Hushmail vs Proton Mail for HIPAA Email: Which Fits a Practice?

If you are comparing Hushmail vs Proton Mail for HIPAA email, the first thing to know is that the old answer has expired. For years the short version was "Hushmail signs a business associate agreement and Proton does not." That is no longer true. As of September 2026, both vendors state on their own sites that they will sign a BAA.

That changes the shape of the decision. When only one vendor offered the paperwork, the paperwork was the comparison. Now that both do, you are choosing between two genuinely different products on unglamorous dimensions: how patients send you information, what happens to mail after it is read, and who on your staff can see what.

This post compares them on those dimensions, and explains why encryption on its own does not make an email account HIPAA compliant — the assumption that gets small practices in trouble more often than any vendor choice does.

The verdict up front#

For a solo therapist, a small clinic, or any practice where patients fill in forms before they arrive, Hushmail is the better fit. Its healthcare plans bundle the things a clinical workflow actually runs on — encrypted web forms with e-signature fields, a built-in archive marketed as audit-ready, and a BAA you are prompted to sign during signup rather than one you have to go and ask for.

For a practice with several staff, shared administration, and an IT person who cares about certifications, Proton Mail is the better fit. It is end-to-end encrypted between Proton accounts by default, it publishes ISO 27001 certification and a SOC 2 Type II audit, and its business plans give you a central admin panel and organisation-wide data retention rules.

Neither is wrong. The mistake is choosing on encryption strength, which is the dimension both vendors market hardest and the one least likely to decide whether a practice passes an audit.

Hushmail vs Proton Mail at a glance#

The table below compares the dimensions HIPAA readiness actually turns on, rather than cipher suites. Every row was checked against the vendor's own pages in September 2026.

Encryption is not compliance#

This is the single most expensive misunderstanding in this category, so it is worth being blunt. HIPAA does not say "use encrypted email." It sets out administrative, physical and technical safeguards, and it requires a signed business associate agreement with any vendor that handles protected health information on your behalf.

An email service can be flawlessly encrypted and still leave you non-compliant, because encryption addresses one technical safeguard and says nothing about the rest. Access control, audit logging, retention, workforce training, a risk analysis, and breach notification procedures are all your obligations, and most of them are about how your practice operates rather than which product you bought.

The inverse is also true and equally important: a signed BAA does not make you compliant either. It makes the vendor accountable for their side. The configuration, the staff behaviour, and the documentation are still yours.

Where Hushmail wins#

Hushmail's real advantage is not the mail — it is everything wrapped around the mail. A clinical practice does not just exchange messages with patients. It collects intake histories, consent forms, insurance details and signatures, and all of that is protected health information the moment a patient types it.

Hushmail's healthcare plans include secure web forms you can embed on your site, send as a link, or attach to an email, with healthcare templates and e-signature fields. Submissions arrive encrypted in your mailbox. Without this, a practice stitches in a separate forms vendor — a second BAA, a second integration, a second thing to review each year.

The second advantage is the archive. Hushmail markets a built-in archive explicitly for HIPAA audit readiness, retaining a record of mail sent and received. A practice reconstructing a communication history months later, for a records request or an audit, will find that far easier than digging through individual mailboxes.

Third, the BAA is part of onboarding rather than a support ticket. You are prompted to sign one when you set up a healthcare account. That sounds minor. It is not: the most common compliance gap in small practices is not a missing feature, it is a BAA nobody got around to executing.

The honest limit is scale. Hushmail is built around small practices and is not trying to be your identity provider or document platform. Run twenty staff with role-based access needs and you will feel the ceiling.

• Encrypted patient intake forms with templates, on the form-bearing tiers
• Legally binding e-signature fields inside those forms
• A built-in archive positioned for audit readiness
• A BAA presented during signup on healthcare plans
• Support by email and phone on every plan

Where Proton Mail wins#

Proton's advantage is the security architecture and the evidence for it. Mail between Proton accounts is end-to-end encrypted by default, meaning Proton cannot read the contents. For a practice whose threat model includes the provider itself, that is a stronger position than transport encryption plus provider-held keys.

Proton also publishes what a security reviewer will ask for: ISO 27001 certification and a SOC 2 Type II audit are stated on its business pages, and the model business associate agreement is public. Handing a compliance officer a document rather than a marketing claim shortens procurement considerably.

Proton Mail for Business gives you a central admin panel for users, permissions and storage, plus organisation-wide data retention rules that can differ by team. That is the closest analogue to Hushmail's archive, though it is a policy engine rather than a searchable audit archive — a distinction worth confirming against your own retention obligations.

Proton Mail Bridge is the other practical win, connecting Outlook, Apple Mail and Thunderbird over IMAP and SMTP, so staff who will not give up their mail app do not have to. Hushmail is primarily webmail plus a mobile app.

The honest limit is the workflow gap. Proton offers no secure intake forms and no e-signatures. If patient paperwork is central to your practice, you are buying a second product and a second BAA — a real cost, not a footnote.

• End-to-end encryption by default between Proton accounts
• ISO 27001 certification and SOC 2 Type II audit stated publicly
• A publicly published model BAA you can read before buying
• Central admin panel and organisation-wide retention rules
• Bridge support for Outlook, Apple Mail and Thunderbird

How the two handle a patient on ordinary email#

Most patients do not have an encrypted mailbox. They have Gmail, Outlook or whatever their phone came with, and how a provider handles that recipient is where the two differ in daily use.

Hushmail routes the message into a secure message centre the recipient opens with a passphrase you agreed with them. Proton sends a password-protected message with an optional expiry date. Both keep content off unencrypted transport, and both ask the patient to do something extra.

Test both against your least technical patient before committing. A secure channel patients refuse to use gets abandoned for plain email within a fortnight, and that is a far worse outcome than either product's ergonomics.

Pricing model, and why you have to check it yourself#

The two vendors are packaged differently, which matters more than any headline number. Hushmail sells flat per-plan tiers organised by vertical, with the healthcare line being the one that carries the BAA — the business and personal lines do not. Proton sells per-user business plans, with the BAA available on request.

That difference changes how cost behaves as you grow. A flat per-plan tier is predictable for a solo practitioner and gets awkward when you add clinicians. A per-user plan scales linearly and is easier to reason about for a team, but it charges for the receptionist's mailbox too.

We are not printing prices here, deliberately. Pricing in this category changes without announcement, and a stale figure in a blog post is worse than no figure — it makes a reader budget wrong. Check the live pricing page on each vendor's own site, and confirm specifically that the tier you are pricing is one that includes the BAA. On Hushmail that means a healthcare plan; on Proton, confirm the BAA request process applies to the plan you are buying.

Who each one is genuinely for#

Match the product to how your practice actually operates, not to which vendor has the better security page.

Choose Hushmail if you are a solo therapist, a small clinic, or a practice where patient paperwork is a daily workflow. The forms and e-signatures are the reason to be there, the archive covers a real obligation, and the BAA is handled at signup rather than left to a future you who forgets.

Choose Proton Mail if you have several staff, want end-to-end encryption by default, need central administration, or have a security reviewer who will want certifications and an auditable agreement. Accept that intake forms are a separate purchase and budget for the second BAA.

Choose neither if you have already standardised on Google Workspace or Microsoft 365 and can execute a BAA there. Both platforms will sign one for the appropriate plans, and moving an entire practice to a new mail provider for compliance reasons you could satisfy where you already are is a large amount of disruption for very little gain.

A third option, honestly#

There is a category of tool that sits above whichever mailbox you choose: an AI email client that connects to your existing accounts and handles triage, drafting and follow-up. We build one of those — AI Emaily — and this is the point in the comparison where a reader reasonably asks whether it belongs in the decision.

For HIPAA-covered communication, it does not, and we are going to say that plainly rather than hedge it. AI Emaily does not sign a business associate agreement and is not marketed for use with protected health information. If the mail you are triaging contains PHI, we are not the right tool, and no configuration changes that.

Where a practice does use it is the other side of the inbox — the mail that is not clinical. Referral partners, vendors, billing companies, recruiters, the local chamber of commerce, the twenty newsletters that accumulated over a decade. That is most of the volume in a small practice's mailbox and none of it is protected health information. AI Emaily connects to Gmail, Outlook and IMAP accounts, triages that traffic, and drafts replies you approve before anything sends.

The controls are the part worth naming, because they are the same controls that make the HIPAA answer clear. Nothing sends without your approval in Copilot mode, every action the agent takes is recorded in an audit log, actions can be undone, and we do not train models on user mail. Voice matching comes from a Personal Context brain you fill in yourself plus per-client profiles you set — not from reading your sent folder.

So the honest position is a boundary, not a pitch: keep clinical mail in the provider you just chose under its BAA, and if the non-clinical half of your inbox is eating your afternoons, that is the half we can help with.

Before you commit, do these four things#

1. 1

   Read the actual BAA, not the page describing it

   Both vendors will give you the agreement. Read what it covers, what it excludes, and which services it applies to. A marketing page saying a BAA is available is not the agreement.

2. 2

   Confirm the plan you are buying is the one that carries it

   On Hushmail the BAA rides on the healthcare plan line specifically. On Proton, confirm the request process applies to your plan before you pay for a year.

3. 3

   Test the patient-facing path with a real person

   Send a secure message to someone non-technical on Gmail and watch them open it. A secure channel patients will not use is worse than no secure channel, because staff route around it.

4. 4

   Write down your retention answer

   Decide how long you must keep clinical email and check the product can actually do it. Hushmail's archive and Proton's retention rules solve related but different problems, and your state may impose a longer period than you expect.