Healthcare cybersecurity · HIPAA email & data protection
Virtru
Virtru provides data-centric encryption for email and files inside Google Workspace and Microsoft 365 so healthcare organizations can share PHI with persistent access controls. It is not an IoMT device security platform.
Strong fit
- Health systems and digital health vendors that need encryption that stays with Gmail, Outlook, and shared files, with controls to revoke or expire access
- Teams that work in Google Workspace or Microsoft 365 and want HIPAA email without changing mail providers
- Buyers comparing mid-sized tools that protect patient data itself, rather than a full hospital security operations or medical device platform
Weak fit
- Solo therapy practices that only need low-cost secure webmail with forms
- Buyers shopping for medical device discovery or vendor risk assessment suites
- Groups that refuse browser extension or gateway controls and want only on-site mail gateways
Bottom line
Virtru is worth using for healthcare IT teams that want encryption and access controls on email and files inside Google Workspace and Microsoft 365. It suits teams that need to revoke or expire shared patient information. Clinics that want simple portal-free email with published pricing may prefer Paubox.
Score breakdown
Weights: Outcomes 35% · Product 30% · Implementation 20% · Pricing clarity 15%.
Virtru is a data security company in Washington, D.C., co-founded in 2012 by CEO John Ackerly and chief architect Will Ackerly. It has about 200 to 270 employees and raised a Series D in mid-2025.
Its core product encrypts email and files inside Google Workspace and Microsoft 365. Access controls such as revoke and expiration travel with the data, which is the main reason healthcare IT teams adopt it.
It is HIPAA email and file protection, not a medical device inventory platform or a webmail inbox for therapy practices.
Setup is usually a change to mail and sharing controls rather than a months-long EHR project.
Prices are quoted for each customer and are less clear than Paubox's starter plans.
Among the HIPAA email tools we review, Virtru scores just below Paubox on simple clinic email without a portal. It scores above LuxSci and Hushmail when lasting file controls and deep Workspace support matter more than high-volume marketing email or therapy practice webmail.
Paubox suits outgoing clinic email without a portal and has published starter prices. LuxSci suits high-volume marketing email through an API, and Hushmail suits solo behavioral health practices that want secure forms included.
Competitor landscape
| Vendor | Overall | Ease of implementation |
|---|---|---|
| Paubox | 7.5 | 7.3 |
| Virtru | 7.4 | 7.2 |
| PreVeil | 7.3 | 7.4 |
| Hushmail | 6.8 | 7.2 |
| LuxSci | 6.8 | 6.6 |
| Trustifi | 6.7 | 7.0 |
| Protected Trust | 6.7 | 6.8 |
| DataMotion | 6.6 | 6.4 |
Pricing
| Item | Detail |
|---|---|
| Model | A subscription for larger buyers that encrypts email, files, and cloud app data, with gateway and client options. Priced by quote. |
| What usually drives cost | Number of protected users, gateway or client modules, public-sector or commercial package, and support level. |
| What to ask before you buy | Full yearly cost for your protected mailboxes and Drive or SharePoint volume, including gateway automation and admin seats. |
| Published pricing | Virtru does not publish fixed prices for healthcare packages. Request a quote through virtru.com. |
Prerequisites for purchase
| Need | Why it matters |
|---|---|
| What you need to get Virtru to function | |
| A named IT owner for encryption rules in Workspace or Microsoft 365 | Controls stall without an owner. |
| A list of the ways patient data is emailed and shared | Unofficial sharing brings back the risk of unencrypted data. |
| BAA and retention rules agreed with legal | Security tools fail audits without the paperwork. |
| An agreed experience for people who receive messages | Unexpected portals or readers push people to workarounds. |
| Admin seats and leak prevention keywords defined | Gateway rules fail if the scope is vague. |
| What will maximize your value | |
| Encrypt mail from the main senders of patient data within 30 days | Covering only some email leaves the risk in place. |
| Enable revoke and expiration on sensitive shares | Lasting control is the point of the product. |
| Drop overlapping encryption add-ons | Duplicate tools confuse users. |
| Deal-breakers | |
| No way to get a BAA for your account | |
| IT refuses any client or gateway control | |
| You only need patient text messaging | |
Value creation time frame
| # | Stage | Typical range |
|---|---|---|
| 1 | Pilot on one department | 1-2 weeks |
| 2 | Policy and gateway rollout | 2-6 weeks |
| 3 | Ongoing admin | ongoing |
Leadership
Methodology
| Weight | Factor | What it measures |
|---|---|---|
| 35% | Customer outcomes | Whether buyers get measurable operational or clinical-workflow results after go-live |
| 30% | Product | Capability depth, reliability, and fit for the job the category buys |
| 20% | Implementation | How hard it is to stand up, integrate, train, and stabilize |
| 15% | Pricing clarity | Whether a buyer can model total cost without a mystery quote |
| Label | Meaning |
|---|---|
| Highly recommend | Strong outcomes and product with manageable caveats |
| Recommend | Solid fit for the right buyer; know the tradeoffs |
| Conditional | Only with a specific use case or heavy caveats |
| Not recommended | Avoid for most buyers in this category |
Read our full methodology for how we weight scores and assign recommend labels.