Lockbin guide · Updated November 3, 2026
Short answer
Yes, if the service stores or transmits protected health information for you. Under HIPAA, a vendor that handles PHI on your behalf is a business associate, and you need a signed Business Associate Agreement (BAA) with it. Lockbin includes a signed BAA on Premium ($10 a month) and Enterprise plans, and you can sign it yourself in about two minutes.
What a BAA is
A Business Associate Agreement is a contract between a HIPAA-covered office and a vendor that creates, receives, stores or transmits patient information for it. The vendor agrees to safeguard that information, report breaches, and follow HIPAA's rules for it.
If you send patient information through an email or file-sharing service, that service is handling PHI for you. Without a signed BAA, using it for PHI puts your office out of step with HIPAA.
There's no such thing as HIPAA certified
No government body certifies software as HIPAA compliant. What HIPAA asks is that you protect patient information and have a BAA with vendors that handle it. So the questions to ask a vendor are: will you sign a BAA, and how do you protect what I send?
How you get a BAA from Lockbin
- Choose Premium ($10 a month for one user) or Enterprise ($10 per user a month for an office). The BAA isn't available on the free plan.
- Open HIPAA BAA in the left menu of your Lockbin inbox, enter your practice details and type your name to sign.
- Lockbin countersigns instantly and emails you the signed PDF. You can download it again any time.
No sales call, no waiting on a legal team, and no yearly contract.
What's behind Lockbin's BAA
- Message bodies and attachments are stored encrypted with AES-256. Each message has its own key, protected with RSA.
- Data moves over TLS 1.2 or higher.
- Lockbin records when each message is opened, from what IP address, and when messages are deleted.
- Lockbin runs on Amazon Web Services in the United States, under AWS's own BAA.
Keep patient details out of subject lines and file names, which aren't encrypted at the message level. Get Premium and sign your BAA.
Questions
Do I need a BAA with my email provider under HIPAA?
Yes, if you use it to send or store protected health information. A vendor that handles PHI for you is a business associate and needs a signed BAA.
Does Lockbin sign a BAA?
Yes. Lockbin signs a HIPAA Business Associate Agreement on Premium and Enterprise plans. You sign it in your dashboard and Lockbin countersigns instantly.
How much does an email service with a BAA cost?
Lockbin Premium is $10 a month for one user, and Enterprise is $10 per user a month. Both include the signed BAA and are billed monthly.
Is there an official HIPAA certification for email?
No. There is no official HIPAA certification for software. Look for a vendor that signs a BAA and encrypts patient information.
Or start free with 10 secure emails and one document request. Questions? Email support@lockbin.com.
More: How Lockbin's BAA works The best HIPAA-compliant email for therapists in 2026 How to collect documents from clients securely How to send an encrypted email to a patient or client How CPAs can collect tax documents securely this tax season How insurance agents can collect applications and SSNs securely