ProtonMail and HIPAA Compliance

Important: HIPAApropriateness reviews, including their summaries, are for informational purposes only. They are neither consultation nor legal advice. Be aware that while we do our best to be thorough and complete, information may be missing or possibly even inaccurate. Products also change quickly, and the review may become out of date. By continuing to read, you agree to use the information in HIPAApropriateness reviews and their summaries at your own risk.

Vital Stats

HIPAA compliance with this product appears possible?: Yes.

Recommend for your HIPAA risk management needs?: Yes. Be sure to read the notes regarding HIPAA-specific items.

# of Caveats: 0 view caveats→

# of Usage Notes: 0 view notes→

Relevant Product Characteristics

This product does not appear to have been designed specifically with healthcare in mind. Note that many products that are useful and appropriate for health care professionals are not designed specifically with health care in mind.

What Is This Product?

This review is public. Generally, our HIPAA-propriateness reviews are only available to members of Person-Centered Tech Support, but this one is special. If you want access to all of our HIPAA-propriateness reviews, please subscribe to Person-Centered Tech Support today.

ProtonMail is a high-privacy secure messaging platform with both webmail and mobile apps. They also offer a BAA even with their FREE tier of service. This is rare, folks.

It’s Hosted in Switzerland. Is that okay for HIPAA?

For a long time, we weren’t sure about that. Luckily, HHS has been on a guidance-writing streak throughout 2016 and they dispelled this nasty rumor. Hosting information outside the US is fine so long as there is a BAA in place (citation). We also need to take the locale into account in our risk analyses. At the time of writing, we are not aware of any political unrest or problems of note in Switzerland that would impact the security of ProtonMail’s servers.

Downsides That Aren’t Caveats

Caveats are criticisms of the company or warnings about the product. None of these downsides meet those criteria, so we’re just calling them “downsides.”

ProtonMail doesn’t offer an easy way for someone to initiate a secure message to you – of course they could still send a normal e-mail. In order for a client to send you a secure message through ProtonMail, they must either:
- Have their own ProtonMail account
- Find a ProtonMail message you sent to them that hasn’t already expired and then reply to it.

Okay, there was only 1 downside. That’s a good thing!

This product offers a free service tier or a free trial account:

We encourage all clinicians interested in this product to try out the free trial or experiment with the free tier to see if it suits your needs.

If you discover anything of concern that isn’t addressed in this review yet, please tell Liath about it at [email protected].

Click here for the free trial or free service tier information→. Important note about Business Associate Agreements: This product offers a Business Associate Agreement with the free trial or free service tier. Be sure to get your BAA from the company before using client information while you test the product.

Caveats

Caveats are criticsms of the company or product that we feel are relevant to your risk management or other important considerations.

None

Notes

Notes cover points where the product can’t ensure compliance or ethical action for you. These help you know what your part of the compliance puzzle looks like when using this product. A high note count usually correlates with a feature-rich product, and not necessarily with a product that has problems.