Does ProtonMail enable HIPAA compliance?

Even though ProtonMail isn’t designed specifically for the healthcare industry, it offers security features healthcare organizations can use for protected health information (PHI). ProtonMail includes a HIPAA compliance statement on its website that assures the company will do its part to protect patient data..

Privacy and security features include end-to-end encryption and zero access data management. The service uses 4,096-bit RSA encryption for all stored communications. Data centers provide physical security for all data backups. The server hardware is located in Switzerland where the servers use fully encrypted hard disks, including multiple password layers in case the hardware is removed from the data center.

If a user’s device is stolen or lost, a remote wipe feature can protect PHI. Account owner authorization gives healthcare organizations control over who can access the information. Automated virus checking and data backups are standard. There is also a sophisticated monitoring system.

ProtonMail states that its employees don’t have access to PHI. ProtonMail states that it doesn't store paper copies or printed reports in its facilities.