Is Gmail HIPAA Compliant?

Home/Is Gmail HIPAA Compliant?

Short answer: free Gmail is not appropriate for patient information. Google Workspace can be used for PHI after you accept Google's business associate agreement and configure it correctly. Google says customers who have not accepted its BAA must not use PHI in Google Workspace.

Take the free risk assessment →Talk to an analyst

01

Workspace versus free Gmail

Google offers a HIPAA business associate agreement for Google Workspace that a super administrator can accept in the Admin console under Account settings, Legal and compliance. Only services on Google's HIPAA Included Functionality list are covered. Third-party add-ons are not.

A free @gmail.com account does not come with that agreement, so it should not be used to send or store patient information.

02

Making Workspace safe for PHI

  • Accept the BAA before any patient information goes in.
  • Require multi-factor authentication for all users.
  • Use encrypted email for messages with PHI that leave your domain.
  • Restrict Drive sharing outside your organization.
  • Turn off or review third-party apps and add-ons.

FAQ

Frequently asked questions

Can we email patients from Gmail?

Use Google Workspace with a signed BAA and encryption for messages containing PHI. Free Gmail accounts should not be used for patient information.

Is Google Drive HIPAA compliant?

Drive is covered under Google's BAA when used in Workspace, but sharing settings and access controls decide whether your use is compliant.

Sources: Google: HIPAA compliance with Google Workspace. This page is general information as of November 2026, not legal advice.

Need HIPAA compliant email?

Cytek SecureMail makes encrypted email easy for staff and patients.

Take the free risk assessment →Talk to an analyst