--- title: "Best VPN for Healthcare: What to Ask Before You Buy" description: "A VPN alone does not make a practice HIPAA compliant. See which business VPNs say they sign a BAA, by plan, and what to ask before patient data crosses one." url: "https://www.vpn.com/vpn/best-vpn-for-healthcare/" lang: "en" updated: 2026-10-29 --- > **Bottom Line:** Ask any VPN company for a signed business associate agreement (BAA) before patient data crosses it, and expect the answer to depend on your plan: NordLayer says it signs one only on annual or longer billing, and Cloudflare says only with enterprise customers. A VPN alone does not make a practice HIPAA compliant. ## What this page is for This page is for a practice manager or owner choosing a business VPN. It sits under our [best VPN for business](https://www.vpn.com/vpn/best-vpn-for-business/) guide, which covers what a business VPN is and how it differs from a personal one. For larger organisations see the [enterprise VPN guide](https://www.vpn.com/vpn/best-vpn-for-business/enterprise/), and for the general privacy picture the [data protection guide](https://www.vpn.com/cybersecurity/data-protection/). Law firms face a different rule; see [best VPN for law firms](https://www.vpn.com/vpn/best-vpn-for-law-firms/). We do not run our own security tests. Everything vendor-specific below is what the vendor says on its own pages, with the date we read it, and HHS and federal regulation text are linked under Resources. This is general information, not legal advice. ## Is there a HIPAA compliant VPN? No. HHS says the Office for Civil Rights does not endorse, certify or recommend specific technology or products, so no VPN carries a government HIPAA certification. Cloudflare's own page makes the same point: HHS does not recognize a certification for HIPAA compliance. A vendor can sign a BAA and offer controls that support your programme. A VPN alone does not make you compliant. ![Two columns: a VPN can cover patient data in transit, but it does not replace the risk analysis, your policies, vendor contracts including the BAA, staff training or audit controls](https://www.vpn.com/images/uploads/2026/10/healthcare-vpn-safeguard-not-programme.webp) ## What to ask a VPN company before patient data crosses it 1. **Will you sign a BAA, and on which plan and billing term?** Get the answer in writing. NordLayer says it will not sign on monthly billing. 2. **Is the VPN product itself covered by the BAA?** A company can sign a BAA for one product and not another. Proton, for example, says it offers BAAs to all users, but we could not confirm from public pages that the VPN is covered. 3. **Which controls come with my plan?** Dedicated IP, single sign-on (SSO) and multi-factor sign-in (MFA) are gated by plan at the vendors below. 4. **What happens before the BAA is signed?** NordLayer says patient data may not go through it until the BAA is executed, so a monthly trial is for testing without patient data. ![Decision flow: will the VPN company create, receive, maintain or transmit patient data for you. If it holds the data, it is a business associate and a BAA comes first. If it only transmits, a narrow conduit exception may apply. If unsure, ask for the BAA in writing and ask your counsel](https://www.vpn.com/images/uploads/2026/10/healthcare-vpn-baa-decision-flow.webp) ## Which plans say they sign a BAA Every row is what the vendor says on its own pages, read on 8 October 2026, with NordLayer, Cloudflare and Proton read again on 29 October 2026. A vendor page is evidence of what the vendor says, not of what it will sign. | Provider | What it says about a BAA | Plan or term condition | Source | |---|---|---|---| | [NordLayer](https://www.vpn.com/out?partner=nordlayer&placement=use-case-body) | Signs a BAA | Annual or longer billing only | [NordLayer help centre](https://help.nordlayer.com/docs/nordlayer-hipaa-baa) | | [Proton VPN for Business](https://www.vpn.com/vpn/protonvpn/) | Offers BAAs to all Proton users | VPN scope not confirmed | [Proton for Business](https://proton.me/business/healthcare) | | Cloudflare Zero Trust | Signs BAAs | Enterprise customers only | [Cloudflare](https://www.cloudflare.com/trust-hub/us-privacy-compliance/) | | [Surfshark VPN for Teams](https://www.vpn.com/vpn/surfshark/) | No statement found | Not stated | n/a | | [ExpressVPN for Teams](https://www.vpn.com/vpn/expressvpn/) | No statement found | Not stated | n/a | Cloudflare has no review page on VPN.com, so it is not linked internally. NordLayer has no review page either, so [NordLayer](https://www.vpn.com/out?partner=nordlayer&placement=use-case-body) links to its own site through our partner link. We earn a commission if you buy NordLayer through it; that does not change what its pages say. ## Final Verdict | If this is your situation | Start the conversation with | |---|---| | You want a BAA on a standard business plan | NordLayer on annual billing, or Proton for Business. Ask each to confirm in writing that the VPN product is covered | | You already hold an enterprise contract with a network vendor | Cloudflare, which says it signs BAAs only with enterprise customers | | You need a dedicated IP on a small plan | NordLayer Core or above, or Proton Professional, as each vendor says | | A vendor will not confirm its position in writing | Do not send patient data through it | Whatever you pick, the VPN is one safeguard. Your risk analysis, staff training and vendor contracts are what a regulator asks about. ## Frequently Asked Questions ### Does a VPN company need to sign a business associate agreement with a medical practice? It depends on whether the VPN company counts as a business associate. HHS defines one as a company that creates, receives, maintains or transmits patient data on a practice's behalf, and limits the "conduit" exception to transmission-only services. We found no HHS ruling on VPNs, so when in doubt, ask for the BAA. This is not legal advice. ### Is there such a thing as a HIPAA compliant VPN for healthcare? No. HHS says it does not endorse, certify or recommend specific technology products, so no VPN holds a government HIPAA certification. A vendor can sign a BAA and offer supporting controls, but a VPN alone does not make a practice compliant. Treat "HIPAA compliant VPN" as a marketing phrase. ### Which VPN providers say they will sign a BAA, and on which billing plan? Of the business VPNs we checked, NordLayer says it signs only on annual or longer billing, Proton says it offers BAAs to all Proton users, and Cloudflare says it signs only with enterprise customers. We found no BAA statement for Surfshark's or ExpressVPN's team plans. Read on 8 and 29 October 2026. ### Can a practice start on a monthly plan and sign the BAA later? Not for real patient records. NordLayer says BAAs are unavailable on monthly plans and that no patient data may go through its service until one is signed. A monthly plan can work for testing with no patient data. Check your own vendor's terms before you load anything real. ### Does HIPAA require a VPN for a medical practice? No. HHS says the HIPAA Rules do not endorse or require specific types of technology. The Security Rule lists encryption of data in transit as addressable, to use whenever deemed appropriate (45 CFR 164.312). Whether a VPN is how you do that is a risk-analysis decision. A VPN alone does not make you compliant. ### Do a practice's VPN logs matter for HIPAA audit controls? The Security Rule asks for ways to record and examine activity in systems that hold patient data (45 CFR 164.312). Whether a VPN's logs, or a no-logs promise, matter to that duty is a question for your risk analysis and counsel. We do not give a rule of thumb here. ### Why would a clinic want a dedicated IP address on its VPN? A dedicated IP gives the clinic one fixed address, so a system can be set to accept connections only from it. NordLayer says Core and above can add a dedicated-IP server for an extra monthly fee. Whether a given records system supports that is a question for its own vendor. ### Do staff need single sign-on and multi-factor sign-in on a business VPN? They are choices, not named product requirements. Single sign-on ties VPN access to your staff accounts, so removing a leaver in one place removes their access. Multi-factor sign-in asks for a second proof beyond a password. Proton says SSO is on its Professional plan, and NordLayer lists SSO and MFA. ### Does a VPN replace the HIPAA risk analysis for a practice? No. The Security Rule requires an accurate and thorough assessment of risks to patient data (45 CFR 164.308), and HHS says encryption alone cannot adequately safeguard it. A VPN is one control you may choose after that analysis. A VPN alone does not make a practice compliant. ### Can a practice use a free or consumer VPN for patient records? Do not assume so. The BAAs described above come with particular plans or billing terms, such as annual billing or an enterprise contract, and Proton's scope for its VPN is unconfirmed. A free or consumer plan is not shown to come with one. Without a BAA, patient data should not cross it. ## Resources - [HHS: 2024 Report to Congress on the Breach Notification Program](https://www.hhs.gov/sites/default/files/breach-report-to-congress-2024.pdf) - [HHS: Guidance on HIPAA and Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) - [HHS: Are the US Postal Service and similar couriers business associates?](https://www.hhs.gov/hipaa/for-professionals/faq/245/are-entities-business-associates/index.html) - [45 CFR 164.312, technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312) - [45 CFR 164.308, administrative safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308) - [NordLayer: Does NordLayer offer a HIPAA BAA?](https://help.nordlayer.com/docs/nordlayer-hipaa-baa) - [NordLayer pricing](https://nordlayer.com/pricing/) - [Proton for Business: healthcare](https://proton.me/business/healthcare) - [Cloudflare: US privacy law compliance FAQs](https://www.cloudflare.com/trust-hub/us-privacy-compliance/)