What HIPAA email costs in 2026
For a 10-person practice paying yearly. List prices change; links go to each vendor’s pricing page. Prices verified October 2026. HIPAA itself does not price anything: the Security Rule at 45 CFR 164.312 asks for access control, audit controls, integrity and transmission security, and the right-hand columns show what each option gives you toward those.
| Option | Per month, 10 seats | What you get for HIPAA | What you don’t |
|---|---|---|---|
| Google Workspace Business Starter + BAA | ~$84 | BAA, opportunistic TLS, 30 GB | Enforced encryption, PHI detection, archive, audit trail |
| Google Business Plus (Vault) | ~$220 | Above + archive/eDiscovery, basic DLP you configure | Enforced encryption to any recipient, per-message audit |
| Microsoft 365 Business Basic + BAA | ~$60 | BAA, opportunistic TLS, 50 GB | Same gaps as Google Starter |
| Microsoft 365 Business Premium (Purview) | ~$220 | Message encryption and DLP you configure | Healthcare templates, easy recipient experience, someone to set it up |
| Hushmail Healthcare Basic → Growth | $110 – $165 | Encrypted email, BAA, archive, forms on higher tiers, 10–35 GB | Automatic PHI detection, device policies, your own key |
| Paubox Email Suite (on top of Google/Microsoft) | Quoted; DLP on higher tiers | Enforced TLS, portal fallback, inbound security on higher tiers | Published pricing, mailbox from the same vendor |
| PXCMail Gateway (on top of Google/Microsoft) | $60 + your current plan | Enforced TLS, encrypted delivery, PHI detection, archive, audit, BAA | The mailbox itself (you keep yours) |
| PXCMail Hosted | $120 | All of the above + 50 GB mailbox, device policies, your own key, migration | Forms and e-signatures (partners) |
Three things the table hides
- Setup time is a cost. Configuring Purview or Google DLP properly takes a competent admin real time, repeated when staff change. Vendors who do it with you on a call are cheaper than they look.
- The per-seat price is not the bill. Minimums, migration fees, storage add-ons and archive tiers matter. Ours: $49 minimum per organization, migration free up to 50 seats, and the 6-year healthcare archive adds $3 per seat on Gateway, taking it to $9. Six years is also how long 45 CFR 164.316 makes you keep Security Rule documentation, so the archive and the paperwork share a clock.
- Forms are a separate decision. If you need intake forms and e-signatures, Hushmail bundles them; everyone else (including us) points you to a HIPAA forms product. Price the two needs separately.
Fines are a tail risk, not a budget line; HHS publishes its resolution agreements if you want to see what the cases look like. The everyday cost is the controls above.
Our pricing, with a calculator →
Sources
- 45 CFR 164.312, Technical safeguards — the access control, audit, integrity and transmission security standards each option in the table is measured against.
- 45 CFR 164.316, Documentation requirements — requires Security Rule documentation to be retained for six years, the same period as the healthcare archive profile.
- HHS, Security Rule overview — HHS’s plain-language summary of what the Security Rule requires of covered entities and business associates.
- HHS, Resolution agreements and civil money penalties — the public record of enforcement cases.
Daniel runs product at PacinfraX and writes about what the product does and costs, including where competitors are better. He spent twelve years building email and archiving systems for large organizations. About the team →
Reviewed against the regulation text cited above. Not legal advice.