Is Paubox HIPAA compliant?
Yes — every Paubox account includes a business associate agreement at no extra cost, and Paubox will not finish configuring your email until you have agreed to it.
Applies to Paubox Email Suite. Last reviewed against Paubox's own documentation. Next review December 20, 2026.
Reviewed by Lisa Tran, CISSP — Healthcare Information Security Executive.
What you must do
- Agree to the agreement first. Paubox requires all customers to sign or agree to it before email accounts are configured.
- Keep a copy. Accounts opened after 10 November 2017 can download it from Paubox's agreement page; older accounts should ask support.
- Complete the outbound DNS change: add Paubox to your SPF record, whether you run Google Workspace, Microsoft 365 or Exchange.
- Set the outbound gateway value Paubox supplies inside your own mail admin console.
- For inbound filtering, repoint your domain's MX record to the value Paubox supplies. Inbound Security is a Plus or Premium feature.
- Choose the tier that matches your recordkeeping needs — archiving and data loss prevention sit on Premium.
Does Paubox sign a business associate agreement?
Yes. Paubox offers one. All plans. Paubox includes the agreement with every account and lists it as a feature of Standard, Plus and Premium alike. Nothing to negotiate — Paubox requires every customer to agree before configuring email. Download your copy from their agreement page, or contact support if you signed up before 10 November 2017.
What this means in practice
Paubox is unusual among the vendors on this site: the agreement is not an upgrade, an add-on, or a sales conversation. Paubox requires all customers to sign or agree to its business associate agreement before it will configure your email accounts, and it appears as an included feature on all three Email Suite tiers.
What you still have to do is the plumbing. Paubox sits in front of your existing Google Workspace, Microsoft 365 or Exchange mailboxes, so outbound protection begins only once you have added Paubox to your SPF record and set the outbound gateway value it gives you. Inbound filtering begins only once you repoint your MX record, and that is a Plus or Premium capability. Until those DNS changes go live, mail leaves your practice exactly as it did before.
Encryption is automatic rather than a per-message decision. When a recipient's mail server cannot handle modern TLS, Paubox converts the message into an encrypted secure link instead of sending it in the clear. Retention schedules, staff access and your internal email policies remain your responsibility.
How organizations get this wrong
The specific mistakes we see with Paubox, not generic advice.
- Updating SPF but never repointing MX, so outbound mail is protected while inbound patient replies arrive completely unfiltered.
- Buying Standard and later discovering that archiving and data loss prevention live on Premium, after an auditor asks for retained messages.
- Sending patient marketing campaigns through Email Suite, which the acceptable use policy prohibits.
- Never downloading the executed agreement, then having nothing to hand an auditor because nobody kept the signup email.
What the agreement does not cover
- Bulk commercial email through Email Suite, which the acceptable use policy prohibits.
- Purchased, rented or third-party data lists.
- Inbound Security on the Standard tier.
- Your own retention schedule, staff access controls and internal email policies.
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Paubox, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Paubox’s own published documentation, read on the date shown.
- Where can I find the Paubox BAA? — Paubox. No publication date given. Read July 29, 2026.
- Business Associate Agreement (BAA) — Paubox. No publication date given. Read July 29, 2026.
- Pricing | Paubox Email Suite — Paubox. No publication date given. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Paubox’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.