Is Gmail HIPAA Compliant? Email Options for Medical Practices

It's one of the most common questions we get from new practices, usually because someone has been sending referrals from a @gmail.com address since before the practice had a name. The short answer: a free Gmail account is not suitable for patient information. A paid business email service can be — but not automatically, and not just because you're paying for it.

No email service is "HIPAA compliant" by itself

HIPAA applies to your practice, not to a product. What an email service can do is support your compliance by signing a business associate agreement (BAA) and offering the safeguards you need. Whether you're compliant depends on how it's configured and used. A vendor's "HIPAA compliant" badge means they'll sign a BAA; it doesn't mean your account is set up properly.

Free Gmail: no

Personal @gmail.com accounts aren't eligible for Google's BAA — it's an amendment to a Google Workspace agreement, which a personal account doesn't have. Without a BAA, patient information shouldn't be in that account at all — not in sent mail, not in the inbox, not in attachments. If your practice has been using one, the fix is to move to a business service and stop using the old account for anything patient-related.

Google Workspace: yes, once the BAA is accepted

Google Workspace — the paid business version — offers a BAA, but it isn't in place until an administrator reviews and accepts it in the Workspace admin console. It also only covers the Google services listed in it, so confirm the ones you use are included, and turn off the ones that aren't if staff might put patient data in them.

Microsoft 365: yes, with configuration

Microsoft makes its HIPAA BAA available by default, through its Online Services Data Protection Addendum, to customers that are covered entities or business associates. Its in-scope services include Exchange Online email, SharePoint, OneDrive and Teams. As with Google, the agreement covers Microsoft's side; the configuration is yours.

What "set up properly" means

• The BAA is signed or accepted, and you've kept a copy
• Multi-factor authentication is on for every account — email is the most attacked system in any practice
• Every person has their own mailbox; shared mailboxes are accessed through individual logins
• Encryption is available, and staff know how to use it for messages leaving the practice
• Former staff accounts are disabled the day they leave
• Your domain's email authentication (SPF, DKIM and DMARC) is set, so nobody can send email pretending to be you

Do we have to encrypt every email?

HIPAA treats encryption as an "addressable" safeguard, which doesn't mean optional. It means you implement it if it's reasonable and appropriate — and if you decide it isn't, you must document why and put an equivalent alternative in place where that's reasonable. For email leaving the practice with patient data, few practices can make that case. Most mail between modern business email services is already encrypted in transit. For messages leaving the practice with patient information, what's available depends on your plan. Microsoft 365's message encryption is included in some business plans and an add-on for others; Google Workspace's encryption options vary by edition, and Gmail's "confidential mode" is not a substitute for encryption. Where your plan doesn't include it, a secure-email add-on or a patient portal does the job.

Patients can also ask to receive information by regular, unencrypted email. HHS allows that if you've warned them of the risk and they still prefer it. Record that they asked.

The other email risk: someone pretending to be you

Even a perfectly configured mailbox doesn't stop a criminal sending email that appears to come from your practice's domain, unless your SPF, DKIM and DMARC records are in place. That's how fake "please update your payment details" emails reach patients and vendors. Our free email spoofing check tells you in a few seconds whether your domain is exposed.

Where to start

If you're still on a free account: move to Google Workspace or Microsoft 365, accept the BAA, turn on multi-factor sign-in, and set up encryption — in that order. If you're already on one of them, check the BAA exists and that multi-factor authentication is on for every account. Those two items close most of the gap.

Email is one of ten things covered in our free HIPAA self-check. If you'd like it set up for you, that's part of our HIPAA security service — and we'll sign our own BAA before we touch anything.