Is Gmail HIPAA Compliant Email? – Well, It Can Be!

Andrew Kroninger, Total HIPAA’s Director of Customer Success, recently interviewed Gil Vidal, founder and CEO of VM Racks, a HIPAA compliant cloud managing solution. The two discussed Gmail’s potential for HIPAA compliant email messaging. You can listen to this episode of our podcast HIPAA Talk! here or on your mobile device via Apple Podcasts. Or, read our summary.

Can I email PHI?

HIPAA mandates that you protect PHI (Protected Health Information) in transit, in storage, and at rest. There is a common misconception that email is a secure way to send and receive PHI. On its own, email is not a secure platform to transmit PHI. In fact, using Google’s email service, Gmail, to send PHI without encryption is against Google’s Terms of Service.1

Emailing PHI without encryption could very easily lead to a breach if the email ended up in the hands of the wrong party.

Is Gmail HIPAA compliant? What about G Suite?

Gmail is not automatically HIPAA compliant, however, you can implement security measures to ensure the safety of sensitive information you send via Gmail. When it comes to protecting emailed information, email encryption is the name of the game. You need to use a third party email encryption service to protect any PHI you send over Gmail.

End-to-end email encryption configures the data so that only the sender and intended recipient can read the email’s content. It assigns a unique “key” for unlocking the contents of the email that only the intended recipient gets. This way, if you send the email to the wrong address, the information is still safe.2 There are several services you can use to make Gmail HIPAA compliant, including but not limited to: Virtru, RMail, LuxSci, Identillect, and Zix. You can learn more about those here.

G Suite is the paid version of Gmail. You can make Gmail HIPAA compliant without purchasing G Suite, but it is more difficult.

There are several security benefits to purchasing this program, like administrator controls on users. For example, administrators can mandate the use of two-factor authentication for all employees. Additionally, admins can limit employees’ email usage on mobile devices. Most notably, in order to be effective, you must implement these security measures on all employee accounts.   

Do I need a Business Associates Agreement with Google to make Gmail HIPAA Compliant?

To make Gmail HIPAA compliant, you must enter into a Business Associates Agreement with Google.

Because Google is such a large company, the process of signing a Business Associates Agreement is different. Unlike your other Business Associates, Google will not send you a signed document. Instead, you will virtually enter into the agreement when you set up the administrator account on your company’s G Suite profile. When you click on the tab “Privacy Additional Terms” there is an option to accept Google’s Business Associates Agreement.

Does sending HIPAA compliant emails mean I am fully compliant with HIPAA law?

So you’ve made Gmail HIPAA compliant with email encryption and secure email practices.

Does this mean your company is now fully compliant with HIPAA law?

No. Sending HIPAA compliant emails does not ensure HIPAA compliance.

For example, imagine an employee is drafting an encrypted email containing PHI, and she gets up to go to lunch, leaving her computer unlocked. Now, the PHI is exposed to everyone who walks by, putting her company at risk of a breach.

HIPAA requires organizations to protect PHI they come into contact with at all times. Safe email practices are just one piece of the puzzle. Therefore, making Gmail HIPAA compliant requires constant mindfulness and effort.

As with every HIPAA compliance security measure, organizations must train their employees how to correctly use programs like Gmail. Employers must include email practices for making Gmail HIPAA compliant in their policies and procedures.

Additionally, entities should assign an administrator who is knowledgeable and readily available to help with all matters concerning email security. Penalties for violating HIPAA via email are just a severe as any other punishments, with fines ranging from $100 – $50,000 per violation (with an annual cap at $1.5 million per incident). Your company can make Gmail HIPAA compliant with a little concentrated effort.

Our HIPAA compliance services help ensure that your business follows the basic HIPAA rules and guidelines to protect sensitive patient information. Our team of experts is dedicated to providing affordable rates and personalized solutions to help you become HIPAA compliant. We understand that navigating the complex requirements of HIPAA can be challenging, which is why we offer a comprehensive range of services to meet your unique needs. From risk assessments to employee training, we have the tools and expertise necessary to help your business achieve and maintain HIPAA compliance. Contact us today to learn more about how we can help you protect your patients, your employees, and your business.

Sources

  1. https://www.vmracks.com/resources/is-gmail-hipaa-compliant/
  2. https://blog.mailfence.com/end-to-end-email-encryption/

 

Sharing is caring!

Documents

Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.


Download Now

Want to stay informed?

Join our community, stay ahead of the curve on HIPAA compliance and receive free expert guidance.

State of HIPAA Compliance in 2025

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!

Document
Register for Webinar

Related Posts

Essential Guide to Email Authentication and Deliverability: How to Configure DMARC, SPF, and DKIM Records

Essential Guide to Email Authentication and Deliverability: How to Configure DMARC, SPF, and DKIM Records

Essential Guide to Email Authentication and Deliverability: How to Configure DMARC, SPF, and DKIM Records
*This process is technical and requires access to your Domain Name Server (DNS). It’s recommended to have an IT professional handle these configurations to avoid potential issues. If you proceed yourself, back up your current settings with screenshots or copies before making any changes.
Organizations rely heavily on email for marketing and communication, making it a prime target for malicious actors. Phishing, spoofing, and other email attacks can inflict significant financial and reputational damage. In response to this growing threat, email providers are tightening their security measures, and businesses that aren’t paying attention risk having their emails blocked.
A recent announcement from Microsoft, highlighted in their Tech Community blog, highlights that Outlook is implementing stricter requirements for high-volume senders to protect users from unwanted and potentially harmful messages. This move serves as a clear signal: email authentication is no longer optional – it’s required for all organizations, regardless of their sending volume.
The key to making sure your emails reach their intended recipients is all in the configuration and alignment of your Domain-based Message Authentication, Reporting and Conformance (DMARC), Sender Policy Framework (SPF), and DomainKeys Identified Mail (DKIM) records. These protocols verify an organization actually sent the emails and tells receiving servers your messages are legitimate and shouldn’t be sent to spam folders or blocked.
What makes SPF, DKIM, and DMARC so crucial?
SPF (Sender Policy Framework): This record lists the authorized mail servers permitted to send emails on your behalf. When your email server receives an email, it checks it and verifies if the sending server’s IP address matches the list in your SPF record. This helps prevent attackers from spoofing your domain using unauthorized servers.
DKIM (DomainKeys Identified Mail): DKIM adds a digital signature to your outgoing emails. This signature is cryptographically linked to your domain and verified by the receiving server using a public key published in your DNS records. DKIM ensures the integrity of the email content and confirms that it hasn’t been tampered with in transit.
DMARC (Domain-based Message Authentication, Reporting & Conformance): DMARC builds upon SPF and DKIM. It tells receiving servers what to do with emails that fail SPF and/or DKIM checks. You can set policies to “none” (monitor), “quarantine” (send to spam), or “reject” (block). DMARC also enables reporting, allowing you to gain valuable insights into who sends emails using your domain and identify potential spoofing attempts.
Microsoft’s Stance: A Wake-Up Call
The stricter requirements being implemented by Outlook for high-volume senders emphasize the need for organizations to set up and review their authentication protocols. While the current focus is on high-volume senders, it is clear: email providers are looking for authenticated mail. Failing to correctly set up your DMARC, SPF, and DKIM records will lead to deliverability issues of emails.
What Your Company Needs to Do Now:
Regardless of size or email volume, every company should take the following steps to make sure its email authentication is configured correctly. Here’s a checklist:
Audit Your Existing Records: Check for existing SPF, DKIM, and DMARC configurations. Are they accurate and up-to-date?
Implement Missing Records: If you are missing any of these records, add them immediately. *Consult with your IT team or email service provider for guidance.
Check Alignment: It’s crucial to make sure there is alignment between your SPF, DKIM, and DMARC records. This means that the domain used for SPF and the signing domain in DKIM should match the “From” address domain in your emails. DMARC relies on this alignment to function effectively.
Start with a Monitoring Policy: For DMARC, it’s often best to start with a “none” policy to monitor how your emails are being handled and identify any legitimate sending sources that might not be properly authenticated.
Gradually Enforce Stronger Policies: Once you clearly understand your email flows and have addressed any authentication issues, move gradually towards stronger DMARC policies like “quarantine” or “reject” to protect your domain from spoofing actively.
Regularly Review and Update: The email landscape is constantly changing. Regularly review and update your authentication records as needed, especially when changing your emails or third-party sending services.
The Benefits of Proper Email Authentication:
Properly configuring and aligning your DMARC, SPF, and DKIM records offers significant benefits:
Improved Email Deliverability: Your legitimate emails are more likely to reach the inbox, avoiding spam folders and blocks.
Enhanced Brand Reputation: Protecting your domain from spoofing builds trust with your recipients and safeguards your brand’s reputation.
Increased Security: You significantly reduce the risk of using your domain for phishing and other malicious activities.
Compliance with Evolving Standards: By staying ahead of the curve, you ensure your email practices align with the increasingly stringent requirements of email providers.
The message is clear: email authentication is no longer optional. The recent emphasis from major providers like Microsoft underscores its critical importance in maintaining reliable and secure email communication. By taking the steps to audit and align your DMARC, SPF, and DKIM records, your organization can protect itself, customers, and reputation. Don’t wait until your emails are blocked – act now to secure your email.
Have questions or need help with your HIPAA compliance? Schedule a call with our experts today. https://www.totalhipaa.com/get-started/
To check your DMARC Records go here
https://www.totalhipaa.com/dmarc-lookup-free/
All records, a free and easy tool to use
https://easydmarc.com/

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)