Hushmail for Healthcare: HIPAA status
Encrypted email with secure web forms and e-signatures for healthcare. Every healthcare plan includes a BAA.
Signs a BAAYes
Hushmail for Healthcare signs a Business Associate Agreement. Included with all Hushmail for Healthcare plans.
Source: Hushmail — Pricing · checked
Hushmail for Healthcare and HIPAA at a glance
Hushmail for Healthcare signs a Business Associate Agreement. A BAA alone does not make its use HIPAA compliant: you still need to turn on two-step verification for each account. Facts checked against Hushmail's own documentation on 2026-10-05.
| Signs a BAA | Yes |
|---|---|
| Plans with a BAA | Healthcare Basic, Healthcare Essentials, Healthcare Growth |
| How you get it | Included with all Hushmail for Healthcare plans. |
| You still need to | Turn on two-step verification for each account. |
| Main limitation | Requiring two-step verification for all accounts is only available on the Healthcare Growth plan. |
| Last checked | 2026-10-05 |
BAA details
| Signs a BAA | Yes | Hushmail — Pricing |
|---|---|---|
| Plans that include a BAA | Healthcare Basic, Healthcare Essentials, Healthcare Growth | Hushmail — Pricing |
What you still have to configure
- Turn on two-step verification for each account. source
Limitations
- Requiring two-step verification for all accounts is only available on the Healthcare Growth plan. source
Against our criteria
| Encryption in transit | Yes — Uses OpenPGP and SSL. | Hushmail — Pricing |
|---|---|---|
| Encryption at rest | Yes — Messages are protected with OpenPGP encryption. | Hushmail — Pricing |
| Secure delivery to patients | Yes — Recipients open encrypted messages with their Google, Apple or Microsoft account and can reply securely. | Hushmail — Pricing |
| Enforceable MFA | Partial — Two-step verification on all plans; requiring it for everyone only on Healthcare Growth. | Hushmail — Pricing |
| Audit logs for customers | Not verified | Not verified yet |