each service against five criteria that matter to a therapy practice of one to ten clinicians:

1. BAA availability. Does the vendor sign a BAA, on which plans, and is there a catch such as a minimum spend?
2. Cost for one or two users. Solo and small group practices shouldn't pay for a five-seat minimum they won't use.
3. Your own domain. [email protected] builds trust and keeps your address if you ever change vendors.
4. Client communication controls. Encryption or a secure portal link for sensitive messages, and a sensible path for clients who ask for plain email.
5. Fit with your records. Whether email connects to the client chart, or sits in a separate silo you'll have to copy from.

The 7 Best HIPAA-Compliant Email Services for Therapists in 2027

1. ClinikMail (Our Pick): Best for Therapists Who Want Email in the EHR

Best for: solo and group practices that want client email, records, booking and the client portal in one place.

ClinikMail is the email service built into ClinikEHR. It gives you real mailboxes on your own domain, set up with a guided DNS wizard, plus a fast webmail with threads, search and Gmail-style keyboard shortcuts. It's HIPAA-compliant and covered by our BAA. Messages are private to your practice, readable only from a session that has passed two-factor authentication, and every read is written to the audit trail.

What makes it a fit for therapy is how it handles client email. When you write to a client, ClinikMail sends a secure message by default: the client gets a short email saying something is waiting and reads the content in their portal. Ordinary email is available only after you record the client's consent, and if you type something sensitive into a direct message, you get a warning first. You can link any thread to the client's chart, where it appears on their timeline, so a between-session email isn't lost in an inbox.

Limitations: it's part of an EHR, so it's best if you use ClinikEHR for your records. Secure portal messages need the client portal, which is included from the Essential plan ($99.90/month). Attachments don't travel on a secure message yet; you share files from the client's record in the portal instead.

Price: Free ($0) includes 3 mailboxes, 5 GB and a custom domain, with 2 staff/providers. Essential ($99.90/month) includes 25 mailboxes and 50 GB; Team ($250/month) 50 mailboxes and 120 GB. There's no per-mailbox charge. See pricing.

2. Hushmail for Healthcare: Best Standalone Mailbox for a Solo Therapist

Best for: a solo clinician who wants one secure mailbox and isn't ready to change EHR.

Hushmail sells healthcare plans for one account on your own domain: Healthcare Basic at $11.99/month, Essentials at $14.99/month and Growth at $17.99/month, or $11, $13.75 and $16.50 a month billed yearly. A BAA is included on all three, with 10 GB of storage per account on Basic and 15 GB on the others. Hushmail says recipients "can open your encrypted message using their Google, Apple, or Microsoft account" (hushmail.com/pricing, checked September 2026).

Healthcare Basic is email only; Hushmail describes it as "Send HIPAA-compliant emails. (Does not include forms.)" Essentials lets you "start using secure forms," and Growth adds "more forms, e-signatures, custom branding, and advanced security."

Limitations: it's separate from your client records, so anything clinical has to be copied into the chart by hand. Multi-user pricing isn't a simple multiple of the single-account price, so a group practice should check Hushmail's current terms for its team size.

3. Proton Mail: Best Low-Cost Option per User

Best for: privacy-minded solo practitioners and small groups who want the lowest per-user price with a BAA.

Proton's business plans start with Mail Essentials at $6.99/user/month billed yearly ($83.88 a year) or $7.99 billed monthly, with 15 GB per user and 3 custom domains. Workspace Standard is $12.99/user/month billed yearly ($14.99 monthly) and adds 1 TB per user, video meetings and a password manager (proton.me/business/plans, checked September 2026). Password-protected emails, email for your own domain and access from Outlook, Thunderbird and Apple Mail are included on all three business plans.

On HIPAA, Proton's healthcare page says: "We offer BAAs to all Proton users." You request a signed copy by emailing Proton with the subject "HIPAA BAA," and a model BAA is published online (proton.me/business/healthcare, checked September 2026).

Limitations: the BAA isn't automatic; you have to ask for it and keep the signed copy. Proton is an email suite, not a clinical system, so client email stays separate from your notes.

4. Google Workspace: Best if Your Practice Already Runs on Gmail

Best for: practices already using Google for calendars and documents, with someone willing to own the settings.

Google Workspace Business Starter is $7/user/month, Standard $14 and Plus $22, on an annual commitment. A super administrator accepts the BAA in the Admin console under Account settings → Legal and compliance, and Gmail is on Google's HIPAA Included Functionality list. Google is blunt that customers who haven't signed the BAA "must not use PHI" (Google's HIPAA page, checked September 2026).

Limitations: a free @gmail.com account isn't the same product, and Google's HIPAA page doesn't address it. Google's implementation guide also says Google Contacts is a core service in which PHI isn't permitted, and third-party add-ons aren't covered. Our Is Gmail HIPAA compliant? post walks through the setup.

5. Microsoft 365: Best if Your Practice Already Runs on Outlook

Best for: clinicians who prefer Outlook, or group practices with IT support.

Microsoft 365 Business Basic is $7/user/month paid yearly ($8.40 billed monthly), Standard $14 and Premium $22. Microsoft says its HIPAA BAA is "available through the Microsoft Online Services Data Protection Addendum by default" to covered entities and business associates, and lists Exchange Online as in scope (Microsoft HIPAA/HITECH, checked September 2026).

Limitations: Microsoft is clear that "using Microsoft services doesn't on its own achieve HIPAA compliance." For a solo therapist without IT help, getting encryption and retention settings right takes time.

6. Paubox: Best Way to Add Encryption to Google or Microsoft

Best for: group practices that want to keep Gmail or Outlook but encrypt outgoing email.

Paubox Email Suite is sold as "everything you need to send HIPAA compliant emails with Google Workspace or Microsoft 365." Standard is $32/month, Plus $65 and Premium $75, each for up to 5 senders, billed annually ($42, $85 and $98 billed monthly). There's a 14-day free trial, and "Paubox includes a BAA with all accounts" (paubox.com/pricing, checked September 2026).

Limitations: you pay for Paubox on top of your Google or Microsoft subscription, so a solo therapist pays for five senders to cover one.

7. Virtru: Best for Recipient-Friendly Encrypted Email in a Group

Best for: group practices on Google Workspace or Microsoft 365 that want encrypted messages clients can open without a new account.

Virtru's Starter plan is $119/month billed annually and includes 5 users. It supports Microsoft 365 and Google Workspace, lets you set expiration dates and revoke access, and says "no usernames or passwords required for recipients." That plan includes a "Signed Business Associate's Agreement (BAA)" (virtru.com/pricing, checked September 2026).

Limitations: at $119/month it's priced for a group, not a solo clinician, and it sits on top of the email service you already pay for.

Also considered: LuxSci Secure Gateway, an encryption layer for Google Workspace and Microsoft 365 email priced from $50/month for up to 5 users, with "HIPAA compliant BAA included" (luxsci.com/pricing, checked September 2026). It's a strong option for high-volume senders but more than most therapy practices need.

What It Costs: Solo vs. Five-Therapist Group

Using the verified prices above, here's the monthly email cost for two common practice sizes. Annual billing is used where the vendor offers it.

For a five-therapist group, ClinikEHR Essential includes 3 staff/providers, then $40/month for each extra clinician up to 5, so five therapists come to $179.90/month. Team ($250/month) includes 5. That price also covers your EHR, notes, booking, billing and client portal, so the fair comparison is against email plus the other tools you'd otherwise pay for.

How to Choose: A Short Decision Guide

If you're a solo therapist starting out, choose based on where your records live. If you're opening a new practice and haven't picked an EHR, ClinikEHR's Free plan gives you records and HIPAA-compliant email on your own domain at no cost. If you already have an EHR you like, Hushmail or Proton gives you a secure standalone mailbox for under $12 a month.

If you're a group practice on Google or Microsoft, keep it. Accept the BAA, turn off services that aren't covered, and add Paubox or Virtru if clinicians regularly email clients. Make sure every clinician has their own login rather than sharing one.

If your team shares a front-desk address, look for proper shared inboxes with individual access. Our shared inbox comparison covers that separately.

Setup Checklist for Any HIPAA-Compliant Email

Whichever service you pick, these steps apply:

1. Sign the BAA before any client email goes through the account. Save a copy with your HIPAA records.
2. Move to your own domain. Set up SPF, DKIM and DMARC so your messages reach clients' inboxes. See our custom domain email guide.
3. Turn on two-factor sign-in for every account, and make sure you can revoke a lost phone without resetting everyone.
4. Decide your default for client email. Secure message or encrypted email for anything clinical; ordinary email only when the client asks for it and you've recorded that choice.
5. Write a one-paragraph email policy for your intake paperwork: what you'll send by email, what you won't, and how quickly you reply. Clients shouldn't treat email as a crisis line, so say where to go in an emergency.
6. Keep psychotherapy notes out of email entirely. Share summaries through a portal if needed.
7. File clinical emails on the chart so they're part of the record, not buried in an inbox.

For the day-to-day habits, see how to email patients securely.

Product Insight: Why ClinikMail Suits a Therapy Practice

ClinikMail is built around how therapists actually use email:

• HIPAA-compliant, covered by our BAA, with two-factor protection and every read in the audit trail.
• Secure by default for clients. A secure portal message is the default; ordinary email needs the client's recorded consent.
• A warning before sensitive detail leaves in plain text.
• Email on the chart. Link a thread to a client and later replies are filed there too.
• One address book built from your clients, CRM contacts and staff, with a warning before you email anyone who has opted out.
• Works with the Gmail app, Apple Mail or Outlook over IMAP, with a revocable app password for each device.
• AI that drafts and stops there. Nothing is sent without a person.

Pricing: Mail is on every plan, Free included. Pair it with online booking and ClinikForms for intake and consent, which runs inside ClinikEHR under the same BAA as the chart.

Frequently Asked Questions (FAQs)

1. What is the best HIPAA-compliant email for therapists?

It depends on where your records live. ClinikMail is our pick if you want email linked to the client chart at no extra cost. Hushmail and Proton are good standalone mailboxes, and Google Workspace or Microsoft 365 work if you accept their BAA and configure them properly.

2. Can a therapist use Gmail with clients?

Only a Google Workspace account with Google's BAA accepted in the Admin console, and configured properly. Google says customers who haven't signed the BAA must not use PHI in Workspace.

3. What's the cheapest HIPAA-compliant email for a solo therapist?

ClinikMail is $0 on ClinikEHR's Free plan. Among standalone services, Proton Mail Essentials is $6.99/user/month billed yearly, and Hushmail Healthcare Basic is $11.99/month for one account. Both offer a BAA.

4. Can I email clients without encryption?

HHS says the Privacy Rule doesn't prohibit unencrypted email for treatment-related communication if you apply reasonable safeguards, and that a client can ask to receive their records that way after a warning. This isn't legal advice, so check with your compliance advisor.

5. Is a patient portal better than email for therapy clients?

For anything clinical, usually yes: the client signs in to read the message, so it isn't sitting in their inbox. ClinikMail sends a secure portal message by default and keeps ordinary email for clients who have agreed to it.

6. Do I need a BAA if I'm a solo therapist?

If you're a HIPAA covered entity and your email vendor stores or transmits client PHI, you need a BAA with that vendor. Every service on this list offers one.

Conclusion

For most therapists, the right HIPAA-compliant email is the one that fits where your client records already live. A signed BAA is the minimum. After that, look at the price for your actual headcount, whether you can use your own domain, and how the service handles a client who emails something personal between sessions. Standalone services like Hushmail and Proton are affordable and secure, and Google or Microsoft work well with the right settings. If you'd rather have email, the client chart and the portal in one place, ClinikMail does that on every ClinikEHR plan.

Key takeaways:

• Get a signed BAA before any client email goes through the account
• Compare prices at your real headcount; some plans are priced for five users
• Use a secure message or encryption for anything clinical
• Record a client's preference if they ask for ordinary email
• ClinikMail is included free with ClinikEHR and covered by our BAA

Ready to try it? Start ClinikEHR free, compare our plans, or book a demo.

Disclaimer: Prices and BAA terms were checked on each vendor's website in September 2026 and can change. This article is educational and not legal advice; confirm HIPAA requirements with your compliance advisor. ClinikEHR and its authors shall not be held liable for any decisions made based on the information provided herein.

Related Articles

• HIPAA-Compliant Email for Healthcare Providers: 2027 Buyer's Guide
• Is Gmail HIPAA Compliant?
• How to Email Patients Securely
• 9 Best Tools to Run a Solo Therapy Practice in 2027
• How to Handle Client Emails Without Burnout
• HIPAA-Compliant Messaging 2027: Email vs Portal vs Secure Chat