Is Gmail HIPAA Compliant Email? – Well, It Can Be!

Andrew Kroninger, Total HIPAA’s Director of Customer Success, recently interviewed Gil Vidal, founder and CEO of VM Racks, a HIPAA compliant cloud managing solution. The two discussed Gmail’s potential for HIPAA compliant email messaging. You can listen to this episode of our podcast HIPAA Talk! here or on your mobile device via Apple Podcasts. Or, read our summary.

Can I email PHI?

HIPAA mandates that you protect PHI (Protected Health Information) in transit, in storage, and at rest. There is a common misconception that email is a secure way to send and receive PHI. On its own, email is not a secure platform to transmit PHI. In fact, using Google’s email service, Gmail, to send PHI without encryption is against Google’s Terms of Service.1

Emailing PHI without encryption could very easily lead to a breach if the email ended up in the hands of the wrong party.

Is Gmail HIPAA compliant? What about G Suite?

Gmail is not automatically HIPAA compliant, however, you can implement security measures to ensure the safety of sensitive information you send via Gmail. When it comes to protecting emailed information, email encryption is the name of the game. You need to use a third party email encryption service to protect any PHI you send over Gmail.

End-to-end email encryption configures the data so that only the sender and intended recipient can read the email’s content. It assigns a unique “key” for unlocking the contents of the email that only the intended recipient gets. This way, if you send the email to the wrong address, the information is still safe.2 There are several services you can use to make Gmail HIPAA compliant, including but not limited to: Virtru, RMail, LuxSci, Identillect, and Zix. You can learn more about those here.

G Suite is the paid version of Gmail. You can make Gmail HIPAA compliant without purchasing G Suite, but it is more difficult.

There are several security benefits to purchasing this program, like administrator controls on users. For example, administrators can mandate the use of two-factor authentication for all employees. Additionally, admins can limit employees’ email usage on mobile devices. Most notably, in order to be effective, you must implement these security measures on all employee accounts.   

Do I need a Business Associates Agreement with Google to make Gmail HIPAA Compliant?

To make Gmail HIPAA compliant, you must enter into a Business Associates Agreement with Google.

Because Google is such a large company, the process of signing a Business Associates Agreement is different. Unlike your other Business Associates, Google will not send you a signed document. Instead, you will virtually enter into the agreement when you set up the administrator account on your company’s G Suite profile. When you click on the tab “Privacy Additional Terms” there is an option to accept Google’s Business Associates Agreement.

Does sending HIPAA compliant emails mean I am fully compliant with HIPAA law?

So you’ve made Gmail HIPAA compliant with email encryption and secure email practices.

Does this mean your company is now fully compliant with HIPAA law?

No. Sending HIPAA compliant emails does not ensure HIPAA compliance.

For example, imagine an employee is drafting an encrypted email containing PHI, and she gets up to go to lunch, leaving her computer unlocked. Now, the PHI is exposed to everyone who walks by, putting her company at risk of a breach.

HIPAA requires organizations to protect PHI they come into contact with at all times. Safe email practices are just one piece of the puzzle. Therefore, making Gmail HIPAA compliant requires constant mindfulness and effort.

As with every HIPAA compliance security measure, organizations must train their employees how to correctly use programs like Gmail. Employers must include email practices for making Gmail HIPAA compliant in their policies and procedures.

Additionally, entities should assign an administrator who is knowledgeable and readily available to help with all matters concerning email security. Penalties for violating HIPAA via email are just a severe as any other punishments, with fines ranging from $100 – $50,000 per violation (with an annual cap at $1.5 million per incident). Your company can make Gmail HIPAA compliant with a little concentrated effort.

Our HIPAA compliance services help ensure that your business follows the basic HIPAA rules and guidelines to protect sensitive patient information. Our team of experts is dedicated to providing affordable rates and personalized solutions to help you become HIPAA compliant. We understand that navigating the complex requirements of HIPAA can be challenging, which is why we offer a comprehensive range of services to meet your unique needs. From risk assessments to employee training, we have the tools and expertise necessary to help your business achieve and maintain HIPAA compliance. Contact us today to learn more about how we can help you protect your patients, your employees, and your business.

Sources

  1. https://www.vmracks.com/resources/is-gmail-hipaa-compliant/
  2. https://blog.mailfence.com/end-to-end-email-encryption/

 

Sharing is caring!

Documents

Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.


Download Now

Want to stay informed?

Join our community, stay ahead of the curve on HIPAA compliance and receive free expert guidance.

State of HIPAA Compliance in 2024

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!

Document

Related Posts

What is Access Control in terms of HIPAA?

What is Access Control in terms of HIPAA?

Access control, in terms of cybersecurity, refers to the practice of managing and regulating who can access specific resources, systems, or data within an organization's network or information...

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)