Is Paubox HIPAA compliant?
Yes, every Paubox account includes a business associate agreement at no extra cost, and Paubox will not finish configuring your email until you have agreed to it.
Applies to Paubox Email Suite. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Agree to the agreement first. Paubox requires all customers to sign or agree to it before email accounts are configured.
- Keep a copy. Accounts opened after 10 November 2017 can download it from Paubox's agreement page; older accounts should ask support.
- Complete the outbound DNS change: add Paubox to your SPF record, whether you run Google Workspace, Microsoft 365 or Exchange.
- Set the outbound gateway value Paubox supplies inside your own mail admin console.
- For inbound filtering, repoint your domain's MX record to the value Paubox supplies. Inbound Security is a Plus or Premium feature.
- Choose the tier that matches your recordkeeping needs: archiving and data loss prevention sit on Premium.
Does Paubox sign a business associate agreement?
Yes. Paubox offers one. All plans. Paubox includes the agreement with every account and lists it as a feature of Standard, Plus and Premium alike. Nothing to negotiate: Paubox requires every customer to agree before configuring email. Download your copy from their agreement page, or contact support if you signed up before 10 November 2017.
What this means in practice
Paubox is unusual among the vendors on this site: the agreement is not an upgrade, an add-on, or a sales conversation. Paubox requires all customers to sign or agree to its business associate agreement before it will configure your email accounts, and it appears as an included feature on all three Email Suite tiers.
What you still have to do is the plumbing. Paubox sits in front of your existing Google Workspace, Microsoft 365 or Exchange mailboxes, so outbound protection begins only once you have added Paubox to your SPF record and set the outbound gateway value it gives you. Inbound filtering begins only once you repoint your MX record, and that is a Plus or Premium capability. Until those DNS changes go live, mail leaves your practice exactly as it did before.
Encryption is automatic rather than a per-message decision. When a recipient's mail server cannot handle modern TLS, Paubox converts the message into an encrypted secure link instead of sending it in the clear. Retention schedules, staff access and your internal email policies remain your responsibility.
How organizations get this wrong
- Updating SPF but never repointing MX, so outbound mail is protected while inbound patient replies arrive completely unfiltered.
- Buying Standard and later discovering that archiving and data loss prevention live on Premium, after an auditor asks for retained messages.
- Sending patient marketing campaigns through Email Suite, which the acceptable use policy prohibits.
- Never downloading the executed agreement, then having nothing to hand an auditor because nobody kept the signup email.
What the agreement does not cover
- Bulk commercial email through Email Suite, which the acceptable use policy prohibits.
- Purchased, rented or third-party data lists.
- Inbound Security on the Standard tier.
- Your own retention schedule, staff access controls and internal email policies.
Keep a record of your Paubox agreement
Sources
- Where can I find the Paubox BAA?: Paubox. Read July 29, 2026.
- Business Associate Agreement (BAA): Paubox. Read July 29, 2026.
- Pricing | Paubox Email Suite: Paubox. Read July 29, 2026.
Paubox can change these terms at any time. If something here no longer matches what Paubox tells you, tell us.