HIPAA Compliant Email Providers: Who Signs a BAA

HIPAA compliant email providers are the ones that sign a business associate agreement (BAA) for the account you use: Gmail in Google Workspace and Outlook on Microsoft's Exchange Online come under Google's and Microsoft's BAAs, Paubox and Virtru say they sign one, Hushmail lists one on its Healthcare and Professionals plans, Proton publishes a BAA it signs on request, and Apple's iCloud terms bar protected health information. HHS lets providers email patients when they "apply reasonable safeguards when doing so" (HHS). Curve Compliance, which signs a BAA on every plan for HIPAA-compliant ad tracking, checked each provider's own page on October 26, 2026.

Book a call. Many practices that email patients also run ads, and an email BAA does not reach your ad tracking. Curve Compliance sends conversions to your ad platforms server-side, removes PHI before anything is sent to an ad platform, and signs a BAA on every plan. Curve's team does the setup. Book a call with Curve.

Which email providers sign a BAA?

Each row comes from the provider's own page, fetched October 26, 2026, and the rows are in no order of preference. A row marked Specific plans means the provider offers its BAA only on the plans or accounts named.

Provider	Signs a BAA?	Plans or accounts covered	How you get it	Source
Gmail (Google Workspace)	Specific plans	Google Workspace accounts; Gmail is on Google's list of covered services	An administrator accepts it electronically in the Admin console	Google Workspace Help; covered services
Outlook (Exchange Online)	Specific plans	Exchange Online in commercial and GCC Office 365 subscriptions; Outlook is one of the apps that connect to it	By default, through the Microsoft Online Services Data Protection Addendum	Microsoft Learn; Exchange Online
Microsoft 365 from GoDaddy	Specific plans	Microsoft 365 email from GoDaddy, with HIPAA compliant email activated	Activate HIPAA compliant email, then sign the Microsoft 365 HIPAA BAA	GoDaddy Help
Paubox	Yes	All accounts	Included with the account	Paubox
Virtru	Yes	Every package, from Starter up	Included in the package	Virtru; packages
Hushmail	Specific plans	Hushmail for Healthcare plans and Hushmail for Professionals, which both list a BAA among their features	Sign up for one of those plans	Hushmail; Professionals
Proton Mail	Yes, on request	Proton publishes its BAA for download	Contact Proton to have it signed	Proton
iCloud Mail	No	None; the iCloud terms bar covered entities and business associates from using iCloud for protected health information	Not offered	iCloud Terms and Conditions

Where a provider has a BAA Directory entry, its name links to it, with the vendor's own words. Google's and Microsoft's wider BAAs are in the Google Workspace and Microsoft 365 entries.

Provider by provider

Gmail. Google says Workspace and Cloud Identity customers subject to HIPAA "must enter a Business Associate Amendment (BAA) with Google," and "The HIPAA BAA is made available to customers for electronic acceptance via their Admin console" (Google). Gmail is on Google's list of Google Workspace supported services (Google).

Outlook. Microsoft says its HIPAA BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA," and its in-scope Office 365 table lists Exchange Online for commercial and GCC subscriptions (Microsoft).

Paubox. "Paubox includes a BAA with all accounts." It runs with your mailbox provider: "Paubox works with Google Workspace, Microsoft 365, and Microsoft Exchange. Be sure your email host provides a business associate agreement" (Paubox).

Virtru. Virtru says "Virtru has a BAA for HIPAA compliance" (Virtru). Its packages page lists a "Signed Business Associate's Agreement (BAA)" in the Starter package, and the higher packages include everything in Starter (Virtru).

Hushmail. Hushmail for Healthcare lists "Signed Business Associate Agreement (BAA)" among its features (Hushmail), and Hushmail for Professionals lists "Business Associate Agreement (BAA)" (Hushmail).

Proton Mail. Proton says "You can download our Business Associate Agreement here" and "Simply contact us if you need it signed" (Proton).

iCloud Mail. Apple's terms say a covered entity or business associate agrees "that you will not use any component, function or other facility of the Service to create, receive, maintain or transmit any “protected health information”" (iCloud terms). iCloud Mail is part of that service.

What HHS says about email

HHS answers the core question directly: "Yes. The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so." Its examples include "checking the e-mail address for accuracy before sending, or sending an e-mail alert to the patient for address confirmation prior to sending the message." HHS adds that "the Privacy Rule does not prohibit the use of unencrypted e-mail for treatment-related communications between health care providers and patients," but other safeguards should apply, "such as limiting the amount or type of information disclosed through the unencrypted e-mail" (HHS FAQ).

The Security Rule also applies to email that carries electronic PHI. Its transmission security standard says to "Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network," and it lists encryption as an addressable implementation specification: "Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate" (45 CFR 164.312). Addressable means your risk analysis decides how you meet it.

Patients can start the conversation. HHS says "Patients may initiate communications with a provider using e-mail," and the provider "can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual" (HHS FAQ).

Mailbox providers versus transactional email

Transactional email services send automated messages from your own systems, such as appointment reminders and form notifications. They are separate vendors from your mailbox provider, with their own answers:

Service	Signs a BAA?	What the vendor says	Source
Amazon SES	Yes, under the AWS BAA	AWS presents its BAA "for signature" in AWS Artifact, and "Amazon Simple Email Service (Amazon SES)" is on its HIPAA Eligible Services list, last updated October 15, 2026	AWS HIPAA; eligible services
Mailgun	Yes	Its HIPAA Addendum "is an addendum to the Mailgun Terms of Service," and notes the service may include "the transmission of plain text email in an unsecured fashion using the public internet"	Mailgun
SendGrid	No	"Twilio is not able to sign Business Associate Agreements for SendGrid"	Twilio
Postmark	No	"We also cannot sign any Business Associate Agreements around HIPAA."	Postmark

Personal accounts, add-ons and other gaps

• Personal accounts. Google offers its BAA to Workspace and Cloud Identity customers and says "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services" (Google). Patient email forwarded to a personal account leaves the BAA your organization signed.
• Add-ons. Google says "Third-party applications including add-ons are not included in the Included Functionality covered by the BAA" (Google).
• Your own setup. Microsoft says "using Microsoft services doesn't on its own achieve HIPAA compliance" (Microsoft). The BAA covers the provider's side; your settings, policies and risk analysis cover yours.
• Email marketing. Newsletters and nurture campaigns run through email marketing platforms, a separate set of vendors with their own BAA answers; see the BAA status of 12 email marketing platforms.
• Ad platforms. A lead list that leaves your inbox for Meta or Google Ads goes to a company outside your email BAA, and the BAA Directory lists Meta and Google Ads as not signing one. See which ad platforms sign a BAA and when an email address is PHI.

How to make your email HIPAA compliant

• Pick a covered account. Use a provider and plan from the table that signs a BAA, and sign it before any PHI goes in. Google says "Administrators must review and accept a BAA before using PHI in Google services" (Google).
• Decide on encryption. Encryption is addressable under 45 CFR 164.312, so your risk analysis documents how you protect email in transit.
• Apply HHS's safeguards. Check addresses before sending, confirm new addresses, and limit what goes into unencrypted email (HHS).
• Map every sender. List the tools that email on your behalf, such as forms and booking tools, and check each one's BAA answer. Which rules apply depends on your setup, so talk to your counsel.

How Curve Compliance helps

Your email BAA covers your mailboxes. Curve Compliance covers lead capture and ad tracking, under the BAA it signs on every plan. Curve Forms are hosted by Curve under that BAA, and every submission lands in the Leads inbox. Notification emails reach your team with Reply-to set to the respondent, and if you want notifications without patient details, Curve can send a fixed "A new submission is waiting" email that links to the inbox.

For ads, Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. For files rather than mail, see which cloud storage providers sign a BAA.

Sources, checked October 26, 2026: HHS FAQ on email with patients; HHS FAQ on treatment communications; HHS guidance on the right of access; 45 CFR 164.312; HIPAA Compliance with Google Workspace and Cloud Identity; Google's list of HIPAA covered services; Microsoft, HIPAA and the HITECH Act; Microsoft, Exchange Online; iCloud Terms and Conditions; Paubox Email Suite plans; Virtru HIPAA email; Virtru packages; Hushmail for Healthcare; Hushmail plans; Proton on HIPAA compliant email; AWS HIPAA Compliance; AWS HIPAA Eligible Services Reference; Mailgun HIPAA Business Associate Addendum; Twilio, Is SendGrid HIPAA Compliant?; Postmark, Is Postmark HIPAA Compliant?; GoDaddy, What is HIPAA and HIPAA compliant email?.

Frequently Asked Questions

Which emails are HIPAA compliant?

Email whose provider signs a BAA for your account, used with reasonable safeguards: Gmail in Google Workspace, Outlook on Exchange Online, Paubox, Virtru, Hushmail and Proton Mail offer a BAA, while iCloud does not. HHS allows email with patients when providers "apply reasonable safeguards when doing so" (HHS).

Is Outlook a HIPAA compliant email?

It can be when Outlook connects to Exchange Online in a commercial or GCC Office 365 subscription, which is in scope for the BAA Microsoft makes available by default through its Data Protection Addendum (Microsoft; Exchange Online). Microsoft adds that "using Microsoft services doesn't on its own achieve HIPAA compliance," so your own settings and policies still count.

Is virtru HIPAA compliant?

Virtru says "Virtru has a BAA for HIPAA compliance" (Virtru). HHS also expects reasonable safeguards and your own risk analysis (HHS).

How do I make my email HIPAA compliant?

Sign a BAA with a provider and plan that offers one before PHI goes in, decide on encryption in your risk analysis (45 CFR 164.312), check addresses and limit what goes into unencrypted email (HHS), and keep PHI out of personal accounts.

Is Gmail considered HIPAA compliant?

Gmail can be used with PHI inside Google Workspace once an administrator accepts Google's BAA; Gmail is on Google's covered services list (Google; covered services). Google's page describes the BAA for Workspace and Cloud Identity customers, not personal Gmail accounts.

Is it against HIPAA to email records?

No. HHS says providers may share PHI for treatment by e-mail with reasonable safeguards (HHS), and patients have a right to copies by e-mail; if a patient asks for unencrypted e-mail, the provider gives "a brief warning" about the risk and confirms the request (HHS).

Is there a safer alternative to Gmail?

Under HIPAA the question is whether a BAA covers the account: Gmail in Google Workspace is covered under Google's BAA, and secure email services such as Paubox, Virtru, Hushmail and Proton Mail say they offer a BAA too. Paubox says it "works with Google Workspace, Microsoft 365, and Microsoft Exchange," so it can work with an existing mailbox.

Do SendGrid or Amazon SES sign a BAA?

Amazon SES is on the AWS HIPAA Eligible Services list, covered once you accept the AWS BAA (AWS). Twilio says it "is not able to sign Business Associate Agreements for SendGrid" (Twilio).

Talk to Curve Compliance

Book a call. Your email BAA covers your mailboxes. Curve Compliance covers your ad tracking and lead forms under the BAA it signs on every plan, with conversions sent server-side and PHI stripped before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.