Email wasn't built for protected health information. Most practitioners find that out the hard way — after a client hits reply on a scheduling email and mentions a diagnosis, a medication, or a symptom, and now that message sits in a standard inbox with no encryption, no access controls, and no audit trail.

Here's what HIPAA-compliant email actually requires, whether your current setup meets the bar, and why most practices eventually stop trying to make email compliant and move client communication somewhere built for it.

What is HIPAA-compliant email?

HIPAA-compliant email is email that meets the Security Rule's technical safeguards for electronic protected health information (ePHI): encryption in transit and at rest, access controls tied to individual user accounts, audit logging, and a signed Business Associate Agreement (BAA) with the email provider.

Standard email fails on nearly all of these by default. Gmail, Outlook, and most consumer email don't encrypt messages end-to-end, don't log who accessed what, and don't come with a BAA unless you're on a specific paid tier and you've signed one directly with the provider.

Is Gmail HIPAA compliant?

Gmail is not HIPAA compliant by default. Google will sign a BAA for Google Workspace customers, but only on Business, Enterprise, or Education plans — not personal Gmail accounts. Signing the BAA is necessary but not sufficient: you still have to configure Workspace correctly (S/MIME encryption or Gmail's confidential mode, admin-level access controls, retention settings) and make sure every staff member who touches client email is covered under that same BAA.

Personal Gmail accounts, free Gmail accounts, and any Workspace account without a signed BAA are not compliant, regardless of what security settings are enabled.

Is Google Workspace HIPAA compliant?

Google Workspace can be HIPAA compliant on Business Standard, Business Plus, Enterprise, and Education plans, provided your organization signs Google's BAA and configures Gmail, Drive, and Calendar according to Google's HIPAA implementation guidance. Workspace is not compliant out of the box — the BAA and configuration are both required, and coverage only extends to the specific services listed in Google's BAA (not every Workspace product automatically qualifies).

How to send a HIPAA-compliant email

1. Confirm your email provider will sign a BAA, and get it signed before any ePHI is sent — not after.
2. Enable encryption in transit (TLS) at minimum, and encryption at rest for stored messages.
3. Restrict access to shared inboxes so only authorized staff can view messages containing ePHI.
4. Turn on audit logging so you can see who accessed or forwarded a message.
5. Train staff to strip identifying details from subject lines, since subject lines are often unencrypted even when body content is protected.
6. Get client consent in writing before communicating ePHI by email, since HIPAA permits it but expects documented authorization.

Even done correctly, this checklist has to be maintained by someone — every new hire, every plan change, every provider update.

HIPAA-compliant email services worth considering

Paubox, Virtru, and Hushmail all offer HIPAA-compliant email with signed BAAs, and each layers encryption on top of existing email addresses rather than requiring clients to log into a separate portal. Google Workspace and Microsoft 365 can also be configured for compliance on qualifying business tiers. Pricing and setup complexity vary, and every option still requires the same ongoing discipline: BAA maintenance, access control review, and staff training as your team grows.

Why secure client messaging beats HIPAA-compliant email

Compliant email solves the transport problem. It doesn't solve the workflow problem: client messages, session notes, intake forms, and billing questions end up scattered across an inbox that was never designed to be part of a clinical record.

Secure messaging built into a practice management platform keeps client communication inside the same system as their chart, so there's one compliant record instead of a compliant inbox plus a separate EHR. Practice Better's client portal messaging is covered under the same BAA as the rest of the platform, so a message thread about a client's protocol lives next to their notes, forms, and billing history — not in a separate inbox you have to secure, audit, and retain on its own timeline.

For a solo practitioner, that's the difference between maintaining two compliant systems and maintaining one.

Frequently asked questions

Is email HIPAA compliant?

Email is not HIPAA compliant by default. It becomes compliant only when the provider signs a BAA and the account is configured with encryption, access controls, and audit logging.

How do you send HIPAA-compliant email?

Send HIPAA-compliant email through a provider with a signed BAA, using encryption in transit and at rest, restricted access, audit logging, and documented client consent.

Is Google Workspace email HIPAA compliant?

Google Workspace email is HIPAA compliant on Business Standard, Business Plus, Enterprise, or Education plans when the organization signs Google's BAA and follows Google's configuration requirements.

How do you send HIPAA-compliant email in Gmail?

Sending HIPAA-compliant email in Gmail requires a Google Workspace plan eligible for a BAA, a signed BAA with Google, and encryption settings such as S/MIME or confidential mode enabled at the admin level.

Do you need a BAA to email clients about their health?

Yes. Any email provider handling protected health information needs a signed Business Associate Agreement before ePHI is sent, regardless of what encryption is in place.

What alternatives are there to email if it's not HIPAA compliant?

Secure messaging within your EHR is the top choice for practitioners who are serious about remaining compliant when sending and receiving communications with clients. EHRs like Practice Better have compliance built in, so you never have to worry about violating privacy laws.

{{free-trial-simple-text}}