Is Gmail HIPAA compliant? Only when used through a paid Google Workspace account with a signed Business Associate Agreement. Free @gmail.com accounts are not HIPAA compliant and should never be used to send or receive protected health information.
Email is the most common communication tool in healthcare offices. Staff use it to coordinate with other providers, send referrals, respond to insurance inquiries, and sometimes communicate with patients. If your practice uses Gmail, the compliance question comes down to one thing: which type of Gmail account are you on?
Free Gmail vs. Google Workspace Gmail
This is the most important distinction. There are two completely different products that both use the Gmail interface:
- Free Gmail (@gmail.com) - personal email accounts. No BAA available. Not HIPAA compliant under any configuration. Google scans these emails for features like Smart Compose and spam filtering under consumer terms of service.
- Google Workspace Gmail (@yourdomain.com) - business email through a paid Google Workspace plan. BAA available. Can be HIPAA compliant with proper configuration.
If your practice sends patient information from a @gmail.com address, that is a HIPAA violation every time it happens. There is no workaround. Free Gmail has no BAA, no admin controls, and no audit logging. It does not matter if the email is encrypted in transit - the BAA requirement exists independently of encryption.
Which Google Workspace Plans Cover Gmail?
Google includes Gmail in the HIPAA-covered services for all paid Google Workspace plans:
- Google Workspace Business Starter
- Google Workspace Business Standard
- Google Workspace Business Plus
- Google Workspace Enterprise
The BAA covers Gmail along with Google Drive, Docs, Sheets, Meet, Calendar, and Chat. One agreement covers all core Workspace services - you do not need separate BAAs for each product.
How to Get a BAA from Google
The process is the same as for Google Drive:
- Log into the Google Admin console (admin.google.com)
- Navigate to Account > Account settings
- Find the HIPAA Business Associate Amendment
- Review and accept the agreement
Google calls it a "Business Associate Amendment" - it amends your existing Workspace terms rather than functioning as a standalone contract. Once accepted, it applies organization-wide. Accept it before sending any PHI through your Workspace email.
Required Email Security Settings
After signing the BAA, your Google Workspace admin needs to configure email-specific settings to support HIPAA compliance:
- Enforce TLS encryption - configure Gmail to require TLS for domains you exchange PHI with. Under HIPAA email rules, emails containing PHI must be encrypted in transit
- Enable two-factor authentication for all users
- Set up Data Loss Prevention (DLP) rules to scan outgoing email for PHI patterns (SSNs, MRNs, diagnostic codes) and block or flag messages that match
- Disable POP/IMAP forwarding to prevent staff from syncing work email to unmanaged personal email clients
- Configure email retention rules in Google Vault to meet HIPAA documentation requirements
- Restrict auto-forwarding to prevent staff from forwarding work email to personal accounts
These settings map to the technical safeguards required under 45 CFR §164.312, including access controls, audit controls, and transmission security.
Common Mistakes with Gmail and HIPAA
Using personal @gmail.com for work. The single most common and most dangerous mistake. A provider replies to a patient from their personal Gmail, a billing staff member forwards insurance documents to their personal account to work from home, or an office manager uses personal email because "it's faster." Every one of these is a potential violation.
Emailing PHI to recipients without TLS. If the receiving mail server does not support TLS, the email is sent unencrypted. Gmail can be configured to require TLS and bounce messages when the recipient's server cannot encrypt. Without this setting, you are relying on the recipient's email infrastructure - which you do not control.
Including PHI in subject lines. Email subject lines are often transmitted and stored without encryption, even when the body is encrypted. Never put patient names, diagnoses, or other identifiers in the subject line. Train staff to use generic subjects like "Follow-up" or "Records request."
No policy on email content. Staff need written rules about what can be emailed, to whom, and under what conditions. Without a clear email policy, staff make their own judgments about what is safe to send - and those judgments are often wrong.
Auto-forwarding to personal accounts. Gmail allows users to set up automatic forwarding. If a staff member forwards all work email to their personal account, every message containing PHI is now in an uncontrolled environment with no BAA. Disable this at the admin level.
Gmail vs. HIPAA-Specific Email Providers
Some vendors like Paubox and Hushmail market themselves as "HIPAA-compliant email" providers. The difference is mostly about defaults:
- HIPAA-specific providers ship with healthcare-oriented defaults: encryption enforced, DLP rules pre-configured, BAA included automatically. They are designed for practices that want compliance out of the box.
- Google Workspace Gmail requires manual configuration but covers email, file storage, video conferencing, and collaboration tools under a single BAA. It is more versatile but requires admin effort to lock down.
For practices already on Google Workspace, configuring Gmail for HIPAA compliance makes sense. For practices that want a turnkey email solution with no admin overhead, a HIPAA-specific provider may be simpler. See our full HIPAA email compliance guide for a deeper comparison.
Can I email patient records through Gmail?
Yes, if you are using Google Workspace Gmail (not free @gmail.com) with a signed BAA, TLS encryption enforced, and DLP rules configured. Even with these controls, keep PHI out of subject lines and verify that the recipient's email system supports encryption before sending.
Is Gmail encrypted?
Gmail uses TLS encryption for emails in transit when both the sender and receiver's mail servers support it. Google also encrypts stored emails at rest. This meets HIPAA encryption requirements under §164.312(e)(2)(ii) for transmission security. However, TLS is opportunistic by default - meaning Gmail will send unencrypted if the recipient's server does not support TLS. Configure your admin settings to require TLS for sensitive communications.
What if a patient emails PHI to our @gmail.com address?
If a patient sends PHI to your free @gmail.com account, the PHI is now in a system with no BAA. You should move to a Google Workspace account as soon as possible. In the meantime, do not reply with additional PHI, and document the incident for your risk assessment. This is exactly the scenario that a compliant email setup prevents.
Do I need a separate BAA for Gmail and Google Drive?
No. Google's HIPAA Business Associate Amendment covers all core Workspace services under one agreement. Gmail, Drive, Docs, Sheets, Meet, Calendar, and Chat are all included. Accept the BAA once in the Admin console and it applies to every covered service.