HIPAA and the BAA, in plain English.
What HIPAA requires of email
HIPAA does not ban email, and it does not list products. It requires covered entities to protect electronic PHI with administrative, physical and technical safeguards — access control, audit controls, integrity, authentication and transmission security — and to have a written agreement (the BAA) with any vendor that handles PHI on their behalf. The 2025 proposed update to the Security Rule makes encryption, multi-factor authentication, annual penetration testing and restore within 72 hours explicit requirements; PXCMail is designed to that standard.
What a BAA is
A contract in which the vendor (the business associate) commits to safeguard PHI, report breaches, flow the same obligations to its subcontractors, and return or destroy PHI at the end of the relationship. Without it, using the vendor for PHI is itself a violation.
What PXCMail’s BAA commits to
- Use and disclosure of PHI only to provide the service.
- Safeguards as described in the Security page.
- Breach notification to you within 72 hours of determination, with the information you need to notify patients and HHS.
- Subcontractor flow-down — our subprocessors are under equivalent agreements.
- Return or destruction of PHI within 30 days of termination, with a certificate of destruction.
- Annual written confirmation of safeguards.
Read the sample BAA. We sign it electronically in the signup flow; a countersigned copy is in your console.
How PXCMail maps to the Security Rule
| Safeguard | PXCMail |
|---|---|
| Access control §164.312(a) | Named accounts, MFA, per-practice encryption keys, automatic logoff, break-glass procedures |
| Audit controls §164.312(b) | Per-message and admin audit trail, immutable copies, 6-year retention of logs |
| Integrity §164.312(c) | Message hashing, signed mail (DKIM), immutable archive storage |
| Authentication §164.312(d) | MFA for all users; app passwords scoped and revocable; one-time codes for recipients |
| Transmission security §164.312(e) | TLS enforced; encrypted delivery fallback; S/MIME where available |
| Contingency plan §164.308(a)(7) | Multi-AZ, cross-region disaster recovery, quarterly drills, restore within 72 hours |
| Workforce & training §164.308(a)(3),(5) | Background checks, annual training, least-privilege access |
What HIPAA does not require
“HIPAA certification” does not exist; no vendor can sell you one. End-to-end encryption with patient-held keys is not required. What is required is reasonable, documented safeguards — which is why our evidence is published rather than badged.