[mh_key_takeaways]
ProtonMail encrypted email is one of the most recognized names in consumer secure email. The service applies end-to-end encryption between Proton accounts and zero-access encryption on stored mail. That combination is why journalists, activists, and privacy-focused professionals adopted it early.
Businesses ask a different question. They want to know if encrypted email from Proton clears HIPAA, fits an existing Gmail or Outlook workflow, and holds up when the recipient is on a normal inbox. This post answers those three questions with plain detail.
The short answer is that ProtonMail encrypted email works well for Proton-to-Proton exchange and acceptably for external recipients through a portal. For a healthcare practice on Microsoft 365, the fit depends on how often staff send PHI to outside inboxes.
ProtonMail Uses Two Encryption Models in Parallel
Proton applies end-to-end encryption to messages between two Proton accounts. The sender client encrypts the message with the recipient public key before it leaves the device. Only the recipient private key can decrypt it.
For stored mail, Proton uses zero-access encryption. The account password derives the private key on the user device. Proton stores the encrypted mail on its servers and does not hold the plaintext or the key material to decrypt it.
These two models are often confused. End-to-end covers transit between two Proton users. Zero-access covers everything at rest, including mail that arrived from Gmail or Outlook in plain form and was encrypted on receipt by Proton.
Neither model encrypts every field. Sender, recipient, subject line for external mail, timestamp, and IP metadata remain visible to Proton for routing and abuse handling. Users evaluating protonmail encrypted email for regulated work should account for that metadata exposure.
Password-Protected Messages Reach External Recipients
Most business recipients are not on Proton. Sending them a secure message uses the password-protected message feature. The sender writes the message, clicks the lock icon, sets a password, and optionally adds a hint.
The recipient receives a notification email with a link. They open the link in a browser, enter the password, and read the message inside a Proton-hosted portal. Replies happen inside that portal, not in the recipient normal inbox.
Password sharing has to happen through a separate channel. Sending the password inside the same email chain defeats the purpose. Phone call, text, or an in-person handoff are the practical options for password delivery.
The portal step is the operational friction most teams report. Staff on the receiving end often ask for the message in plain email instead. Practices that plan to use protonmail encrypted email for outbound PHI need a policy that forbids that fallback.
HIPAA Compliance Requires a Signed BAA on a Business Plan
ProtonMail is not automatically HIPAA-compliant. A covered entity must sign a Business Associate Agreement with Proton. Proton offers the BAA on Proton for Business plans, not on free personal accounts.
Sending PHI from a free Proton account is a HIPAA violation regardless of encryption strength. The signed BAA is what makes Proton a business associate under 45 CFR 164.502(e). Without it, the covered entity carries the full liability for any exposure.
Signing the BAA covers the service. It does not cover configuration. The practice still owns access controls, session timeouts, audit log review, and workforce training. The HHS Security Rule lays out the technical safeguards a covered entity must apply.
Retention is another common gap. Proton offers configurable retention, but the default may not match a state medical board rule. Admins should review retention against the state records law before turning users loose on protonmail encrypted email for PHI.
ProtonMail Runs on OpenPGP Underneath
ProtonMail uses OpenPGP as the underlying protocol for message encryption between Proton accounts and for external users who supply a PGP public key. This is the same OpenPGP standard documented by the IETF in RFC 4880.
What Proton adds is automation. Key generation happens on account creation. Key storage lives inside the encrypted account. Key exchange with other Proton users happens transparently. Users never see a keyring or a fingerprint.
That transparency is the main difference from a manual PGP setup like Thunderbird with Enigmail. The cryptography is the same. The user experience is different by a wide margin.
The tradeoff is portability. Moving off Proton means exporting keys, importing them into another PGP client, and re-establishing trust with every external contact. A useful encrypted email definition includes the operational reality of key portability, not only the algorithm. See how to send encrypted email for the practical workflow comparison.
[mh_example]
Free ProtonMail Accounts Have Real Limits for Business Use
The free tier gives one address, 1 GB of storage, and 150 messages per day. Custom domain support is not available. Support is community-based. No BAA is offered.
Those limits work for a personal user. They fail for a clinic. A three-person practice will hit the daily message cap by mid-morning during a normal appointment cycle.
Paid business plans start with more storage, custom domain support, more addresses per user, and access to the BAA. Pricing tiers change over time, so verify current pricing on the Proton for Business page before quoting internally.
Common free-tier gaps that surface later:
- No custom domain, so all mail sends from a proton.me address
- No BAA, blocking any legitimate PHI use
- 150-message daily cap on outbound
- 1 GB total storage across mail, calendar, and drive
- No priority support when delivery fails
Proton for Business Supports Custom Domains
A professional healthcare practice needs to send from clinic-name.com, not a shared proton.me address. Proton for Business plans support custom domains through standard DNS records.
Setup runs through the Proton admin console. The admin adds the domain, receives an ownership TXT record, and adds MX, SPF, DKIM, and DMARC records at the DNS provider. Propagation takes minutes to hours depending on the registrar.
Google sender guidelines for Gmail and Microsoft Exchange Online guidance both call for aligned SPF and DKIM. A Proton-hosted domain with correct SPF, DKIM, and DMARC lands in the inbox for most recipients on the first send.
Existing tenants on Google Workspace or Microsoft 365 face a migration decision when moving to Proton. Mailboxes, calendars, contacts, and delegation rules all have to move. That migration cost is a common reason practices keep Google or Microsoft and add a HIPAA gateway on top instead.
ProtonMail Versus Standard TLS-Only Email
Regular Gmail and Outlook use TLS between mail servers when both sides support it. TLS protects the message in transit. The provider holds the plaintext at rest and can decrypt any stored mail.
ProtonMail adds zero-access encryption at rest. That is the meaningful difference for a privacy-focused user. If Proton is subpoenaed, it can turn over ciphertext but not readable content of stored mail.
For a HIPAA workflow, both models can qualify with the right BAA and configuration. The security posture of the whole stack matters more than any single layer. Email is one component of the PHI chain, alongside EHR, storage, and endpoint controls.
What TLS-only fails to cover is external delivery to a non-secure recipient. That is where a portal-based or gateway-based encryption layer becomes necessary regardless of which mail provider the practice uses.
[mh_protip]
Encrypted Email Meaning Depends on the Threat Model
Encrypted email is a broad label. The encrypted email meaning shifts based on what the sender is protecting against and who they consider a threat.
Against a passive network snoop, TLS in transit is often enough. Against a compromised provider or a lawful order, only end-to-end or zero-access encryption keeps content sealed. Against a phishing attack on the recipient, no encryption model helps because the recipient hands over the credentials voluntarily.
A useful encrypted email definition for healthcare covers three layers:
- Encryption in transit between mail servers, usually TLS 1.2 or 1.3
- Encryption at rest on the provider, either provider-held or zero-access
- Encrypted delivery to external recipients through a portal or S/MIME
ProtonMail covers layers two and three natively. See how to send an encrypted email for the walk-through on the portal step from a sender view. A gateway product covers layer three on top of Gmail or Microsoft 365 without moving the mailbox.
Feature Comparison Across Common Encrypted Email Options
The table below summarizes how ProtonMail compares to a native Microsoft 365 or Google Workspace tenant with encryption features enabled.
| Feature | ProtonMail Business | Microsoft 365 with Purview | Google Workspace with S/MIME |
|---|---|---|---|
| End-to-end encryption inside org | Yes, native OpenPGP | Optional with S/MIME | Optional with S/MIME |
| Zero-access at rest | Yes | No, provider holds keys | No, provider holds keys |
| External recipient delivery | Password portal | Portal or one-time passcode | S/MIME certificate exchange |
| Custom domain support | Yes on paid plans | Yes | Yes |
| BAA offered | Yes on Business plans | Yes on Business Premium and above | Yes on Business Standard and above |
| Third-party app ecosystem | Limited | Broad | Broad |
A practice already invested in Microsoft or Google will find the migration cost of a full switch to Proton hard to justify unless zero-access at rest is a stated requirement.
When ProtonMail Fits and When a Gateway Fits Better
ProtonMail fits a solo practitioner or a small clinic starting from scratch on email. The account, the BAA, and the encryption story all come from one vendor. Setup is fast.
It fits any user whose threat model includes the provider itself. Zero-access at rest is what Proton offers that Microsoft and Google do not.
A gateway on top of Gmail or Outlook fits a practice already running on Google Workspace or Microsoft 365. The mailbox does not move. Users keep their existing inbox and their existing threading. The gateway handles encrypted delivery to external recipients. See how to troubleshoot encrypted email when deliverability fails.
Mailhippo operates as this kind of gateway. It sits alongside Gmail or Outlook, includes a BAA in the base plan, and handles the external recipient step with one click. For practices comparing options, the deciding factor is usually whether the existing mail platform is going to move. If it is not, a gateway is the lower-friction path. Practices that also need a compliant public-facing site can pair this with HIPAA-conscious healthcare website design so the whole intake chain stays consistent.
[mh_faqs]
