Is Hushmail HIPAA compliant?
Only if you sign up on a Hushmail for Healthcare plan: the identically priced Small Business, Law and Personal plans are marked as not including a business associate agreement.
Applies to Hushmail for Healthcare and Hushmail for Professionals. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Sign up specifically under Hushmail for Healthcare. The pricing comparison marks the agreement as included on Healthcare Basic, Essentials and Growth.
- Hushmail for Professionals, the secure messaging plan, also lists the agreement as included.
- Enter your legal business name during signup: Hushmail uses it to create your agreement, so a personal name produces a document naming the wrong party.
- Sign the agreement during the signup flow, before any patient information passes through the account.
- US practices should confirm they received the business associate agreement rather than the Canadian Information Manager Agreement.
Does Hushmail sign a business associate agreement?
Yes. Hushmail offers one. Hushmail for Healthcare (Basic, Essentials or Growth), plus Hushmail for Professionals. Not on Small Business, Law or Personal plans. Choose a Hushmail for Healthcare plan at signup, enter your business name when prompted, and sign the agreement Hushmail presents during account creation.
What this means in practice
The whole question with Hushmail is which storefront you buy through. Hushmail sells parallel Basic, Essentials and Growth tiers to healthcare, small business and law customers, and its own comparison table marks the business associate agreement as included only on the healthcare line. A therapist who signs up on the Small Business tier gets a visually identical mailbox with no agreement standing behind it.
Signing is built into account creation rather than handled afterwards by a sales team. Hushmail asks for your business name at signup precisely because that name populates the agreement, so entering a personal name or leaving it vague produces a document that names the wrong party.
Location matters too. Hushmail issues US customers a business associate agreement and Canadian customers an Information Manager Agreement instead. And the personal plan is explicitly ruled out: Hushmail states it is not designed for healthcare or behavioral health practices and includes neither an archive nor either agreement.
How organizations get this wrong
- Buying the Small Business or Law tier because the price matches: same mailbox, but Hushmail's own table marks the agreement as not included.
- Upgrading a long-standing personal Hushmail address instead of opening a healthcare account, leaving years of patient email outside any agreement.
- Typing a clinician's own name at signup rather than the practice's legal entity name, producing an agreement that names the wrong party.
- Assuming a Canadian signup yields a HIPAA agreement; Hushmail issues an Information Manager Agreement outside the US instead.
What the agreement does not cover
- Hushmail Small Business plans, which show 'No' against the agreement on all three tiers.
- Hushmail for Law plans, which likewise show 'No'.
- Hushmail for Personal Use, which Hushmail states is not designed for healthcare or behavioral health practices.
- Customers outside the US, who receive an Information Manager Agreement covering Canadian privacy law instead.
Keep a record of your Hushmail agreement
Sources
- Hushmail for Healthcare: Hushmail. Read July 29, 2026.
- Pricing: Hushmail. Read July 29, 2026.
- How to enter your business name during signup: Hushmail. Read July 29, 2026.
Hushmail can change these terms at any time. If something here no longer matches what Hushmail tells you, tell us.