Is Virtru HIPAA compliant?
Yes on a paid Virtru package, but only after you email their BAA address and execute the agreement — Virtru does not issue it automatically, and its subscription terms require you to ask.
Applies to Virtru email encryption and Secure Share for Gmail and Outlook. Last reviewed against Virtru's own documentation. Next review December 22, 2026.
Reviewed by Lisa Tran, CISSP — Healthcare Information Security Executive.
What you must do
- Be on a paid Virtru package. The published pricing lists the signed agreement as a Business-tier feature; the entry-level Starter tier does not name it.
- Request the agreement by emailing baa@virtru.com, as directed by section 11.9 of Virtru's Subscription Agreement.
- Execute it before any patient information is encrypted, shared or stored through Virtru.
- Keep an agreement in place with whoever hosts the mailbox underneath — Virtru is a layer on top of Gmail or Outlook.
- Confirm in writing which of your Virtru products the executed agreement covers, since packages bundle encryption, Secure Share and connectors differently.
Does Virtru sign a business associate agreement?
Yes. Virtru offers one. Paid packages — the signed agreement appears as a Business-tier feature. Not offered to free Personal Privacy users. Email baa@virtru.com as directed in section 11.9 of the Subscription Agreement, or contact Virtru sales, and execute before sending patient information.
What this means in practice
Virtru is not an email service — it is an encryption layer that installs into Gmail or Outlook. That shapes what its agreement can and cannot do for you. Virtru's Subscription Agreement puts the onus on the customer: organisations subject to HIPAA agree to request a business associate agreement by email. Nothing arrives on its own, and buying a licence does not execute one.
Tier matters as well. Virtru's published packages list the signed agreement as a Business-tier feature, while the cheaper Starter package does not mention it. Free Personal Privacy accounts sit outside the paid packages entirely, so a clinician using the free plugin has no agreement in place.
The practical trap is coverage of the whole path. Because the mailbox itself is Google's or Microsoft's, an agreement with Virtru alone leaves the mail platform uncovered — you need both. Virtru publishes no feature-level exclusion list, so confirm with sales exactly which products your executed agreement names.
How organizations get this wrong
The specific mistakes we see with Virtru, not generic advice.
- Buying licences and assuming the agreement came with them. Virtru's terms require you to request it by email; nobody sends it unprompted.
- Covering Virtru but not the mailbox underneath, leaving Gmail or Outlook storage of patient email outside any agreement.
- Relying on staff to remember to switch Virtru on per message, so unencrypted patient email goes out whenever someone forgets.
- Choosing the Starter package on price when the published feature list names the signed agreement only from Business upward.
What the agreement does not cover
- Free Virtru for Personal Privacy accounts.
- The Starter package, whose published feature list does not name the agreement.
- Your underlying Gmail or Microsoft 365 mailbox, governed by Google's or Microsoft's own agreement.
- Virtru publishes no feature-level exclusions list, so treat any unlisted product as unconfirmed.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
Agreement included with every account, and no plugin for staff to remember to click
If you only need the mailbox covered, the amendment is accepted directly in the Admin console
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Virtru, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Virtru’s own published documentation, read on the date shown.
- Terms of Service — Subscription Agreement, s.11.9 HIPAA Protected Entities — Virtru. Published November 18, 2024. Read July 29, 2026.
- Data Protection Packages & Pricing — Virtru. No publication date given. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Virtru’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.