PXCMail vs Hushmail
Hushmail has protected therapists’ email since 1999 and is a good product. If you are a solo practitioner who wants secure forms and e-signatures in the same place, it may be the better fit. Here is where each is stronger.
| Hushmail Healthcare | PXCMail | |
|---|---|---|
| Price per seat (yearly) | $11 – $16.50 | Gateway $6 · Hosted $12 · Pro $18 |
| Keep Gmail / Microsoft 365 | Yes (newer option) | Yes — Gateway, designed around it |
| Mailbox storage | 10 – 35 GB | 50 GB |
| Encrypted delivery to recipients | Open with Google/Apple/Microsoft sign-in | One-time code; sign-in option on the roadmap |
| PHI detection before sending | Manual encryption toggle | Automatic detection + policy |
| Secure forms & e-signatures | Yes, built in | Via partners (Jotform HIPAA, IntakeQ) |
| Native Outlook / iPhone / Android with device policies | iOS app; IMAP for others | EWS/ActiveSync with PIN and remote wipe |
| Dedicated encryption key per practice | Shared OpenPGP infrastructure | Yes (Hosted and Pro) |
| Audit trail per message, exportable | Archive | Yes, mapped to audit questions |
| Published trust evidence | BAA | BAA; pentest and SOC 2 Type I ROADMAP |
| Support | Email + callback | 15-minute response, DNS on a call |
Hushmail features and prices from hushmail.com/pricing, October 2026. We keep this table honest; tell us if something is out of date.
Choose Hushmail if
- You are solo, want forms and e-signatures in one subscription, and are happy with a 10–35 GB mailbox.
Choose PXCMail if
- You want to keep Google or Microsoft and add enforcement for $6.
- You have a front desk and want PHI caught automatically, not toggled.
- You need Outlook and phones managed, a bigger mailbox, your own key, and an audit trail your auditor can read.
- You are an IT provider or billing company managing many practices.
Where Hushmail is stronger
- Forms and e-signatures in the subscription. Intake forms, consents and signatures live beside the mailbox under one BAA. PXCMail does not do forms; we point you to Jotform HIPAA or IntakeQ, which is a second vendor and a second BAA.
- Recipient sign-in. A client can open an encrypted message with a Google, Apple or Microsoft sign-in. At PXCMail that is ROADMAP; today recipients use a one-time code by SMS or email.
- Time in the market. Hushmail has protected therapists’ email since 1999 and has a long list of solo practices that are happy. Our SOC 2 Type I and pentest letter are ROADMAP.
- Price at the bottom end. At $11 a seat on the entry tier, a solo practitioner pays less than our $49 organization minimum.
Where PXCMail is stronger
- Detection instead of a toggle. The Healthcare pack catches names beside MRNs, insurance IDs, ICD-10 and CPT codes, and scanned attachments on Pro, then applies deliver, encrypt, warn, hold or block. Nobody has to remember.
[SECURE]still forces it. - Keep Google or Microsoft. Gateway at $6 a seat sits in front of the mailbox you already have; nothing migrates.
- A bigger, managed mailbox. Hosted is 50 GB with native Outlook, iPhone and Android sync, PIN and remote wipe, shared mailboxes, ten devices per user, and a dedicated organization key rather than shared infrastructure.
- Evidence. A per-message audit record, a quarterly compliance report, an annual safeguards letter and evidence packs mapped to the questions an auditor or carrier asks. One-year archive on every plan; 6-year immutable archive and legal hold on Pro.
- Support. Human reply within 15 minutes on chat during business hours, 24/7 for outages, DNS and migration on a call, migration free up to 50 seats.
A week at Pacific Behavioral
Pacific Behavioral is a group therapy practice with clinicians, a front desk and a biller. On Monday a clinician emails a treatment summary with a diagnosis code to a client’s primary-care doctor; detection applies encrypt, and the doctor’s office opens it with a one-time code. On Tuesday the biller sends a superbill to a client; same thing, and the open is logged. On Wednesday the front desk emails appointment reminders with no PHI; they go over TLS, logged as delivered. On Thursday a clinician forwards a session note to a personal address by mistake; the policy holds it and the practice manager sees why. On Friday the manager exports the week’s records for the practice’s cyber-insurance renewal. On Hushmail, Monday and Tuesday depend on the clinician remembering the encryption toggle, Thursday goes through, and Friday is an archive search rather than a per-message report.
Total cost for a 10-person practice
| Option | Per month, 10 seats, billed yearly | Includes |
|---|---|---|
| Hushmail Healthcare, Basic to Growth | $110 to $165 | Encrypted email, BAA, archive, forms on higher tiers, 10 to 35 GB |
| PXCMail Gateway + your Google or Microsoft plan | $60 + your current plan | Enforced TLS, encrypted delivery, detection, 1-year archive, audit trail, BAA |
| PXCMail Hosted | $120 | All of the above + 50 GB mailbox, device policies, dedicated key, migration |
| PXCMail Hosted Pro | $180 | + 6-year immutable archive, legal hold, SSO, OCR, audit API, SLA credits |
Add a forms product on the PXCMail side if you need intake forms; price that line separately. Below four Hosted seats the $49 minimum applies, which is why we say a solo practice may be better served by Hushmail. Prices from our 2026 cost comparison, verified October 2026.
By the numbers
- PHI that was encrypted per HHS guidance is not “unsecured,” so its loss is not a notifiable breach (HHS guidance). That safe harbor only helps if encryption actually happened, which is the argument for detection over a toggle.
- Breach notification is due within 60 days, and breaches of 500 or more go to HHS and the media (45 CFR Part 164 Subpart D).
- NetDiligence’s 2025 claims study: 98% of cyber claims came from small and mid-sized businesses (NetDiligence).
Who should pick which
Pick Hushmail if you are solo or a two-person practice, intake forms and e-signatures matter as much as email, a 10 to 35 GB mailbox is fine, and you prefer your clients to sign in with Google or Apple.
Pick PXCMail if you have a front desk or more than a few clinicians, you want encryption decided by detection rather than memory, you want phones and Outlook managed, you need a per-message audit trail for a carrier or an auditor, or you already have Google Workspace or Microsoft 365 and want to keep it for $6 a seat.
Questions therapists and practice managers ask
Can I keep Gmail and add PXCMail?
Yes. Gateway is built for that: a relay route in Google Admin, three DNS records, 15 minutes on a call. Setup guide
What does my client see when a message is encrypted?
A notification with a link; they open it with a one-time code by SMS or email, no account or app, in English or Spanish. Messages expire after 30 days by default (1 to 90 configurable) and you can revoke any time. Sign-in with Google, Apple or Microsoft is ROADMAP.
What do I do about intake forms?
Use Jotform HIPAA or IntakeQ and sign their BAA. Their notification emails come through your mailbox and inherit the policy. We help move templates when you switch.
How hard is it to move from Hushmail?
An IMAP sync in the background, then one afternoon for DNS and devices. Free up to 50 seats. Switch guide
Does PXCMail support 42 CFR Part 2 programs?
The BAA includes a Part 2 QSOA where it applies, and the Healthcare detection pack can be extended with your own keyword lists. See 42 CFR Part 2.