Is Virtru HIPAA compliant?
Yes on a paid Virtru package, but only after you email their BAA address and execute the agreement: Virtru does not issue it automatically, and its subscription terms require you to ask.
Applies to Virtru email encryption and Secure Share for Gmail and Outlook. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Be on a paid Virtru package. The published pricing lists the signed agreement as a Business-tier feature; the entry-level Starter tier does not name it.
- Request the agreement by emailing baa@virtru.com, as directed by section 11.9 of Virtru's Subscription Agreement.
- Execute it before any patient information is encrypted, shared or stored through Virtru.
- Keep an agreement in place with whoever hosts the mailbox underneath: Virtru is a layer on top of Gmail or Outlook.
- Confirm in writing which of your Virtru products the executed agreement covers, since packages bundle encryption, Secure Share and connectors differently.
Does Virtru sign a business associate agreement?
Yes. Virtru offers one. Paid packages: the signed agreement appears as a Business-tier feature. Not offered to free Personal Privacy users. Email baa@virtru.com as directed in section 11.9 of the Subscription Agreement, or contact Virtru sales, and execute before sending patient information.
What this means in practice
Virtru is not an email service: it is an encryption layer that installs into Gmail or Outlook. That shapes what its agreement can and cannot do for you. Virtru's Subscription Agreement puts the onus on the customer: organisations subject to HIPAA agree to request a business associate agreement by email. Nothing arrives on its own, and buying a licence does not execute one.
Tier matters as well. Virtru's published packages list the signed agreement as a Business-tier feature, while the cheaper Starter package does not mention it. Free Personal Privacy accounts sit outside the paid packages entirely, so a clinician using the free plugin has no agreement in place.
The practical trap is coverage of the whole path. Because the mailbox itself is Google's or Microsoft's, an agreement with Virtru alone leaves the mail platform uncovered: you need both. Virtru publishes no feature-level exclusion list, so confirm with sales exactly which products your executed agreement names.
How organizations get this wrong
- Buying licences and assuming the agreement came with them. Virtru's terms require you to request it by email; nobody sends it unprompted.
- Covering Virtru but not the mailbox underneath, leaving Gmail or Outlook storage of patient email outside any agreement.
- Relying on staff to remember to switch Virtru on per message, so unencrypted patient email goes out whenever someone forgets.
- Choosing the Starter package on price when the published feature list names the signed agreement only from Business upward.
What the agreement does not cover
- Free Virtru for Personal Privacy accounts.
- The Starter package, whose published feature list does not name the agreement.
- Your underlying Gmail or Microsoft 365 mailbox, governed by Google's or Microsoft's own agreement.
- Virtru publishes no feature-level exclusions list, so treat any unlisted product as unconfirmed.
Alternatives
Agreement included with every account, and no plugin for staff to remember to click
If you only need the mailbox covered, the amendment is accepted directly in the Admin console
Keep a record of your Virtru agreement
Sources
- Terms of Service: Subscription Agreement, s.11.9 HIPAA Protected Entities: Virtru. Published November 18, 2024. Read July 29, 2026.
- Data Protection Packages & Pricing: Virtru. Read July 29, 2026.
Virtru can change these terms at any time. If something here no longer matches what Virtru tells you, tell us.