Is Mailgun HIPAA compliant? (2026 update)

Mailgun is a cloud-based email delivery service built for developers, offering APIs and SMTP services for sending, receiving, and tracking transactional and marketing emails at scale.

With Mailgun, businesses can integrate email functionality directly into their applications, monitor deliverability, validate email lists, and manage inbound email routing.

Is Mailgun HIPAA compliant? Yes, Mailgun can be HIPAA compliant, but there are limitations.

What changed this year?

As of May 2026, our review did not identify any publicly disclosed changes to Mailgun HIPAA-related policies or BAA terms. The BAA was last revised on November 20, 2020, and no updates have been announced since

Will Mailgun sign a business associate agreement (BAA)?

Yes, Mailgun will sign a business associate agreement, which can be reviewed here.

What does the Mailgun BAA cover?

The Mailgun BAA covers the use and disclosure of protected health information (PHI), stating, "This HIPAA Business Association Addendum (this 'HIPAA Addendum') is an addendum to the Mailgun Terms of Service (the 'Terms'). This HIPAA Addendum defines the rights and responsibilities of each of us with respect to Protected Health Information as defined in the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder, including the HITECH Act and Omnibus Rule.”

What does the Mailgun BAA exclude?

The BAA states, "You acknowledge and understand that the Mailgun Services include the transmission of unencrypted email in plain text over the public internet and open networks. Customer Data you upload to the Mailgun Services is not encrypted by Business Associate and is stored (and transmitted) in similar fashion as you provide it. You are responsible for encrypting any sensitive data you use in conjunction with the Mailgun Services."

This means Mailgun does not encrypt PHI on your behalf, the customer must implement their own encryption measures, such as encrypted attachments, PGP, or S/MIME, before transmitting PHI through the platform.

The BAA further notes, "Although Mailgun Services include support for TLS, content will be transmitted even if the recipient does not also support TLS, resulting in an unencrypted transmission." This means TLS encryption is not guaranteed end-to-end, and PHI could be transmitted in plain text if a recipient's mail server does not support TLS.

Additionally, the BAA explicitly excludes third-party conduits involved in email transmission from the agreement's safeguards: "This does not apply to third party conduits and providers who are involved in the transmission, routing, storage or receipt of email which is inherent in the delivery of the Mailgun Services."

HIPAA compliance on Mailgun is only available on enterprise plans, requiring customers to contact Mailgun directly for pricing.

Conclusion

Mailgun may be HIPAA compliant, but customers bear responsibility for ensuring PHI is encrypted prior to transmission, patient consent is obtained, and appropriate safeguards are configured on their end. It is also worth noting that HIPAA compliance on Mailgun is only available on enterprise plans, requiring customers to contact Mailgun directly for pricing.

Learn more: HIPAA Compliant Email: The Definitive Guide

FAQS

What is a business associate agreement?

A business associate agreement (BAA) is a legally binding contract establishing a relationship between a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and its business associates. The purpose of this agreement is to ensure the proper protection of personal health information (PHI) as required by HIPAA regulations.

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting the privacy and security of certain health information, known as protected health information (PHI).

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.