HIPAA-Compliant Email for Healthcare Providers: 2027 Buyer's Guide

HIPAA-compliant email for healthcare providers comes down to three things: a vendor that signs a Business Associate Agreement (BAA), settings that protect patient information, and a way of working that keeps unnecessary PHI out of email. Google Workspace and Microsoft 365 both offer a BAA. Paubox and Hushmail sell email built for healthcare. ClinikMail puts clinic email inside the EHR, covered by ClinikEHR's BAA. We checked every price and BAA statement below on the vendor's own site in September 2026.

Quick Answer

• Already on Google or Microsoft? Accept their BAA and configure the account properly. It's the cheapest route if you manage it well.
• Want encryption without changing providers? Paubox adds HIPAA-compliant email on top of Google Workspace or Microsoft 365.
• Solo practitioner who wants a standalone secure mailbox? Hushmail for Healthcare starts at $11.99/month for one account.
• Want email linked to the patient chart? ClinikMail comes with every ClinikEHR plan, Free included, and it's covered by our BAA.

What "HIPAA-Compliant Email" Actually Means

HHS says the Security Rule "does not expressly prohibit the use of email for sending e-PHI," but covered entities must assess how they protect it in transit, choose a solution and document the decision (HHS FAQ 2006, opened September 2026). There's no HHS-approved HIPAA certification for products either. What a vendor can do is sign a BAA and give you the controls. How your staff use those controls is what decides compliance.

When you compare vendors, check these six things:

1. A BAA that covers the email service you'll actually use.
2. Your own domain ([email protected]), not a free consumer address.
3. Access controls: two-factor sign-in, and a way to revoke a lost device.
4. Audit trail: a record of who opened what.
5. A safe patient-email path: encryption or a secure portal link, plus a documented approach for patients who ask for plain email.
6. Total cost for your whole team, including add-ons you'll need to close the gaps.

The 5 Options Compared (Prices Checked September 2026)

Sources: workspace.google.com/pricing, Google's HIPAA page, Microsoft 365 business plans, Microsoft HIPAA/HITECH, paubox.com/pricing, hushmail.com/pricing, all checked September 2026. ClinikEHR plans are priced per clinic, not per mailbox. For multi-user Hushmail pricing, check Hushmail's current terms.

Google Workspace

Google offers a BAA that a super administrator accepts under Account settings → Legal and compliance in the Admin console. Gmail is on Google's HIPAA Included Functionality list. Google also states that customers who haven't signed the BAA "must not use PHI." Third-party add-ons aren't covered, and some Google services have to be switched off for PHI users. We cover the whole setup in Is Gmail HIPAA Compliant?.

Best for: practices already on Google that have someone to own the configuration.

Microsoft 365

Microsoft says its HIPAA BAA is "available through the Microsoft Online Services Data Protection Addendum by default" to covered entities and business associates, and it lists Exchange Online as in scope. Microsoft is also clear that using its services "doesn't on its own achieve HIPAA compliance."

Best for: Outlook-based practices with IT support.

Paubox

Paubox's pricing page describes Paubox Email Suite as "everything you need to send HIPAA compliant emails with Google Workspace or Microsoft 365" and says "Paubox includes a BAA with all accounts." Each plan covers up to 5 senders, with a 14-day free trial. Budget for your Google or Microsoft subscription on top of Paubox.

Best for: practices that want to keep their current email and add encryption.

Hushmail

Hushmail's healthcare plans include a BAA, a custom domain, an email archive, and 10 GB (Basic) or 15 GB (Essentials and Growth) of storage per account. Healthcare Basic "does not include forms," Essentials adds forms, and Growth adds e-signatures.

Best for: solo practitioners who want one secure mailbox, separate from the EHR.

ClinikMail

ClinikMail is the email service inside ClinikEHR. It gives you real mailboxes on your own domain, shared inboxes, and threads you can link to the patient's chart. It's HIPAA-compliant and covered by our BAA.

Best for: clinics that want email, records and the patient portal in one place.

Worked Example: A 5-Person Clinic

Take a clinic with five staff who each need a mailbox, plus reception@ and billing@ as shared addresses.

• Workspace or Microsoft 365, entry tier: $7 × 5 users = $35/month on an annual commitment, before any encryption add-on. Check with the vendor how shared addresses are licensed.
• Paubox Standard on top: add $32/month (annual) for up to 5 senders.
• ClinikMail: the Free plan's 3 mailboxes cover a very small practice. Seven mailboxes fit in Essential ($99.90/month, 3 staff/providers included, then $40/month per extra clinician up to 5), and that price also covers the EHR itself: scheduling, notes, billing and the rest of the plan.

The fair comparison isn't mailbox against mailbox. It's the total cost of the tools you'd otherwise run side by side.

Matching the Option to Your Practice

The right choice depends less on the product than on who will look after it. Here's how the options line up for four common practice types.

Solo therapist or counselor. Email volume is low and you're the only sender. A single Hushmail for Healthcare account ($11.99/month, or $11/month billed yearly) or a Workspace account with the BAA accepted will both do the job, as long as you configure them. If you'd also like your scheduling, notes and patient portal in the same place as your email, ClinikMail on the Free plan gives you 3 mailboxes, 5 GB and your own domain at no cost.

Small group practice, three to five people. This is where per-user pricing starts to add up and where configuration gaps usually appear. Budget for five licences at the entry tier ($35/month on annual terms with Google or Microsoft), then decide whether you need an encryption layer such as Paubox on top. Be honest about who will manage users, devices and add-ons. If the answer is "whoever has time," choose the option with the fewest settings to get wrong.

Larger clinic, ten or more staff or several locations. Ten entry-tier Workspace or Microsoft 365 users cost $70/month on annual terms before any add-on. Paubox's published plans cover up to 5 senders, so check Paubox's current terms for a bigger team. Several locations often means several domains or brands, and ClinikMail's Team plan ($250/month) includes 50 mailboxes, 120 GB of storage and 10 domains of your own. Team includes 5 staff/providers, then $35/month per extra clinician.

Practice already deep in Microsoft. If your staff live in Outlook and Teams, the least disruptive route is usually to stay, confirm the BAA through Microsoft's Data Protection Addendum, and configure Exchange Online properly. Switching email providers is rarely worth it just to change the logo on the inbox.

Questions to Ask Every Vendor Before You Sign

Put these to each vendor in writing and keep their answers with your risk analysis:

1. Which services does your BAA cover, by name? Google and Microsoft both publish in-scope lists. If a feature you plan to use isn't on the list, treat it as uncovered.
2. How is the BAA accepted, and by whom? Google's is accepted by a super administrator in the Admin console, and Microsoft's is included by default through its Data Protection Addendum. Ask every other vendor exactly how theirs works and who on your side needs to accept it.
3. How are shared addresses like reception@ licensed? Ask whether a shared mailbox needs its own paid licence, because that changes the real monthly cost.
4. How do staff read mail on a phone, and can we cut off one device without resetting everyone?
5. Can we see who opened a patient's message?
6. What does a patient see when we send something sensitive? Ask to try it from a patient's point of view before you commit.
7. How do we leave? Find out how you'd export your mail if you change providers.

Common Buying Mistakes

The most common mistake is comparing sticker prices per user while ignoring shared addresses, encryption add-ons and the hours someone spends administering the account. The second is assuming that "encrypted" means "compliant"; encryption is one safeguard, and the BAA, access controls and your own policies matter just as much. The third is buying before you've decided how you'll email patients. Settle that first, using our guide on how to email patients securely, then pick the tool that makes your policy the easy path for staff.

Red Flags When Buying

• A vendor that won't sign a BAA, or charges extra for one without saying so up front.
• "HIPAA certified" claims. As Microsoft's own HIPAA page notes, there's no HHS-approved certification standard for HIPAA compliance.
• A shared inbox that really means one shared password.
• No way to revoke a single lost phone without resetting everyone.
• No record of who read a patient's message.

Product Insight: Why ClinikMail Fits a Clinic

ClinikMail is built for how clinics actually use email:

• HIPAA-compliant, covered by our BAA. Messages are private to your clinic, sit behind two-factor protection, and every read goes into the audit trail.
• Patient email done properly. A secure portal link is the default, and direct email needs recorded consent.
• Shared inboxes with assignment, "see who is replying," internal notes and shared labels.
• Chart linking. Link a thread to a patient and it shows on their timeline.
• Your domain, on every plan, set up with a guided DNS wizard.
• IMAP access for the Gmail app, Apple Mail or Outlook, with a separate app password for each device.
• An explainable spam filter. Uncertain mail is delivered with a caution chip rather than hidden.

See pricing, the CRM that feeds the ClinikMail address book, and ClinikReach for consent-aware campaigns.

Frequently Asked Questions (FAQs)

1. What makes email HIPAA-compliant?

A vendor that signs a BAA, safeguards like access controls, audit logs and protection in transit, and staff practices that limit what goes into email. No product is HIPAA compliant by itself.

2. Is Google Workspace or Microsoft 365 enough for HIPAA?

Both offer a BAA and can support compliance once configured. Microsoft states its services don't on their own achieve compliance, and Google says customers who haven't signed its BAA must not use PHI.

3. How much does HIPAA-compliant email cost?

As checked in September 2026: Google Workspace and Microsoft 365 from $7 per user/month on annual terms, Paubox from $32/month for up to 5 senders (annual, on top of your email host), and Hushmail from $11.99/month for one account. ClinikMail is included on every ClinikEHR plan, Free included.

4. Do Paubox and Hushmail sign a BAA?

Their pricing pages say so. Paubox includes a BAA with all accounts, and Hushmail lists a BAA on all three healthcare plans.

5. Do I need encrypted email to message patients?

HHS allows unencrypted email with reasonable safeguards, and patients can ask for it once they've been warned of the risk. A secure portal link is the safer default for clinical detail.

6. Is ClinikMail covered by a BAA?

Yes. ClinikMail is HIPAA-compliant and covered by ClinikEHR's Business Associate Agreement.

Conclusion

Any of these five can be part of a HIPAA-compliant setup. What separates them is who does the configuration work, what the whole team costs, and whether email stays cut off from the patient record. If you're already on Google or Microsoft and have someone to manage it, their BAA is a reasonable start. If you want email that's covered, configured and linked to the chart from day one, ClinikMail does that inside ClinikEHR.

Key takeaways:

• Get a BAA that covers the email service you actually use
• Compare the total cost for the whole team, including add-ons
• Check shared inboxes, per-device revocation and audit trails before buying
• Paubox layers on top of Google or Microsoft, while Hushmail stands alone
• ClinikMail is included on every ClinikEHR plan and covered by our BAA

Ready to compare it for yourself? Try ClinikEHR free, see our pricing, or book a free demo.

Disclaimer: Prices and terms were checked on each vendor's website in September 2026 and can change, so confirm current terms with each vendor. This article is educational and not legal advice. ClinikEHR and its authors shall not be held liable for any decisions made based on the information provided herein.

Related Articles

• Is Gmail HIPAA Compliant? What Clinics Must Do in 2027
• How to Email Patients Securely (2027)
• 7 Best Patient Communication & Secure Messaging Tools in 2027
• How Small Clinics Can Simplify Compliance