Best HIPAA Compliant Email for Therapists: Mailbox or Encryption Add-On?

Product and shape	What you buy	BAA and covered-account question	Outside recipient path	Who it fits
Google Workspace with a BAA	Hosted mailbox on your practice domain	Accept Google’s BAA and confirm each service you will use is covered	Test the message, reply, and attachment to the address a client actually uses	You already run Workspace and want to retain that domain and admin console
Microsoft 365 with the Microsoft DPA/BAA	Hosted mailbox on your practice domain	Confirm Exchange Online and every additional service in your workflow are in scope	Test the message, reply, and attachment from a non-Microsoft address	You already run Microsoft 365 and want to retain that tenant and admin model
Paubox Email Suite	Encryption add-on for Google Workspace or Microsoft 365	Keep the mail-host agreement separate from the Paubox agreement. Paubox says it includes a BAA with accounts	Paubox says recipients do not need a portal or password. Test your real outside-recipient case	You want to keep the existing host and reduce recipient friction
Hushmail Healthcare	Hosted secure mailbox, custom domain, or current-email option	Confirm the account type and the agreement for the feature set you will use	Hushmail describes secure replies and encrypted attachments. Test the recipient’s route	You want Hushmail to host the mailbox or want its secure-message workflow
Proton Mail Business	Hosted secure mailbox	Confirm current HIPAA offering, BAA availability, plan scope, and attachment workflow directly with Proton before placing PHI there	Test the recipient invitation, reply, and attachment on the plan you will buy	You want to evaluate a privacy-focused hosted mailbox and can confirm the current contract scope

Vendor facts are based on Google Workspace pricing and BAA documentation, Microsoft HIPAA and HITECH documentation, Paubox pricing, Hushmail pricing, and Proton’s therapist-email guide, checked November 2026. Terms, plans, and recipient flows can change. Confirm the live account and written agreement before you send client content.

Before you compare documentation tools, see how Emosapien works. It is not an email product and it is not the product compared here.

Make your delivery choice

The best hipaa compliant email for therapists depends on the account, agreement, and recipient path the practice can actually administer. Use this comparison to choose a delivery setup for one-to-one client email, not a bulk-email platform or a clinical record. A hosted secure mailbox replaces or hosts the inbox. An encryption add-on works beside a mail host you already use. First decide whether your practice keeps the domain and inbox it already administers or moves to a new hosted mailbox. Then write down the account, agreement, recipient steps, attachment route, retention setting, export path, and full recurring cost. Finally, run the same harmless fictional message through the finalists before any client content moves.

The first four columns identify a product category. They do not clear a send decision. Use the HIPAA compliant email for therapists decision card for the law, client-choice, and send-or-stop questions before any real client message leaves.

Choose the inbox you will own

Keep your existing domain and mailbox when you can name the host, the administrator, the BAA path, and the exact services your practice will use. Google says its BAA must be accepted and only covered services should carry protected health information. Microsoft says its BAA applies to in-scope services through its data-protection terms. Neither statement means every feature, setting, or recipient route is automatically appropriate for your workflow.

Choose an add-on when the existing host remains the mailbox you want to administer. Paubox is not a mailbox replacement. It works with Google Workspace or Microsoft 365, so your account cost has at least two parts: the mail-host licenses and the add-on. Ask which account holds the archived message, which account can export it, and which agreement applies if a client reply arrives after the add-on processes an outbound message. For the best hipaa compliant email for therapists, that two-account answer must be documented before you send.

Choose a hosted secure mailbox when you want the email provider to supply the inbox and its secure-message experience. Hushmail offers new addresses, custom-domain hosting, and a current-email option. Those are not interchangeable setups. Ask the vendor to show which one you are buying, how your domain is administered, and what a departing clinician leaves behind.

Price the full account, not the headline plan

A cheap mailbox is not the account cost if you add an encryption service, archive, domain service, extra administrator, or a required retention tier. Promotional prices and regional checkout prices move, so write the current checkout amount rather than copying an old review-site number.

Cost line	Hosted secure mailbox	Existing host plus encryption add-on
Mailbox license	The secure-mail provider’s per-user plan	Google Workspace or Microsoft 365 per-user plan
Encryption service	Included only if the SKU says it is	Add-on subscription, separate from the host
Domain and migration	Domain, DNS, migration, aliases, and any setup fee	Usually retain the current domain, but price any migration or admin work
Retention and archive	Ask whether retention, export, and archive are in the plan or an add-on	Price host retention or archive separately from the add-on
Additional users	Price clinicians, delegates, and shared-role accounts separately	Price host seats and add-on seats separately

Fill one number on every line. If a vendor does not publish a number for your account, write “quote only.” Do not turn a free trial, introductory offer, or a single mailbox price into the cost for a two-clinician practice.

Run one outside-recipient acceptance test

Do not use a client or a real chart excerpt. Open a trial account and run the same fictional message through each finalist. The point is not to declare that you tested the product. The point is to give you an acceptance sheet your practice can actually complete. That test is how you decide which option is the best hipaa compliant email for therapists in your own workflow.

Do not fill the result from a sales claim. Fill it after you run the test. If a client needs a portal, an identity step, or a password, you need to see that experience before you choose it. If the add-on promises a frictionless outside recipient, send the attachment and make the reply arrive before you rely on that promise.

Separate agreements, admin ownership, and offboarding

For a hosted mailbox, ask who can add a delegate, remove a delegate, suspend a departing clinician, preserve the mailbox, and export the account. For an add-on, ask those questions twice: once for the mail host and once for the encryption provider. A BAA with one company does not explain what another company stores or processes.

Admin question	Evidence you need before purchase
Who owns the domain and tenant	Named practice owner, recovery contact, and administrative login
Who can read a shared or delegated inbox	Role list and the least-privilege setting you will use
What happens when a clinician leaves	Suspend, forward, preserve, and remove-access sequence with timing
How long mail is retained	Written retention setting and any archive tier that supports it
How messages leave the system	Export format, export role, and whether attachments remain linked
Where chart-worthy material goes	Approved destination in your clinical record, not an informal mailbox folder

Treat this table as an operating check, not legal advice. Your privacy adviser or counsel can help with the contract and retention questions that apply to your organization.

Run the account-ownership test before migration

Email changes fail during an ordinary staffing change, not during the polished sales demo. Ask the person who will administer the system to complete this short test while the trial is open. The best hipaa compliant email for therapists is the setup the practice can still administer when one person leaves.

1. Create a fictional clinician account and give it only the role a clinician needs.
2. Create a fictional office administrator account and confirm it has only the access the job requires.
3. Send the harmless acceptance-test message to an outside address, then have the fictional recipient reply with the same harmless attachment.
4. Suspend the fictional clinician. Confirm that the practice, not the departed clinician, retains the mailbox, messages, and domain administration.
5. Export the fictional thread and attachment. Open the export on a practice-controlled device and write down the format and the person authorized to do it.
6. Delete or revoke the fictional delegate. Confirm that the prior delegate can no longer open the mailbox.

The test gives you evidence for your operating procedure. It does not replace your own risk analysis, workforce training, access controls, or the send-or-stop decision for a particular message. Keep the scope narrow: this is the email lane. Your clinical record, billing system, and any portal you use are separate systems with their own ownership and retention decisions.

Write the results in a place the practice can find during offboarding. A vendor support article is not your procedure. Your procedure identifies the named tenant owner, recovery contact, security administrator, and clinical owner for the account. If those names are blank, delay the migration rather than creating an inbox only one clinician can recover.

Decide where chart-worthy content belongs

Before you turn on a new mailbox, agree on a small rule for messages that change clinical work. A scheduling confirmation can remain a scheduling confirmation. A message that changes a plan, records a material client request, or documents an action you need to remember should follow the process you use for the clinical record. Do not rely on a search result in an email archive as the only way to reconstruct the care decision.

That rule also keeps a former clinician’s account from becoming the only place a practice can find important context. It is an operations rule, not a reason to duplicate every email into the record. Have the clinician decide what is chart-worthy under the practice policy, then place the appropriate information in the approved destination.

Keep email delivery separate from the clinical record

Email is not automatically the clinical record. If a message contains information used to make a clinical decision, follow your approved process for placing the appropriate information in the record you maintain; the mailbox’s encryption does not decide that question. Do not make your inbox the only place a clinical fact lives.

The same separation applies to note drafting. Emosapien drafts therapy notes from the session for the clinician to review and sign. It does not send client email or replace the record you maintain. Where session documentation is the question, see how notes are drafted and reviewed.

References

• U.S. Department of Health and Human Services. Business associate contracts.
• 45 CFR 164.502(e), business associate disclosures.
• Google Workspace. Google Workspace BAA documentation and pricing page, checked November 2026.
• Microsoft. Microsoft HIPAA and HITECH compliance documentation, checked November 2026.
• Paubox. Paubox pricing page, checked November 2026.
• Hushmail. Hushmail pricing page and behavioral-health email page, checked November 2026.
• Proton. Proton guide to HIPAA compliant email for therapists, checked November 2026.