Proton Mail: HIPAA status
End-to-end encrypted email with zero-access encryption. Proton offers a HIPAA BAA to its users on request.
Signs a BAAYes
Proton Mail signs a Business Associate Agreement. Available to all Proton users on request: email privacy@support.proton.me with the subject "HIPAA BAA".
Source: Proton — Encrypted solutions for healthcare · checked
Proton Mail and HIPAA at a glance
Proton Mail signs a Business Associate Agreement. A BAA alone does not make its use HIPAA compliant: you still need to request and keep a signed BAA before any PHI goes into Proton, and send to patients who don't use Proton as password-protected emails; they open them in any browser with the password. Facts checked against Proton's own documentation on 2026-10-05.
| Signs a BAA | Yes |
|---|---|
| How you get it | Available to all Proton users on request: email privacy@support.proton.me with the subject "HIPAA BAA". |
| You still need to | Request and keep a signed BAA before any PHI goes into Proton. |
| Last checked | 2026-10-05 |
BAA details
| Signs a BAA | Yes | Proton — Encrypted solutions for healthcare |
|---|
What you still have to configure
- Request and keep a signed BAA before any PHI goes into Proton. source
- Send to patients who don't use Proton as password-protected emails; they open them in any browser with the password. source
Against our criteria
| Encryption in transit | Yes — End-to-end encrypted between Proton users; password-protected email for others. | Proton — Encrypted solutions for healthcare |
|---|---|---|
| Encryption at rest | Yes — Zero-access encryption: Proton cannot read stored mail. | Proton — Encrypted solutions for healthcare |
| Secure delivery to patients | Yes — Password-protected emails open in any web browser. | Proton — Encrypted solutions for healthcare |
| Enforceable MFA | Not verified | Not verified yet |
| Audit logs for customers | Not verified | Not verified yet |