Best Email Software for Therapy Practices (2026 Buyer Guide)

Search for the best email software for therapy practices and you get two piles that never quite meet: enterprise HIPAA-email roundups written for hospital IT, and AI inbox tools written for salespeople. Neither describes your day — a solo or small practice fielding new-client inquiries, insurance panel mail, and scheduling threads with no front desk behind the reply.

The first reply carries weight. A prospective client who emails on Sunday night is deciding whether you are reachable; a slow, generic answer sends them to the next name on their list. But some of what lands in that same inbox — a claim question, a client describing symptoms — is protected health information (PHI), and the rules about who may touch it are strict.

So this guide splits the problem in two. One job is managing the volume of inquiry, scheduling, and administrative mail. The other is transmitting clinical information safely. Different tools win each, and a few pretend to do both.

One disclosure up front: we build AI Emaily, and it is our pick for the first job — not the second. No competitor prices, ratings, or review counts appear here; both would be wrong by renewal.

The short answer: our top pick, and where it stops#

For the front-desk job — triaging and drafting the flood of prospective-client inquiries, scheduling, and non-clinical admin mail that no receptionist is handling — AI Emaily is our pick. It connects to your existing Gmail, Outlook, or IMAP mailbox, sorts what needs a reply now, and drafts in your voice, with your approval required before anything sends.

AI Emaily does not sign a Business Associate Agreement (BAA), so it is not a HIPAA-compliant home for clinical mail. For sending and receiving PHI, the honest picks are purpose-built or made compliant: Paubox and Hushmail for Healthcare, or your existing suite with a signed BAA — Google Workspace or Microsoft 365 — or Proton Mail's business plan. Most practices run one of each: an AI layer on the inquiry inbox, a BAA-covered channel for anything clinical.

The sections below rank both categories, explain what HIPAA actually asks of a therapy inbox, and show how to route mail so the two never cross.

How we compared these tools#

We did not put these on a bench test. We compared them on documented capabilities that decide fit for a therapy practice, checked against each vendor's own pages in August 2026. Packaging and terms move, so verify the live page before you buy.

• BAA: will the vendor sign one, and on which plan — the single gate for any mailbox that carries PHI.
• Encryption: how mail is protected in transit, and whether recipients need a portal or password to read it.
• Triage and drafting: does it sort a busy inbox and write replies, or only store mail.
• Control: approval before send, undo, and an audit trail of what an AI did on your behalf.
• Provider coverage: whether it works with the Gmail, Outlook, or IMAP mailbox you already use.
• Data use: whether the vendor trains AI models on your mail.
• Packaging shape: free tier, trial, per-seat, or per-account — described, not priced.

What HIPAA actually requires of a therapy inbox#

HIPAA does not ban email. The HHS Office for Civil Rights says the Privacy Rule lets health care providers communicate with patients by email, including about treatment, as long as they apply reasonable safeguards — checking the address before sending, and limiting how much is disclosed in an unencrypted message. Unencrypted email is not prohibited for provider-patient treatment communication, but ePHI you transmit still has to meet the Security Rule.

Whether the rules bind you at all turns on a detail many therapists miss. You are a HIPAA covered entity only if you transmit health information electronically in connection with a standard transaction — an electronic insurance claim is the common one. HHS is explicit that using email does not by itself make you a covered entity; the standard transaction is the trigger. A strictly cash-pay practice that files no electronic claims may sit outside HIPAA — though state law and professional ethics still apply.

When you are covered, any vendor that creates, receives, maintains, or transmits PHI for you is a business associate, and you need a signed BAA with it before PHI flows. Behavioral health carries two extra layers: HIPAA gives psychotherapy notes heightened protection and expects them kept separate from the rest of the record, and substance use disorder records at federally assisted programs fall under a stricter federal rule, 42 CFR Part 2, administered by SAMHSA.

Comparison table#

1. AI Emaily — the front-desk layer, not a PHI host#

We build AI Emaily. It is an AI email client that connects to the Gmail, Outlook, or IMAP mailbox you already have — no migration, and you keep your address. For a practice with no receptionist, it does the front-desk reading: it triages the inbox so prospective-client inquiries and time-sensitive scheduling rise to the top, and it drafts replies in your voice.

That voice comes from a Context brain and per-client profiles you set — not from scanning your sent mail — so you decide how a first reply to a nervous new client should read. Every draft waits for your approval before it sends (Copilot mode), with undo and an audit trail of what the assistant did. Autonomy is dialable from fully manual up to gated Autopilot, and AI Emaily does not train models on your mail. It runs on the web, as downloadable macOS and Windows apps, and a native iOS app, with an Android home-screen app; there is no Linux build.

The limit is the important part on this page: AI Emaily is not a HIPAA-compliant email host and does not sign a BAA. So it is not where clinical PHI belongs. Run it on the inbox that fields prospective-client inquiries, scheduling, and non-PHI admin — the receptionist work — and route clinical mail through a BAA-covered channel below.

If you bill insurance electronically you are likely a covered entity, so keep PHI-bearing insurance correspondence in that channel too. Packaging is free-to-start with paid tiers; check our pricing page for current terms.

2. Google Workspace (Gmail) with a signed BAA#

If your practice already lives in Gmail, the compliant path is a paid Google Workspace account with the HIPAA BAA accepted from the Admin console — Gmail is on Google's HIPAA Included Functionality list. That makes it a reasonable home for clinical email, and it pairs with automatic-encryption add-ons if you want recipients to read mail without a portal.

Two cautions. A free consumer @gmail.com account is never covered by a BAA, so it cannot lawfully hold PHI for a covered entity. And the BAA only covers Google's listed services with the right settings — third-party add-ons and some features sit outside it. Packaging is per-user, with monthly and annual billing.

3. Microsoft 365 (Outlook) with a signed BAA#

For Outlook and Exchange practices, Microsoft includes a HIPAA BAA by default in its standard online terms for eligible business and enterprise customers, and Exchange Online is an in-scope service. You do not sign a separate document; the BAA rides on the Microsoft Online Services Data Protection Addendum, and the agreement is available through Microsoft's Service Trust Portal.

As with Google, the free consumer side — Outlook.com — is not covered, and only the covered services configured correctly fall under the BAA. This is the natural fit if your billing, calendar, and documents are already in Microsoft 365. Packaging is per-user with monthly and annual plans.

4. Paubox — HIPAA email that encrypts by itself#

Paubox is built for one job: HIPAA-compliant email that does not ask your clients to log into a portal. Every Paubox plan includes a signed BAA, and outbound mail is encrypted in transit with TLS by default, so a client opens your message in their normal inbox with no extra password.

It layers onto Google Workspace or Microsoft 365 rather than replacing your mailbox, which suits a practice that wants strong PHI email without changing its address or workflow. There is no free tier; packaging is subscription, sold per account. This is a good clinical channel to sit alongside an AI triage layer on the inquiry inbox.

5. Hushmail for Healthcare — email plus intake forms#

Hushmail for Healthcare is aimed squarely at small practices and therapists. The plan includes a signed BAA and bundles encrypted email with secure, e-signable web forms and a private message center — so intake paperwork and client email live in one HIPAA-covered place, with ready-made templates for mental health work.

For a solo counselor who wants the paperwork and the secure inbox from a single vendor, that bundling is the draw. Packaging is per-account, sold as solo and small-group plans; verify current tiers on Hushmail's site. Like Paubox, it is a clinical channel, not an AI triage tool.

6. Proton Mail (Proton for Business)#

Proton is the privacy-first option. Proton for Business offers a HIPAA plan, and Proton will provide a signed BAA on request. Its selling point is end-to-end and zero-access encryption from Swiss-based servers, meaning Proton itself cannot read stored mail — a strong posture for sensitive behavioral-health content.

The trade-off is workflow: end-to-end encryption is smoothest between Proton users, and reaching outside clients securely uses password-protected messages rather than transparent delivery. If encryption depth matters more to you than a familiar Gmail-style client, this is the pick. Packaging is per-user with monthly and annual billing. We publish a fuller side-by-side on our AI Emaily vs Proton page.

7. Shortwave — AI triage, but keep PHI off it#

Shortwave is an AI-native client for Gmail from ex-Google engineers, with strong semantic search and AI triage and drafting — the closest competitor to AI Emaily for the front-desk job. If your inquiry inbox is on Gmail and you want fast AI search over it, it is worth a look.

On HIPAA, Shortwave does not publish a BAA offering; its security page lists SOC 2 Type II and GDPR and points HIPAA questions to its support team. So treat it the same way you treat AI Emaily: fine for a non-PHI inquiry inbox, not a home for clinical mail until you confirm a BAA in writing. Packaging is subscription; verify the current tiers and any free plan on Shortwave's own page.

8. Front — a shared inbox for group practices#

Front is a shared-inbox platform rather than a personal client, built for teams that answer from a common address. For a group practice with an office manager and several clinicians, that shared queue — with assignment and internal comments — can be the front desk.

Front will enter into a BAA, but it reserves that for customers whose annual contract meets a threshold, and the BAA covers only the features it names as included functionality; you have to keep PHI and non-PHI inboxes organized accordingly. That makes it a heavier fit for a solo therapist than for a staffed group. Packaging is per-seat across Starter, Professional, and Enterprise tiers, with AI features as paid add-ons on the lower tiers.

How to choose for your situation#

Start with one question: are you a covered entity? If you bill insurance electronically, you almost certainly are, and any tool that touches clinical mail needs a signed BAA. If you are strictly cash-pay and file no electronic claims, HIPAA may not bind you — but a client's mental-health details are sensitive regardless, and state law and your licensing board still set duties.

Then run two lanes, not one. Give prospective-client inquiries, scheduling, and non-clinical admin their own address and put the AI triage layer there — that is the receptionist work AI Emaily is built for. Keep anything clinical, plus insurance correspondence that quotes patient detail, in a BAA-covered channel such as Paubox, Hushmail for Healthcare, or your Workspace or Microsoft 365 with the BAA accepted. The two lanes should never merge, because a triage tool without a BAA reading a PHI-bearing message is itself a disclosure.

For a solo counselor, the lightest workable stack is a HIPAA email service for clinical mail plus an AI layer on a separate inquiry inbox. A group practice with staff may prefer a shared inbox for the front desk, with the same clinical channel behind it.

Set up the two lanes#

1. 1

   Split the addresses

   Publish a general inquiry address (hello@ or info@) for prospective clients and scheduling, kept separate from the address that receives clinical and claim mail.

2. 2

   Sign a BAA for the clinical lane

   Stand up a HIPAA email service — Paubox, Hushmail for Healthcare, or Workspace or Microsoft 365 with the BAA accepted — and confirm the signed BAA is in place before any PHI moves through it.

3. 3

   Add the AI layer to the inquiry lane only

   Connect an AI triage and drafting tool to the inquiry inbox, not the clinical one, so no PHI is processed by a vendor that has not signed a BAA.

4. 4

   Keep replies with PHI in the compliant channel

   When a reply needs to quote a diagnosis, claim, or session detail, compose and send it from the BAA-covered service, not the AI-assisted inquiry inbox.