Once you've accepted that you need a real HIPAA-compliant email provider — and if you're on free Gmail, you do — the next question is the practical one: which one do you actually buy? There are only a handful of serious options for a solo therapy practice, and they split into two camps. Some replace your email outright. Others bolt encryption onto the email you already run.

This is a straight comparison of the four that matter — Google Workspace, Microsoft 365, Hushmail for Healthcare, and Paubox — with rough costs, whether each signs the Business Associate Agreement (BAA), and the setup steps for each. If you want the underlying rules first — what makes email HIPAA compliant in the first place — start there and come back. This post assumes you already know you need a BAA and encryption, and just want to pick.

The one rule that decides everything

Before the table, the single test that every option has to pass: will the vendor sign a BAA, and is the mailbox encrypted in transit and at rest? If a provider won't sign a BAA, nothing else about it matters — not the price, not the features, not how secure it claims to be. Every provider below clears that bar. That's why they're the four on the list and the dozens of consumer services aren't.

The second thing to know: signing up is not the same as being compliant. With Google and Microsoft especially, the BAA is a step you have to trigger and configuration you have to finish. Buying the plan does nothing on its own.

The comparison at a glance

Here's how the four stack up for a solo practice. Prices are per user, per month, as of 2026 — always check current pricing before you commit, because these move.

Provider	Signs a BAA?	Rough cost (2026)	What it is	Best for
Google Workspace	Yes — you accept it in Admin Console	~$7–$14/user/mo	Paid Gmail at your own domain	Therapists already comfortable in Gmail
Microsoft 365 Business	Yes — included for eligible plans	~$6–$22/user/mo	Paid Outlook + Office at your domain	Practices already in Word/Excel/Teams
Hushmail for Healthcare	Yes — included by default	~$10–$13/mo (healthcare plans)	Purpose-built encrypted email + web forms	Solo therapists who want simple and done
Paubox	Yes — included	~$29+/mo (Standard)	Encryption layer over Workspace/365	Practices sending lots of client email

Now the detail on each.

Google Workspace + BAA

This is the paid version of Gmail running at your own domain — you@yourpractice.com instead of you@gmail.com — with the same inbox you already know, plus Calendar, Drive, Docs, and Meet.

BAA: Yes. Google will sign a BAA with paid Workspace customers, but it is not automatic and consumer Gmail will never qualify. A super administrator has to accept it. As of 2026, Business Starter runs around $7/user/month and Business Standard around $14 — most solo therapists pick Standard for the extra storage and admin controls. Check current pricing before you buy.

Setup steps:

Sign up for a paid Workspace plan at a domain you own (buy the domain through Google or point one you already have).
In the Admin Console, go to Account Settings → Legal & Compliance and accept the Business Associate Addendum. This is the legally binding BAA. It takes about five minutes and is the step everything else depends on.
Enforce two-step verification on every account that touches client information, starting with your own.
Confine PHI to BAA-covered services. The BAA covers Gmail, Calendar, Drive, Meet, Chat and others — not YouTube, Blogger, Google Photos, or Marketplace add-ons. Disable the non-covered services for accounts handling PHI.
Set up SPF, DKIM, and DMARC for your domain.

The catch: the configuration is on you, and it's easy to leave gaps. Google gives you a compliant platform, not a compliant setup out of the box.

Microsoft 365 (Business)

The Microsoft equivalent: paid Outlook at your own domain, bundled with Word, Excel, Teams, and OneDrive. If your practice already lives in Office, this keeps everything under one roof.

BAA: Yes. Microsoft offers a BAA to eligible business and enterprise subscriptions, and for many plans the BAA is incorporated automatically through the Microsoft Product Terms rather than needing a separate click — but you should confirm it applies to your specific subscription rather than assume. As of 2026, Business Basic is around $6/user/month and Business Standard around $12.50; check current pricing.

Setup steps:

Buy a Microsoft 365 Business plan at a domain you own. Free @outlook.com and @hotmail.com addresses do not qualify and never will.
Confirm the BAA covers your subscription (it's part of the Microsoft Product Terms / Data Protection Addendum, but verify rather than assume).
Enforce multi-factor authentication for every user.
Lock down external sharing in OneDrive and SharePoint, and configure your encryption rules for outbound mail.
Document the BAA reference alongside your other vendor agreements.

The catch: Microsoft's admin surface is larger and more intimidating than Google's, and confirming exactly which terms cover you takes a little reading. Powerful, but not the "simplest" option.

Hushmail for Healthcare

Hushmail is the purpose-built option — email designed from the start for small healthcare and therapy practices rather than a general business suite you have to harden.

BAA: Yes, included by default — there's no separate step to trigger it. Encryption is built in, and the healthcare plans add encrypted web forms, which are genuinely useful for intake and consent without a separate tool. As of 2026, healthcare plans run roughly $10–$13/month for a solo mailbox; check current pricing.

Pros:

The BAA and encryption are on from day one — far less to misconfigure.
Built-in secure web forms for intake, so you're not bolting on another vendor (and another BAA) just to collect client information.
Designed for people who are therapists, not IT administrators.

Cons:

Per-mailbox cost tends to run higher than Workspace's entry tier.
You don't get the full productivity ecosystem — no bundled documents suite, calendar, and video the way Google and Microsoft give you. It's email (and forms), done well, rather than an everything platform.

Setup steps: sign up for a healthcare plan, connect your domain, and turn on the encrypted forms you need. That's close to the whole list — which is the point.

Paubox

Paubox is the odd one out, and the most misunderstood. It's not a mailbox you move into — it's an encryption layer that sits on top of the Google Workspace or Microsoft 365 you already run. Its signature trick: outbound email is encrypted automatically, with no portal and no "click here to view your secure message" step for the recipient. Your client just gets a normal-looking email.

BAA: Yes, included. But note — because Paubox layers on top of Workspace or 365, you still need the BAA with the underlying provider too. Paubox secures the delivery; Google or Microsoft still stores the mailbox. As of 2026, Paubox Standard starts around $29/month; check current pricing.

When it makes sense: you (or your group) already run Workspace or 365, you send a meaningful volume of client email, and the friction of secure-message portals is a real problem — clients not opening messages, replies getting lost. Paubox removes that friction entirely. For a very low-volume solo practice, it's often more than you need on top of what Workspace already gives you.

Setup steps: keep your existing Workspace/365 (with its BAA signed), sign the Paubox BAA, and update your domain's mail routing (MX/SMTP relay) per Paubox's instructions so outbound mail flows through their encryption.

Which should you pick?

Match your situation to the shortest path:

Already on Gmail and want the least disruption → Google Workspace. Same interface, own domain, sign the BAA, done. This is the default for most solo therapists.
Already living in Word, Excel, and Teams → Microsoft 365. Keep everything in one ecosystem; just confirm the BAA covers your plan.
Want the simplest all-in-one, and you're not an IT person → Hushmail for Healthcare. BAA and encryption on by default, plus intake forms in the box. Least to misconfigure.
Your team already runs Workspace or 365 and you send a lot of client email → add Paubox on top so encryption is invisible to clients. Keep the underlying BAA in place.

There's no single right answer — all four are defensible choices. The wrong answer is staying on a free consumer account because switching feels like a hassle. For the full picture of why free Gmail can never be fixed, see Is Gmail HIPAA compliant?, and for the underlying requirements every one of these has to satisfy, see what makes email HIPAA compliant.

Email is one BAA among many

Picking a compliant email provider and signing its BAA is real, concrete progress — but it closes exactly one gap. Every other vendor that touches client data needs the same treatment: your EHR, your scheduler, your telehealth platform, your billing service, your cloud backup, your transcription tool. Each one is its own BAA and its own configuration.

Yundra tracks all of it in plain English — every vendor relationship, every BAA, your Security Risk Analysis, and your written policies — without consultant fees, and we never see your client data. If you're not sure which of your tools are covered and which are quietly out of compliance, take the free assessment and check your email setup alongside 39 other areas in about 25 minutes.

HIPAA-Compliant Email for Therapists: Providers Compared