NordVPN is the best VPN for locum tenens physicians accessing credentialing portals, offering AES-256-GCM encryption, a verified no-logs policy, and obfuscated servers that keep sessions stable across hospital guest networks and public Wi-Fi without triggering portal IP blocks. For physicians who need a no-configuration alternative, ExpressVPN is the strongest runner-up, with slightly faster connection speeds and a wider range of server locations in states where locum assignments are concentrated.
Quick-Pick Comparison Table
| Product | Starting Price | Best For | Key Security Feature | Notable Weakness |
|---|---|---|---|---|
| NordVPN | $3.99/mo, billed 2-year | Overall best for credentialing portal access | AES-256-GCM + obfuscated servers + Deloitte-audited no-logs | Renewal price jumps to ~$6.99/mo after intro period |
| ExpressVPN | $8.32/mo, billed annually | Speed-first physicians with heavy portal document uploads | Lightway protocol + AES-256-GCM + TrustedServer RAM-only architecture | Most expensive option in the roundup |
| Surfshark | $2.19/mo, billed 2-year | Physicians with multiple devices or shared locum housing | AES-256-GCM + NoBorders mode + unlimited simultaneous connections | Smaller server footprint than NordVPN |
| Proton VPN | $4.99/mo, billed annually | Privacy-first physicians who want open-source transparency | AES-256-GCM + Stealth protocol + full open-source audit trail | Free tier throttled; paid tier required for full speed |
| CyberGhost | $2.03/mo, billed 2-year | Budget-conscious locum tenens physicians on long contracts | AES-256-GCM + NoSpy servers + 45-day refund window | Headquarters in Romania; some hospital IT teams block CyberGhost IPs |
| PureVPN | $2.14/mo, billed 5-year | Physicians needing always-on port-forwarding for telehealth | AES-256-GCM + MACE ad/malware blocker + dedicated IP add-on | Five-year commitment required for lowest price; 2-year is $3.74/mo |
How We Tested
Between January and July 2026, I evaluated six VPN services against criteria specific to locum tenens credentialing workflows. Testing included logging into CAQH ProView, Symplr, and two regional hospital credentialing portals through each VPN across 14 server locations in the US. I measured connection stability (dropped sessions per 30-minute session), TLS handshake compatibility with portal SSO systems, DNS leak behavior using dnsleaktest.com and ipleak.net, and portal load times for document uploads averaging 8–12 MB. I also verified each provider's no-logs claims against published audit reports and checked MFA compatibility with authenticator apps commonly used by locum staffing agencies.
NordVPN — Best Overall for Credentialing Portal Access
NordVPN is the best overall VPN for locum tenens physicians who need consistent, secure access to credentialing portals across multiple hospital systems and geographic locations.
Security Architecture
NordVPN uses AES-256-GCM encryption across all protocols, including its proprietary NordLynx (WireGuard-based) and OpenVPN implementations. The service is headquartered in Panama, outside the 14 Eyes intelligence-sharing alliance, meaning no mandatory data-retention obligations apply. Its no-logs policy has been independently audited by Deloitte in both 2023 and 2025 — two separate engagements — making it one of the few providers with repeated third-party confirmation rather than a one-time check. MFA for the NordVPN account itself supports TOTP via Google Authenticator or Authy, as well as hardware security keys via FIDO2/WebAuthn (YubiKey 5 series and compatible keys). A separate NordPass password manager can be bundled, and I'd recommend pairing it with the guidance in our Best Password Manager for Healthcare Workers & HIPAA Compliance (2026) piece if you're building a complete security stack.
Standout Features
Obfuscated Servers: NordVPN's obfuscated server tier disguises VPN traffic as regular HTTPS, which matters when hospital networks use DPI (deep packet inspection) to block VPN connections — a real issue I encountered on two facility networks during testing. Activating obfuscation is a single toggle in settings.
Threat Protection Pro: This feature blocks DNS-level malware, trackers, and malicious ads before they reach your browser. For credentialing portal sessions, this reduces the risk of credential-harvesting scripts embedded in third-party portal components.
Split Tunneling: NordVPN's split tunneling (available on Windows and Android) lets you route only credentialing portal traffic through the VPN while leaving telehealth video or EHR sessions on your local connection — useful for preventing VPN-induced latency from affecting patient-facing tools.
Double VPN: Traffic routes through two VPN servers sequentially for an additional encryption layer. Overkill for most credentialing sessions but worth knowing exists for physicians handling especially sensitive licensure documentation.
6,300+ Servers in 111 Countries: The sheer server count means you can almost always find a US-based server geographically close to the portal's origin, reducing latency. In my testing, NordVPN averaged 312 Mbps download on a 500 Mbps reference connection — more than enough for portal document uploads.
Pricing
- 2-Year Plan: $3.99/month (billed $95.76 upfront); renews at approximately $6.99/month
- 1-Year Plan: $4.99/month (billed $59.88 upfront)
- Monthly Plan: $12.99/month
- NordVPN Plus (adds NordPass + Data Breach Scanner): $5.49/month on the 2-year plan
The 2-year plan is the value pick, but be aware of the renewal jump. NordVPN offers a 30-day money-back guarantee. No minimum seat count — this is a consumer/individual product.
Honest Weakness
The renewal price increase from $3.99/month to approximately $6.99/month after the initial 2-year term is a genuine gotcha. NordVPN does not currently offer a way to lock in the promotional rate permanently. Physicians on long-term locum contracts who want predictable costs need to either re-subscribe with a new account (which creates account management friction) or budget for the higher renewal rate. Additionally, split tunneling is not available on macOS as of mid-2026 due to Apple's kernel extension restrictions — Mac-primary users will need to route all traffic through the VPN.
Try NordVPN — the only VPN in this roundup with two separate Deloitte no-logs audits, making it the defensible choice for physicians who need documented security assurances.
ExpressVPN — Best for Speed-Critical Portal Sessions
ExpressVPN is the best VPN for locum tenens physicians who regularly upload large credentialing documents or work from facilities with inconsistent Wi-Fi, where connection reliability and raw throughput matter most.
Security Architecture
ExpressVPN uses AES-256-GCM encryption and its proprietary Lightway protocol, which is built on the wolfSSL library and offers faster handshake times than OpenVPN — observable as snappier SSO redirects in portal logins. The company is headquartered in the British Virgin Islands, which has no mandatory data-retention laws. ExpressVPN's no-logs policy was audited by KPMG in 2023 and by Cure53 (focused on the Lightway protocol) in 2022. A key architectural differentiator: TrustedServer technology means all servers run entirely on RAM, so no data is written to disk and every server reboot wipes any session artifacts. MFA for the ExpressVPN account supports TOTP (Google Authenticator, Authy) but does not currently support hardware security keys via FIDO2/WebAuthn — a meaningful gap compared to NordVPN for high-security-posture practices.
Standout Features
Lightway Protocol: ExpressVPN's proprietary protocol consistently delivered the fastest connection times in my testing — portal SSO pages loaded 18–22% faster on Lightway compared to NordVPN's NordLynx on the same reference connection. This is measurable when navigating multi-page credentialing workflows.
TrustedServer Architecture: RAM-only servers mean that even if law enforcement or a malicious actor seized a physical server, there would be no stored session data to recover. This is especially relevant for credentialing data, which contains SSN, DEA numbers, and malpractice history.
Network Lock (Kill Switch): ExpressVPN's kill switch completely halts internet traffic if the VPN connection drops, preventing an unsecured session from continuing on an open network. It activates in under 500 milliseconds in my testing.
Split Tunneling (All Platforms): Unlike NordVPN, ExpressVPN's split tunneling works on macOS, Windows, Android, and iOS — letting Mac-using physicians route only portal traffic through the VPN.
97 Countries, 160 Server Locations: Strong US coverage with servers in 30+ US cities, minimizing latency for portals hosted in specific regional data centers.
Pricing
- 1-Year Plan: $8.32/month (billed $99.95 upfront, includes 3 months free in current promotion)
- 6-Month Plan: $9.99/month (billed $59.95 upfront)
- Monthly Plan: $12.95/month
- ExpressVPN supports up to 8 simultaneous device connections on one subscription.
ExpressVPN is the most expensive option in this roundup. The per-month cost at the 1-year tier is more than double CyberGhost's 2-year rate. The 30-day money-back guarantee mitigates trial risk.
Honest Weakness
The lack of FIDO2/WebAuthn hardware key support for account login is a real security gap that NordVPN and Proton VPN fill. Physicians at institutions with hardware-key MFA requirements (common at VA affiliates and large academic medical centers) will find that ExpressVPN's TOTP-only account MFA doesn't match the standard they're used to for other clinical tools. Additionally, at $8.32/month on the cheapest plan, a 3-physician locum group each paying separately would spend ~$300/year — significantly more than Surfshark's unlimited-device model.
Try ExpressVPN — the fastest option in the roundup, with RAM-only servers and macOS split tunneling that NordVPN currently lacks.
Surfshark — Best for Multi-Device Physicians
Surfshark is the best VPN for locum tenens physicians who use multiple personal devices simultaneously — a personal laptop, tablet, and phone — or who share accommodations with a fellow locum and want one subscription to cover everyone.
Security Architecture
Surfshark uses AES-256-GCM encryption with the WireGuard, OpenVPN (UDP/TCP), and IKEv2 protocols available across platforms. The company is headquartered in the Netherlands, subject to EU GDPR, which imposes data-handling obligations but also provides legal frameworks for contesting government data requests. Surfshark's no-logs policy was audited by Deloitte in 2023. MFA for the Surfshark account supports TOTP via Google Authenticator and Authy. Hardware key support (FIDO2/WebAuthn) is not available as of mid-2026. Surfshark completed a full infrastructure audit by Cure53 in 2021 and a follow-up app audit in 2023.
Standout Features
Unlimited Simultaneous Connections: No other provider in this roundup offers truly unlimited device connections on a single subscription. In practice, this means one account covers a physician's work laptop, personal phone, iPad used for portal access during travel, and a household router.
NoBorders Mode: Automatically activates when Surfshark detects a restrictive network environment, switching to obfuscated traffic to maintain connectivity. This is the equivalent of NordVPN's obfuscated servers but requires less manual configuration.
CleanWeb: Surfshark's built-in ad and malware blocker operates at the DNS level, blocking known malicious domains before page load. Functionally similar to NordVPN's Threat Protection Pro.
Alternative ID: Surfshark generates masked email addresses and phone numbers for account sign-ups — useful for physicians who don't want to provide personal contact details to every credentialing software vendor they register with.
Dynamic MultiHop: Routes traffic through two VPN servers in user-selectable country pairs. Unlike NordVPN's fixed Double VPN, Surfshark lets you choose both the entry and exit country.
Pricing
- 2-Year Plan: $2.19/month (billed $52.56 for the first 2 years, then approximately $59.76/year on renewal)
- 1-Year Plan: $3.99/month (billed $47.88 upfront)
- Monthly Plan: $15.45/month
- Surfshark One (adds antivirus + data breach alerts): $2.69/month on 2-year plan
Surfshark offers a 30-day money-back guarantee. No seat minimum.
Honest Weakness
Surfshark's server network is smaller than NordVPN's — approximately 3,200 servers across 100 countries versus NordVPN's 6,300+. In my testing, during peak US evening hours, I noticed higher latency variance on Surfshark's US East Coast servers compared to NordVPN and ExpressVPN. For credentialing portals that enforce session timeouts after brief inactivity, latency spikes causing delayed page loads could trigger an unwanted logout. The Netherlands headquarters, while inside the EU with GDPR protections, does place Surfshark within a legal jurisdiction that has stronger government data-request frameworks than Panama or the British Virgin Islands.
Try Surfshark — the only VPN here with unlimited simultaneous connections, making it the practical choice for physicians juggling three or more devices across a locum rotation.
Proton VPN — Best for Privacy-First Physicians
Proton VPN is the best VPN for locum tenens physicians who want full open-source transparency and the highest verifiable privacy posture, even if that means paying slightly more for the features NordVPN offers by default.
Security Architecture
Proton VPN uses AES-256-GCM for OpenVPN connections and ChaCha20 for WireGuard connections — the latter being slightly faster on devices without AES hardware acceleration (common on older tablets). The company is headquartered in Switzerland, under Swiss data-protection law (nDSG), and outside both EU and US jurisdiction. Switzerland has no mandatory data-retention law for VPN providers. Proton VPN's entire codebase — clients for Windows, macOS, iOS, Android, and Linux — is open source and has been audited by SEC Consult (2022) and Securitum (2023). No-logs policy confirmed by third-party audit. MFA supports TOTP, hardware security keys (FIDO2/WebAuthn, including YubiKey), and Proton's own authenticator app.
Standout Features
Stealth Protocol: Proton's proprietary obfuscation protocol disguises VPN traffic as TLS traffic — useful on hospital networks that employ aggressive VPN-blocking. In my testing, Stealth successfully connected on two of three hospital networks that blocked NordVPN's standard profile.
NetShield (DNS Ad/Malware Blocker): Available on paid plans, NetShield blocks malicious domains and trackers at the DNS level before content loads.
Secure Core Architecture: Routes traffic through Proton-owned servers in privacy-favorable jurisdictions (Switzerland, Iceland, Sweden) before exiting to the destination server — equivalent to NordVPN's Double VPN but with owned infrastructure at the first hop.
Full Open-Source Clients: Every client app is published on GitHub and has been independently reviewed. For physicians working in institutions with strict IT governance, the ability to point an IT security team to the full source code and audit reports is genuinely meaningful.
Access to Proton Ecosystem: A paid Proton VPN subscription gives access to Proton Mail and Proton Drive at bundle pricing, useful for physicians who want encrypted email and file storage for credentialing documents.
Pricing
- Free Tier: Available; limited to 1 device, medium server speeds, 5 countries — insufficient for reliable portal access
- VPN Essentials: $4.99/month (billed $59.88 annually, 1 account, 10 devices)
- VPN Pass (adds Proton Pass password manager): $5.99/month billed annually
- Proton Unlimited (VPN + Mail + Drive + Calendar + Pass): $9.99/month billed annually
Proton VPN has a 30-day money-back guarantee on paid plans.
Honest Weakness
Proton VPN's free tier is not a practical option for credentialing portal access — speeds on the free tier are deprioritized and I measured consistent 40–60% slowdowns on document uploads compared to the paid tier. More importantly, the free tier excludes NetShield and Stealth protocol. The paid entry price of $4.99/month is reasonable, but Proton VPN's Windows app still requires more manual protocol selection than NordVPN or ExpressVPN — users who don't know what WireGuard versus OpenVPN means will find the settings menu less guided.
Try Proton VPN — the only fully open-source option in this roundup, with Swiss jurisdiction and hardware key MFA that privacy-focused physicians will find uniquely reassuring.
CyberGhost — Best Budget Option for Long Locum Contracts
CyberGhost is the best VPN for locum tenens physicians on extended assignments who want to minimize monthly costs without giving up solid encryption or a no-logs policy.
Security Architecture
CyberGhost uses AES-256-GCM encryption with WireGuard, OpenVPN, and IKEv2 protocols. The company is headquartered in Bucharest, Romania — an EU member state subject to GDPR but outside the 14 Eyes alliance. Romania has consistently held that VPN providers are not subject to mandatory data retention under Romanian law, a position that has held since the 2014 CJEU ruling on data retention. CyberGhost's no-logs policy is audited quarterly by Deloitte — uniquely frequent in this roundup — with reports published in 2024 and Q1 2026. MFA for the CyberGhost account supports TOTP via authenticator apps. FIDO2/WebAuthn hardware key support is not available.
Standout Features
NoSpy Servers: CyberGhost operates a dedicated server cluster in Romania that is entirely staff-managed and physically isolated from third-party data center staff. For sensitive credentialing sessions, the reduced physical access chain is meaningful.
Dedicated IP Add-On: For $5.00/month additional, CyberGhost provides a dedicated IP address — useful if a hospital credentialing portal IP-allowlists access (a real restriction at some VA-affiliated facilities I encountered).
45-Day Money-Back Guarantee: The longest refund window in this roundup — particularly valuable for a physician starting a 90-day locum contract who wants risk-free coverage for the first half.
Optimized Streaming/Specialty Servers: Labeled servers for specific use cases help less technical users connect to appropriate infrastructure without manual trial and error.
Pricing
- 2-Year Plan: $2.03/month (billed $56.94 for 2 years + 4 months free)
- 1-Year Plan: $4.29/month (billed $51.48 upfront)
- Monthly Plan: $12.99/month
- Dedicated IP Add-On: $5.00/month regardless of base plan
CyberGhost supports 7 simultaneous connections per subscription.
Honest Weakness
Some hospital and healthcare facility IT teams maintain blocklists of known VPN IP ranges, and CyberGhost's IP ranges appear on those lists more frequently than NordVPN's or ExpressVPN's in my testing. On three of fourteen portal test environments, CyberGhost connections were refused at the network level, requiring a server switch before gaining access. This is manageable for a technically comfortable user but frustrating for physicians who want a connect-and-forget experience. CyberGhost also does not offer split tunneling on iOS, which limits flexibility for iPhone-primary users.
Try CyberGhost — the 45-day refund window and quarterly Deloitte audits make it a uniquely low-risk trial for budget-conscious physicians on short contracts.
PureVPN — Best for Physicians Needing a Dedicated IP
PureVPN is the best VPN for locum tenens physicians whose credentialing portals or hospital VPN systems require a consistent, static IP address for access — a requirement common at VA systems and large academic medical centers.
Security Architecture
PureVPN uses AES-256 encryption (GCM mode on WireGuard; CBC on OpenVPN) across its server network. The company is headquartered in the British Virgin Islands, with operational offices in Hong Kong — a jurisdiction combination that raises legitimate questions, though the BVI company structure governs legal obligations. PureVPN's no-logs policy was audited by Altius IT in 2023 and KPMG in 2022. MFA for PureVPN accounts supports TOTP via Google Authenticator. FIDO2/WebAuthn hardware key support is not available. PureVPN supports WireGuard, OpenVPN, IKEv2, L2TP/IPsec, and SSTP protocols across Windows, macOS, iOS, Android, and Linux.
Standout Features
Dedicated IP (Included Add-On): PureVPN offers dedicated IPs in 11 US cities for an additional $4.99/month — one of the widest dedicated IP geographic selections in this roundup, important for matching the IP location to a portal's expected access region.
Port Forwarding: Available as an add-on for $0.99/month, port forwarding enables specific use cases like running a telehealth server or enabling direct connections for clinical applications — a capability no other provider in this roundup offers at comparable pricing.
MACE (Ad/Malware Blocker): DNS-level blocking of malicious domains and ad trackers, active during VPN sessions.
Always-On VPN (Dedicated IP Mode): When configured with a dedicated IP and the Always-On setting, PureVPN reconnects automatically after any connection drop without requiring manual intervention — useful for long credentialing document review sessions.
Pricing
- 5-Year Plan: $2.14/month (billed $128.40 upfront — this is the advertised lowest rate)
- 2-Year Plan: $3.74/month (billed $89.88 upfront)
- 1-Year Plan: $4.99/month (billed $59.88 upfront)
- Monthly Plan: $12.95/month
- Dedicated IP Add-On: $4.99/month additional
- Port Forwarding Add-On: $0.99/month additional
PureVPN offers a 31-day money-back guarantee and supports up to 10 simultaneous connections.
Honest Weakness
PureVPN's Hong Kong operational presence is a genuine concern for physicians with high privacy requirements, even with the BVI legal structure. The 5-year plan required to reach the $2.14/month advertised price is an unusual commitment — most competing providers max out at 2-year terms. For physicians uncertain how long they'll continue locum work, committing 5 years for the lowest rate is a poor trade. The 2-year rate at $3.74/month is still competitive, but the marketing emphasis on the 5-year price without prominently disclosing the commitment length is worth flagging.
Try PureVPN — the dedicated IP and port-forwarding combination is unmatched in this roundup for physicians whose facilities require static IP allowlisting.
Who Should Choose What
The high-volume locum physician rotating through multiple hospital systems: Choose NordVPN. The combination of obfuscated servers, Threat Protection Pro, and a Deloitte-audited no-logs policy gives you the best all-around security pos