Is Hushmail HIPAA compliant?
Only if you sign up on a Hushmail for Healthcare plan — the identically priced Small Business, Law and Personal plans are marked as not including a business associate agreement.
Applies to Hushmail for Healthcare and Hushmail for Professionals. Last reviewed against Hushmail's own documentation. Next review December 21, 2026.
Reviewed by Lisa Tran, CISSP — Healthcare Information Security Executive.
What you must do
- Sign up specifically under Hushmail for Healthcare. The pricing comparison marks the agreement as included on Healthcare Basic, Essentials and Growth.
- Hushmail for Professionals, the secure messaging plan, also lists the agreement as included.
- Enter your legal business name during signup — Hushmail uses it to create your agreement, so a personal name produces a document naming the wrong party.
- Sign the agreement during the signup flow, before any patient information passes through the account.
- US practices should confirm they received the business associate agreement rather than the Canadian Information Manager Agreement.
Does Hushmail sign a business associate agreement?
Yes. Hushmail offers one. Hushmail for Healthcare (Basic, Essentials or Growth), plus Hushmail for Professionals. Not on Small Business, Law or Personal plans. Choose a Hushmail for Healthcare plan at signup, enter your business name when prompted, and sign the agreement Hushmail presents during account creation.
What this means in practice
The whole question with Hushmail is which storefront you buy through. Hushmail sells parallel Basic, Essentials and Growth tiers to healthcare, small business and law customers, and its own comparison table marks the business associate agreement as included only on the healthcare line. A therapist who signs up on the Small Business tier gets a visually identical mailbox with no agreement standing behind it.
Signing is built into account creation rather than handled afterwards by a sales team. Hushmail asks for your business name at signup precisely because that name populates the agreement, so entering a personal name or leaving it vague produces a document that names the wrong party.
Location matters too. Hushmail issues US customers a business associate agreement and Canadian customers an Information Manager Agreement instead. And the personal plan is explicitly ruled out: Hushmail states it is not designed for healthcare or behavioral health practices and includes neither an archive nor either agreement.
How organizations get this wrong
The specific mistakes we see with Hushmail, not generic advice.
- Buying the Small Business or Law tier because the price matches — same mailbox, but Hushmail's own table marks the agreement as not included.
- Upgrading a long-standing personal Hushmail address instead of opening a healthcare account, leaving years of patient email outside any agreement.
- Typing a clinician's own name at signup rather than the practice's legal entity name, producing an agreement that names the wrong party.
- Assuming a Canadian signup yields a HIPAA agreement; Hushmail issues an Information Manager Agreement outside the US instead.
What the agreement does not cover
- Hushmail Small Business plans, which show 'No' against the agreement on all three tiers.
- Hushmail for Law plans, which likewise show 'No'.
- Hushmail for Personal Use, which Hushmail states is not designed for healthcare or behavioral health practices.
- Customers outside the US, who receive an Information Manager Agreement covering Canadian privacy law instead.
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Hushmail, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Hushmail’s own published documentation, read on the date shown.
- Hushmail for Healthcare — Hushmail. No publication date given. Read July 29, 2026.
- Pricing — Hushmail. No publication date given. Read July 29, 2026.
- How to enter your business name during signup — Hushmail. No publication date given. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Hushmail’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.