HIPAA-Compliant Email for Therapists: Which Vendors Need a BAA (Probably More Than You Think)

It's 9pm on a Tuesday. A client emails asking to move Thursday's session. You type back: "Sounds good, see you Thursday at 4 — and yes, we can absolutely talk about the medication anxiety then." Send. Kettle on, day done.

Somewhere in that sentence, you crossed a line you couldn't see. The scheduling half was defensible. The back half — a named clinical concern, tied to an identifiable person, sent from a free Gmail account that has never signed anything with anyone — is protected health information sitting on a server with no Business Associate Agreement behind it. Nothing bad will probably happen. That's the trouble with this whole topic: the water looks calm right up until it isn't, and the rocks were under the surface the entire time.

This guide is the map. What the BAA rule actually says, which vendors will sign one (and at what tier), the client-initiated-email nuance that confuses everyone, the honest version of the texting question, and a checklist of every vendor in a typical solo practice that needs an agreement you may not have.

The rule, in one breath

HIPAA's business associate rule (45 CFR 164.502(e) and 164.308(b)) says: any vendor that creates, receives, maintains, or transmits protected health information on your behalf is your business associate, and you may not share PHI with them until they've signed a Business Associate Agreement — a contract making them legally responsible for safeguarding it. Your email host maintains and transmits every message you send. If a client's name plus anything about their care passes through that inbox, the host is handling PHI on your behalf.

Three corollaries do most of the work:

• No BAA, no PHI. Full stop. There's no "but I was careful" exception and no volume threshold. One email with clinical content through a non-BAA service is the same category of problem as a thousand.
• Encryption doesn't substitute for the agreement. A service can be beautifully encrypted and still be off-limits, because the BAA is a legal relationship, not a technical feature. You generally need both.
• Free consumer tiers never qualify. This is the pattern across every vendor in this article. Free Gmail, free Zoom, free Dropbox — the companies offer BAAs only on paid business products, without exception that I'm aware of. If you're not paying, there is no agreement to sign.

Think of your practice as a small boat. Every vendor that touches client data is a through-hull fitting — a deliberate hole below the waterline. Perfectly seaworthy, as long as each one is properly sealed. The BAA is the seal. An unsealed one doesn't leak on sunny days. It leaks in the storm — the breach, the audit, the board complaint — which is exactly when you can't fix it.

The vendor walk: who signs, and at what tier

Tiers and product names shift, so treat the table as a July 2026 snapshot and confirm on each vendor's own HIPAA page before you rely on it. The shape of the landscape, though, has been stable for years:

Google Workspace deserves the longest look, because it's where most solo practices already live and where the quietest compliance failure happens. Google offers its BAA on paid Workspace plans — but the agreement is not automatic. A super admin has to go into the Admin console (Account settings, then Legal and compliance), find the HIPAA Business Associate Amendment, and formally review and accept it. Plenty of therapists pay for Workspace for years believing the subscription itself made them compliant. It didn't. Until someone clicks accept, there is no BAA, and you're sailing without the paperwork you think you have. Google also publishes a list of covered services — Gmail, Drive, Meet, Calendar, and most core apps are on it; third-party add-ons bolted onto them are not.

Microsoft 365 takes the opposite approach: BAA terms are baked into Microsoft's standard Data Protection Addendum for business and enterprise subscriptions, so coverage attaches without a separate signature ceremony. The catch shifts downstream — the agreement doesn't configure your tenant for you, and the defaults are not a clinical practice's defaults.

Zoom signs BAAs for healthcare customers on eligible paid plans — the healthcare packaging has gone by a few names over the years (Zoom for Healthcare, and more recently HIPAA-enabled Business and Enterprise configurations), so confirm the current SKU when you buy. Two things stay constant: the free tier is never covered, and the BAA plus the HIPAA account settings must actually be in place, not merely available.

The therapist-marketed options — Paubox, Hushmail for Healthcare, Proton Mail — exist because the mainstream products make you assemble compliance yourself. Paubox's model is encryption by default: your outbound mail is encrypted in transit and lands in the client's ordinary inbox with no portal or extra password, and a BAA comes with every account. Hushmail's healthcare plans bundle a BAA with encrypted mail and web forms and are priced for solo practices. Proton Mail is end-to-end encrypted and is reported to offer BAAs on paid business plans — verify that directly with Proton before you commit, and check that your retention settings satisfy your state's record-keeping rules.

When the client emails you first

Here's the nuance that unknots most of the anxiety: your clients are not covered entities. HIPAA doesn't regulate them. A client can email you their entire history from a Hotmail account they opened in 2004, and nobody has violated anything. Your obligations attach to what you send, and to where messages containing PHI end up stored — which includes your inbox once their email is sitting in it.

And HIPAA is more permissive about your replies than the folklore suggests. HHS has said plainly that providers may communicate with patients by email, and the Omnibus Rule commentary goes further: if you've warned a client about the risks of unencrypted email and they still prefer it, you may honor that preference — clients have a right to receive communications by the channel they ask for, within reason. The compliance pattern, then, is not "never email." It's three documented moves:

• Warn in writing. Your intake paperwork includes plain-language email and texting consent: ordinary email isn't fully secure, here are the risks, here's what we'll use it for. This lives in the intake packet, alongside your Notice of Privacy Practices.
• Record the preference. The client chooses email, portal, phone, or text — and their choice is documented in the chart, not remembered.
• Keep your side minimal. Whatever they send you, your replies stay in the logistics lane: dates, times, directions, fees. "See you Thursday at 4" is logistics. "Let's discuss the medication anxiety" is clinical content, and it belongs somewhere covered.

That last habit — email for logistics, portal for everything clinical — is the one to tattoo somewhere visible. It's not just safer; it's simpler. You stop adjudicating every message ("is this one okay?") because the rule decides for you. It's the difference between checking the chart every time and knowing the channel is deep enough to begin with.

Texting: the honest version

Standard SMS is worse than email on every axis: unencrypted in transit, stored by carriers who will not sign a BAA with your practice, and mirrored onto whatever devices and smartwatch your client's messages sync to. There is no paid tier that fixes this. If your compliance posture requires a BAA behind every channel, ordinary texting can't clear the bar.

And yet nearly every therapist texts, because clients confirm appointments by text and ignore almost everything else. So here's the honest framing rather than the pretend one: the same HHS posture that permits unencrypted email at a client's informed request is generally read to extend to texting — warn about the risks, document the client's preference for text, and keep content minimal. A large share of real-world practices operate exactly this way, as a documented, risk-tolerant choice: appointment reminders and scheduling only, nothing clinical, nothing you'd wince at on a lock screen. What the guidance does not tolerate is texting as a therapy channel — session content, crisis check-ins, diagnoses, medication details over SMS. If a text thread starts drifting clinical, the professional move is one sentence: "Let's take this to the portal or our next session."

Audit yourself: every vendor that touches PHI

Email is just the visible mast. The BAA rule applies to the whole rigging — every service that creates, receives, maintains, or transmits client information for you. Walk this list and ask two questions for each: does client data touch it, and do I have a signed BAA on file?

• Your EHR. Obvious, and almost certainly already signed — but confirm you can actually produce the document.
• Email host. Everything above.
• Video platform. Zoom, Meet, Doxy.me, or whatever runs your telehealth — same paid-tier-plus-BAA logic as email.
• Cloud storage. The Drive or Dropbox folder holding scanned intake forms is maintaining PHI. Both vendors offer BAAs on paid business plans; consumer accounts don't qualify.
• Transcription and AI tools. Anything that hears a session or drafts a note is swimming in PHI. The vendor needs a BAA covering the AI processing itself, not just storage — the full test is in our guide to HIPAA-compliant AI notes.
• Fax services. E-fax providers transmit records for you. BAA required; most healthcare-oriented ones sign readily.
• Scheduling tools. A booking calendar holding client names and appointment reasons is holding PHI. Free consumer schedulers usually can't sign.
• Payment processors. The genuine nuance: HIPAA carves out financial institutions' payment-processing activities — authorizing, clearing, settling, and collecting payments isn't business-associate work, which is why card processing per se doesn't require a BAA. But the carve-out is narrow. Services beyond moving money (storing treatment descriptions, invoicing with clinical detail) can pull a processor back into business-associate territory. Keep clinical information out of payment descriptions and receipts, and the carve-out works as intended.
• Your accountant and your biller. The ones everyone forgets. A billing service sees diagnoses and dates of service; a bookkeeper reconciling client payments may too. Humans and firms can be business associates just as easily as software.

Most solo practices that run this audit find seven to ten vendors and two or three missing agreements. That's not a scandal — it's Tuesday. The point of the audit isn't shame; it's that every missing BAA is fixable in an afternoon once you can see it.

The shortest list wins

Notice what actually made that list long: PHI scattered across many harbors. Notes here, messages there, billing in a third place, each with its own agreement, tier requirements, and console checkbox to remember. The most effective compliance move available to a solo practice isn't a better email vendor — it's fewer places where client information lives at all. When clinical conversation happens in a client portal inside your EHR, the message never leaves a system that's already covered; your email goes back to being what it's good at, which is logistics. That's the design behind Practice Harbor: portal messaging, notes, scheduling, and billing under one BAA — including the AI note-drafting — so the audit list above collapses to a handful of entries, and the 9pm reply about medication anxiety has a home that was built for it.