No email product is PHIPA compliant on its own, Paubox included, and Paubox doesn’t claim to be.
Paubox stores all data on US servers with no Canadian data center option
No Canadian audit trail, no PHIPA framework alignment, no provincial compliance infrastructure
Paubox is built for HIPAA, which does not map directly to Canadian health privacy law
No statute requires a private practice therapist to write a Privacy Impact Assessment before using Paubox. If you use it, recording the cross border risk in one is good practice

Paubox is a US healthcare email encryption product, and it states it has held HITRUST certification since 2019. If you’ve researched encrypted email for your practice, you’ve probably seen it recommended in American healthcare forums, HIPAA guides, and G2 reviews.

Here’s the problem: Paubox is built for HIPAA. And HIPAA is not PHIPA. If you’ve already looked into whether Gmail itself is PHIPA compliant, you know that email encryption for Canadian therapists is a different question than email encryption for American ones.

Paubox acknowledges this themselves. Their own blog post on PHIPA compliance discusses the relationship between the two frameworks but does not claim PHIPA compliance. For Canadian therapists searching “is Paubox PHIPA compliant,” the short answer is that no email product is, on its own, and Paubox doesn’t claim to be. This guide explains why, what the specific gaps are, and what to evaluate instead.

What Paubox does well

This is not an attack on Paubox. It’s a US product doing US healthcare compliance well. That deserves acknowledgment.

Paubox states it achieved HITRUST CSF certification in February 2019 and displays current r2 certified status. This is meaningful when treated as a vendor attestation. Paubox offers what it calls zero step email encryption for Gmail and Microsoft 365. Paubox says your recipients open encrypted email in their own inbox. When a recipient’s server lacks TLS, Paubox sends a secure link instead. For US providers subject to HIPAA, this is a strong offering.

Their approach to encryption is genuinely good. Paubox checks whether the recipient’s server supports TLS. If it does, the email sends encrypted. If it doesn’t, the message routes through Paubox’s own encrypted delivery system. The sender does nothing differently. The recipient usually doesn’t either.

For American healthcare organizations that need HIPAA compliant email without changing their workflow, Paubox delivers. They’ve been operating since at least 2014, based on the earliest live Paubox product captures in the Internet Archive. Paubox says it serves thousands of healthcare organizations, and their US compliance track record is solid.

The product isn’t the problem. The jurisdiction is.

Why is Paubox not PHIPA compliant?

Paubox says it is not PHIPA compliant (Paubox blog, 2022-11-17). No vendor can be: PHIPA s.17(1) keeps the custodian responsible. The useful question is whether Paubox is a reasonable safeguard for you under s.12(1), and its security documentation names no Canadian region and no Canadian statute (read 2026-09-23).

Three gaps stand out for a Canadian therapist.

No Canadian data storage

Paubox’s security page names no Canadian region. As far as its documentation shows, email processing, data storage, encryption keys and audit logs all sit on US servers, with no Canadian data center option.

For a US healthcare provider subject only to HIPAA, this doesn’t matter. HIPAA does not require domestic data storage.

But Canadian health privacy law treats cross border data transfer as a risk factor that must be evaluated. Under PHIPA email requirements, health information custodians must take reasonable steps to protect personal health information (s.12(1)). Storing it outside Canada isn’t prohibited. It’s a risk you should assess, and a privacy impact assessment is a good place to record that assessment.

No Canadian audit trail

When you send an email through Paubox, the encryption event is logged on Paubox’s US infrastructure. That log shows what was encrypted and when. But it’s stored on US servers, subject to US law, and accessible under US legal process (including the CLOUD Act).

A Canadian audit trail means: encryption events logged on Canadian servers, subject to Canadian law, accessible under Canadian legal frameworks, and demonstrably within the jurisdiction of the Information and Privacy Commissioner of Ontario (IPC) or equivalent provincial authority.

Paubox doesn’t provide this. If the IPC requests documentation of your email safeguards, your audit trail lives on servers in another country, under another country’s legal framework.

No PHIPA framework alignment

HIPAA and PHIPA share some conceptual ground (both require safeguards for health information), but the specifics diverge. PHIPA has different consent requirements, different breach notification obligations, different definitions of personal health information, and different enforcement mechanisms. A product that satisfies HIPAA’s administrative, physical, and technical safeguard requirements does not automatically satisfy PHIPA s.12(1)‘s reasonable steps test. The two statutes ask different questions and define compliance differently.

Paubox’s compliance documentation, BAA templates, and security controls are designed for HIPAA. We found no PHIPA equivalent: no Canadian service agreement, and no documentation mapping Paubox’s controls to PHIPA s.12(1), to College of Registered Psychotherapists of Ontario (CRPO) Standard 3.4, or to any other Canadian regulatory body’s practice standards. If your college asks how you protect client email under its electronic practice standards, you’d be building that answer yourself.

What is the data residency gap?

What is the data residency gap?
Feature	Paubox	Canadian alternative
Data processing location	US	Message content on Google’s servers outside Canada; audit trail and encrypted portal messages stored in Montreal
Audit trail location	US	Canada
Applicable law for stored data	US (CLOUD Act, Patriot Act)	Canadian law (PIPEDA, provincial statutes) for data stored in Canada; the CLOUD Act still reaches a US provider’s data wherever it’s stored (18 U.S.C. §2713)
IPC jurisdiction over stored data	No	Yes
Privacy Impact Assessment required	Only for Alberta custodians (HIA s.64), regardless of vendor location; recommended but not legally required in Ontario and BC	Same: legally required for Alberta custodians under HIA s.64, recommended practice elsewhere
PHIPA s.12(1) alignment documentation	None	Available

Data residency is not a binary pass/fail under Canadian health privacy law. PHIPA does not explicitly prohibit storing health information outside Canada. Neither does Alberta PIPA, the statute most private practices answer to. BC’s Personal Information Protection Act (PIPA) takes a similar position.

But all three provinces treat cross border storage as a risk factor that must be addressed.

How each province treats cross border storage

In Ontario, the IPC has stated that health information custodians must consider the risks of storing personal health information in jurisdictions where Canadian privacy protections may not apply. In BC, the Office of the Information and Privacy Commissioner treats cross border storage as relevant to the BC PIPA reasonable security standard under s.34. In Alberta, the Office of the Information and Privacy Commissioner of Alberta (OIPC Alberta) considers data location in its review of custodians’ Privacy Impact Assessments under HIA s.64.

The question isn’t “is it illegal to use Paubox in Canada?” It isn’t. The question is whether relying exclusively on US infrastructure meets the “reasonable” standard your provincial privacy commissioner would apply. And whether you can justify that choice if asked.

US encryption vs Canadian compliance infrastructure

Paubox encrypts email, which is the practical way to meet the safeguards duty for email. It’s one part of what you’d show a regulator. But encryption alone is not compliance.

The difference between “email is encrypted” and “email is encrypted for Canadian health privacy law” comes down to four additional components: (1) a Canadian audit trail that documents every encryption event, (2) a precise statement of where your data is stored and processed, (3) alignment with the specific provincial privacy statute governing your practice, and (4) documentation that maps the product’s controls to your obligations under PHIPA or PIPA.

Paubox provides component one (encryption) without components two through four. It’s not that their encryption is weak. It’s that encryption alone doesn’t satisfy the broader reasonable safeguards test that Canadian provincial statutes apply.

The four components test

Think of it this way. If the IPC asked you to demonstrate the safeguards protecting your client emails, you’d want to show:

Every email was encrypted (Paubox does this)
Every encryption event was logged in an audit trail you control (Paubox’s logs are on US servers under US law)
You can say precisely where your health information is stored and processed (Paubox’s documentation names no Canadian region)
You can map your email system’s controls to your obligations under PHIPA or PIPA (Paubox’s documentation names no Canadian statute)

One out of four isn’t zero. But it isn’t enough, and no product can carry your compliance for you.

What should Canadian therapists evaluate?

Before choosing any email encryption product, run through this evaluation. It applies to Paubox, to Curio, to Hushmail and to anything else you’re looking at.

Canadian email encryption evaluation checklist:

Does the provider store data on Canadian servers?
Is there a Canadian audit trail (encryption events logged in Canada)?
Does the provider offer a service agreement aligned with PHIPA or PIPA?
Can you demonstrate to your college (CRPO, the College of Alberta Psychologists (CAP), the College of Health and Care Professionals of BC (CHCPBC)) that the product meets their electronic practice standards?
If data is stored outside Canada, can you document the cross border transfer justification in a Privacy Impact Assessment?
Is the audit trail held by a provider outside US legal process? (The CLOUD Act reaches a US provider’s data wherever it’s stored.)
Does the product price in CAD with Canadian billing?

For Paubox, based on what its documentation shows, the answer to six of the seven is no. Question five is yes, and the work is yours.

That doesn’t make Paubox a bad product. It makes it a product built for a different country’s compliance requirements.

Pan-Canadian note

These gaps apply whether you practise in Ontario, Alberta or BC. None of Ontario’s PHIPA or the Alberta and BC PIPAs bans storage outside Canada, and all three require safeguards you can demonstrate. None of them are satisfied by HIPAA compliance alone.

If you practice in Ontario, your obligations under PHIPA s.12(1) and CRPO Standard 3.4 are not met by a product built for HIPAA with no Canadian mapping. The same logic applies in Alberta (Alberta PIPA s.34, CAP practice standards) and BC (PIPA s.34, with CHCPBC psychotherapy regulation beginning November 29, 2027).

For a full comparison of how email privacy requirements differ by province, see the email privacy laws across Canada guide.

Honest limitations of this analysis

This is a comparison written by a company that competes with Paubox. We’ve tried to be factual and fair, but you should know the bias exists.

Curio has limitations that matter here. Our audit trail and encrypted portal messages are stored in Montreal, and the gateway that checks each send runs there too. But email content still passes through Gmail before it reaches us, and Gmail stores it on Google’s servers outside Canada. We don’t collect or manage consent. We don’t support lock box directives.

If your requirement is that email content never leaves Canadian servers at any point in the transmission chain, neither Paubox nor Curio solves that, and no email service can promise it once a message reaches the recipient’s own mail server. Hushmail comes closest on storage: it says its servers are in Canada. The tradeoff is that your secure messages go through Hushmail rather than Gmail, even in its setup that keeps your current email.

No option is perfect. The honest answer is that you’re choosing which tradeoffs are acceptable for your practice, your province, and your risk tolerance.

Key takeaways

No email product is PHIPA compliant on its own, and Paubox doesn’t claim to be. Its security documentation names no Canadian region.
HIPAA compliance does not equal PHIPA compliance. The frameworks share concepts but differ in specifics.
No statute requires a private practice therapist to write a Privacy Impact Assessment before using Paubox. If you use it, recording the cross border risk in one is good practice.
Encryption is one safeguard, not the whole duty. No Canadian statute requires a Canadian audit trail or Canadian processing. Both make the safeguards you rely on easier to show.
Evaluate any email encryption product against your specific provincial obligations (PHIPA or PIPA) rather than assuming US healthcare compliance transfers to Canada.

Curio’s compliance infrastructure is Canadian. Audit trail and encrypted portal messages hosted in Montreal. Automatic encryption for every send. Start now.

Curio holds every client email to Canadian mental health privacy law and keeps the record that it did. It is not a substitute for professional legal or compliance advice. Consult a qualified privacy professional for your specific situation.

This content is for informational purposes only and does not constitute legal advice. Privacy regulations vary by province and are subject to change. Verify current requirements with your provincial regulatory body.

Is Paubox PHIPA compliant for Canadian therapists?

What Paubox does well