Proton says it offers a BAA to all Proton users and signs it on request by email. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access.
| Plan or product | BAA |
|---|---|
| Any Proton user per Proton’s statement; plan tiers are not itemized | Covered |
How to get the BAA
Email [email protected] with the subject HIPAA BAA, or download the model BAA from Proton’s site first.
What the vendor says to do
- Email Proton with the subject HIPAA BAA to get a signed agreement
- Set a password on messages to external recipients, since they are not otherwise end-to-end encrypted
- Set a company-wide policy for handling PHI in transmission
What we couldn’t confirm
Proton says the BAA is for all users, but its HIPAA material focuses on Business plans and doesn’t plainly address free accounts. We didn’t review the BAA clause by clause.
Proof from the vendor
- Use Proton for HIPAA-compliant email, calendar, and VPNBAA offered to all Proton users; request address; external recipient encryption behavior
- Proton BAA modelModel BAA and signing request address (last modified July 17, 2026)
- HIPAA compliance for email (Proton blog)Older contact address for signing: [email protected]
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.