Last verified: October 2026, against Google's HIPAA documentation and Gmail Help. General information, not legal advice — confirm with your compliance officer or attorney.
Is Gmail HIPAA compliant? A practice address on Google Workspace can carry patient information once an administrator accepts Google's business associate agreement (BAA) and the account is configured the way Google's own guide describes. A free @gmail.com address can't, because there is no BAA to sign. The rest comes down to daily habits: how you email patients, where form notifications land and how Drive links get shared.
Short answer (dated) for Gmail and Google Drive
Short answer (verified October 2026): Google's Workspace HIPAA help page (opens in a new tab) says "Administrators must review and accept a BAA" before using protected health information (PHI) in Google services, and "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services." Gmail and Google Drive (including Docs, Forms, Sheets and Slides) are on Google's HIPAA included functionality list (opens in a new tab). Third-party add-ons are not.
So Gmail in a Workspace account with the BAA accepted is usable for PHI; a personal Gmail account isn't. Google's implementation guide (opens in a new tab) (September 2025 edition) adds that covered services "must be configured by IT administrators", which is what the rest of this page is about.
A super administrator accepts the BAA under Account settings > Legal and compliance; the walk-through is in our Google Workspace BAA setup guide.
Free Gmail vs Google Workspace accounts
Google's guide describes the BAA as an addendum "to their Google Workspace Agreement." That agreement is the line between the two kinds of account.
| Item | Free @gmail.com | Google Workspace, BAA accepted |
|---|---|---|
| Route to a BAA | None | Super admin accepts in the Admin console |
| PHI allowed | No | Yes, in included services, once configured |
| Who controls the account | The person who opened it | Your practice's administrators |
| S/MIME encryption | Not offered for personal accounts | Hosted S/MIME on Frontline Plus, Enterprise Plus and Education editions |
The trap usually looks harmless: a "smithfamilydental@gmail.com" address printed on the website years ago, a hygienist forwarding work mail to a personal inbox, or a manager reading the front-desk account on a personal phone. Each one puts patient details where no BAA reaches.
The fix is a Workspace account on your own domain, the BAA accepted, and a separate organizational unit for staff who handle PHI. Google's guide says non-core services such as YouTube and Blogger must be turned off for those users unless a separate BAA covers them.
Emailing patients from Gmail: encryption and consent
HHS allows it. Its FAQ on emailing patients (opens in a new tab) says providers may communicate by email if they "apply reasonable safeguards", such as checking the address and limiting what the message contains. If a patient emails you first, you may assume email is acceptable unless they say otherwise. If you doubt they understand the risk, explain it and let them decide.
A patient can also ask for copies of their records by unencrypted email. HHS's right of access FAQs (opens in a new tab) say you must send them that way if the records are readily producible, and that you aren't responsible for a disclosure in transit once the patient was warned and still chose it.
What Gmail does on the wire, as Google documents it:
- TLS by default. Google's TLS article (opens in a new tab) says "Gmail always tries to send messages over a secure TLS connection." If the receiving server doesn't support TLS, the message is still sent, without that protection. Gmail Help (opens in a new tab) shows such messages with a red open lock.
- A TLS compliance rule. Admins can require TLS for domains they name, such as a referral partner. Outgoing mail that can't use TLS then bounces instead of going out unprotected.
- Hosted S/MIME. Available on Frontline Plus, Enterprise Plus and the Education editions (opens in a new tab). It works only after sender and recipient exchange keys, which a patient's personal mailbox usually hasn't done.
- Confidential mode. It sets an expiry and blocks forwarding, copying, printing and downloading, but Google warns (opens in a new tab) that recipients "can still take screenshots or photos." Google doesn't describe it as encryption, so don't treat it as such.
A workable rule: appointment logistics by email; results, records and anything sensitive through your patient portal or EHR messaging; and when a patient insists on plain email, note the warning and their choice in the chart.
Form notifications landing in Gmail
Many practice websites email every contact-form submission to the front desk. That puts names, phone numbers and the reason for the visit into email, often through a form plugin whose vendor never signed a BAA. Ask four questions:
- Which inbox receives notifications? If it's a personal Gmail, stop the notifications today.
- Does the form vendor sign a BAA? Google Forms falls under Drive's coverage; see Google Forms and HIPAA.
- Does the email contain the whole submission? "New request, log in to view" exposes far less.
- Who can read that inbox? Google's guide notes that everyone in a collaborative inbox sees every message sent to it.
Medfy's HIPAA-compliant website forms send submissions to its patient CRM and inbox rather than leaving patient details in email. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada, access is role-based with an audit log, and Medfy signs a BAA with your practice before any patient data flows. More in how Medfy handles patient data.
Google Drive: sharing links and folder permissions
Is Google Drive HIPAA compliant? It's on the included list, so it can hold PHI under the BAA. Day to day, these rules carry the weight:
- No "anyone with the link" for PHI. Google's guide says admins can "Restrict" sharing outside the domain and set the default file visibility to "Private to the owner." Do both for staff who handle PHI.
- No PHI in names. The guide recommends keeping PHI out of file, folder and shared drive titles. "Referrals – October" is fine; a patient's name isn't.
- Audit external shares. The file exposure reports in the Security Center show which files are shared outside your domain. Run them monthly for PHI users.
- Review add-ons. Third-party Drive apps and Docs add-ons sit outside the BAA. Google's guide suggests disabling the ones you haven't reviewed.
- Offboard the same day. Remove a departing employee's access when they leave, and keep patient files in shared drives the practice owns so nothing depends on one person's account.
Sending large files to another practice or a lab? Compare Dropbox and Box. Running video visits on the same account? See Google Meet and HIPAA. Every other tool we've checked is on the HIPAA-compliant email hub.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
The public side of your website matters too. A free marketing audit flags privacy risks such as ad pixels on pages with patient forms.
Frequently asked questions
Is a free Gmail account HIPAA compliant?
No. Google's BAA is an addendum to a Google Workspace or Cloud Identity agreement, accepted by an administrator, and a personal @gmail.com account has neither. Google says customers without a signed BAA must not use PHI in its services. Move practice email to Workspace on your own domain, accept the BAA and configure it before patient details arrive. Confirm the plan with your compliance officer or attorney.
Can I email patients from Gmail?
Yes, from a Workspace account under Google's BAA, with reasonable safeguards. HHS lets providers email patients, expects checks such as confirming the address, and allows plain email for patients who prefer it after being told the risks. Keep results and records in your portal, and note each patient's choice. Don't use a free Gmail address for patients at all. Confirm your policy with your compliance officer or attorney.
Is Google Drive safe for patient files?
It can be. Drive, with Docs, Sheets, Slides and Forms, is on Google's HIPAA included functionality list, so it may hold PHI once your administrator accepts the BAA. Safety then comes down to settings: no 'anyone with the link' sharing, sharing outside your domain restricted, no PHI in file names, regular reviews of external shares, and same-day removal of access when someone leaves.
Does Gmail encrypt emails automatically?
In transit, usually. Google says Gmail always tries to use TLS, but if the recipient's server doesn't support it, the message still goes out without that protection and Gmail shows a red open lock. Stronger options depend on your edition: a TLS compliance rule that bounces unprotected mail, and hosted S/MIME on Enterprise Plus, Frontline Plus and Education editions. Google doesn't describe confidential mode as encryption.