Is ProtonMail HIPAA Compliant? Why Encryption Alone Is Not Enough

The short answer

ProtonMail is not HIPAA compliant. Proton AG, the Swiss company behind Proton Mail, does not offer Business Associate Agreements to healthcare organizations. No tier, no plan, no workaround changes this.

If your clinic staff use ProtonMail for any email that references patient names, appointment details, diagnoses, or treatment information, that is a HIPAA violation. The encryption does not help.

Why encryption alone falls short

This is the most common misunderstanding. Proton Mail’s end-to-end encryption is technically strong, in some ways stronger than what Microsoft or Google offer by default. So why does it not qualify for HIPAA?

HIPAA compliance requires three categories of safeguards: administrative, physical, and technical. Encryption is one technical safeguard. The regulation also requires:

• Audit controls (who accessed what, when)
• Access management (role-based permissions, automatic logoff)
• Breach notification procedures (documented response within 60 days)
• Business Associate Agreement with every vendor that handles PHI

ProtonMail satisfies one item on that list. It does not satisfy the others, and Proton does not offer a BAA to US healthcare organizations. A tool can be technically excellent and still be off-limits for PHI. This is one of those cases.

Why clinicians reach for ProtonMail

The logic is understandable. Standard Gmail or Outlook send emails in plaintext over the open internet. ProtonMail encrypts everything end-to-end. A clinician who cares about patient privacy sees the encryption and assumes the problem is solved.

The problem is that HIPAA compliance is not purely a technical question. It is also an organizational one. A BAA creates legal accountability between your practice and your vendor. It defines what happens if a breach occurs, who is responsible for notifying patients, and what remediation is required. Swiss-based Proton AG is not subject to HIPAA enforcement and cannot take on that legal role for a US-based covered entity.

What the BAA requirement actually means

When your practice sends patient information to a vendor’s system (whether it is an EHR, a task management tool, or an email provider), that vendor becomes a business associate under HIPAA. You need a signed BAA before any PHI touches their infrastructure.

A BAA is not optional paperwork you can skip if the tool is encrypted. HHS has assessed fines for BAA violations independent of whether any breach actually occurred. The absence of a BAA is itself a compliance failure.

What to use instead

For standard clinic email, two options cover most practices. Microsoft 365 Business Premium signs BAAs and includes encryption, audit logging, and data loss prevention. Most practices already have Microsoft accounts, which makes this the path of least resistance. Google Workspace for Healthcare also offers a BAA and covers HIPAA-relevant controls across Gmail, Drive, and Meet.

For clinical messaging between staff and with patients, consider purpose-built platforms. TigerConnect, Klara, and Spruce Health all include BAAs and are designed around healthcare communication workflows. They look similar to standard messaging apps but operate over encrypted channels with full audit trails.

What PHIGuard covers

PHIGuard handles task coordination and compliance program management within your clinic, not external email. We built it because clinics using general-purpose tools like Asana and Monday.com face the same problem as ProtonMail users: good tools that were not built for healthcare and cannot sign a BAA that covers PHI-related workflows.

If your clinic needs a task management tool where staff can assign follow-ups, track prior authorizations, and run compliance checklists without worrying about PHI exposure, PHIGuard includes a BAA at every pricing tier starting at $20/month for up to 10 staff.

For email, use Microsoft 365 or Google Workspace. For ProtonMail, the answer is the same whether you are a small family practice or a multi-provider clinic: it is not an option for PHI.