Menu

Is Gmail HIPAA Compliant? Setup and Rules for Therapists

Personal Gmail can't be used under HIPAA; Google Workspace Gmail can, with Google's BAA and the right settings. Setup, HHS email rules and consent wording.

Updated 10 min read
In this guideChecklistTemplate to copy9 questions answered

Is Gmail HIPAA compliant? Gmail can be used in a HIPAA-compliant way, but only inside a Google Workspace account whose administrator has accepted Google's Business Associate Agreement (BAA), and only when it is set up and used with care. A personal @gmail.com account can't get that agreement, so if you're a HIPAA covered entity it isn't a place for client information. Google's HIPAA help page states the rule plainly: "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services." Gmail is on Google's list of services covered by the BAA, and the same page reminds readers that HHS "doesn't offer a certification program for HIPAA compliance" and that compliance "is a shared responsibility between you and Google."

Below you'll find what Google's own pages say about Gmail (we read them on October 25, 2026), the settings a therapist should check, what HHS allows when you email clients, what to keep out of subject lines, a checklist, and consent-to-email wording you can copy. If you also run sessions on Google Meet, our Google Meet HIPAA guide walks through the Workspace BAA and the Admin console steps in detail, so this article only summarizes them.

Is Gmail HIPAA compliant? The answer by account type

  • Personal Gmail (an @gmail.com address): no.It's a consumer account with no Admin console, and Google's BAA says "Customer must have an existing Services Agreement in place for this BAA to be valid and effective." A personal account has no Workspace agreement, so there is no BAA to accept.
  • Google Workspace with the BAA accepted: yes, with work on your side.Gmail can carry client information once an administrator accepts the BAA and the account is configured and used as Google's HIPAA Implementation Guide describes.
  • Google Workspace without the BAA: not yet.Buying Workspace doesn't switch the BAA on. An administrator accepts it in the Admin console.
  • Workspace Individual: unclear.Google's HIPAA pages don't mention it, and the documented way to accept the BAA runs through an Admin console. Get Google's answer in writing before you put client information in it.
  • The legacy edition sometimes called Google Apps Standard Edition: no.Google says its users "cannot review and accept a BAA from Google at this time" (Google, privacy compliance and records).

One question comes before all of this: whether HIPAA applies to you. It covers health care providers who send health information electronically in connection with standard transactions, such as billing insurance. A therapist who sees only private-pay clients may not be a covered entity, though state privacy law and your ethics code still ask for the same care. The Google Meet guide covers this in more depth; if you're unsure where you stand, ask a healthcare attorney.

What Google's HIPAA pages say about Gmail

Gmail is a covered service

Google's HIPAA Implementation Guide (September 2025) lists Gmail among the "Core Services in which PHI is permitted," together with Calendar, Drive, Meet and others, "as long as the health care organization configures those services to be HIPAA compliant." That last clause is the whole story of Gmail and HIPAA: the service is eligible, and the setup is yours.

Google's help page also answers a newer question. "The help me write, contextual smart replies, and side-panel features are covered as part of Google Workspace with Gemini in HIPAA Included Functionality." So those Gemini features in Gmail sit inside the BAA too, on an account where the BAA is accepted.

What the BAA doesn't cover

The gaps matter more for email than for most tools, because email is where other apps plug in:

  • Third-party apps and add-ons."Third-party applications including add-ons are not included in the Included Functionality covered by the BAA," says Google's HIPAA help page. An email tracking extension, a mail-merge tool or a scheduling add-on that reads your inbox needs its own agreement. The guide says customers "are solely responsible for determining if they require a BAA or any other data protection terms in place with a third party."
  • Google Contacts.The guide puts Contacts under "Core Services where PHI is not permitted." That's easy to miss, because Google automatically saves people you've interacted with to "Other contacts" unless you change the "Create contacts for auto-complete" option in Gmail settings.
  • Other Google services.YouTube, Blogger, Google Photos and similar services "must be disabled for Google Workspace users who manage PHI" unless a separate BAA covers them.
  • Google's technical support."Customers should not provide PHI to Google when accessing technical support services." Describe the problem, not the client.

The configuration is yours

The BAA says the customer will "use controls available within the Services, including those detailed in the HIPAA Implementation Guide, to ensure its use of PHI is limited to the Covered Services," and that the customer "is solely responsible for ensuring that its and its End Users' use of the Covered Services complies with HIPAA and HITECH." That isn't a weakness in Google's offer. It's how every BAA with a software vendor works: the vendor protects its service, and you decide how it's used.

How to make Gmail HIPAA compliant: five steps

1Move client email to a Workspace account on your practice domain

Use an address like [email protected] on a Google Workspace account, not a personal account with a forwarding rule. If you've been emailing clients from a personal Gmail, stop using it for anything about clients, and ask an attorney whether past messages need a closer look.

2Accept the BAA and keep proof

A super administrator signs in to the Admin console, goes to Account settings, then Legal and compliance, reviews the Google Workspace/Cloud Identity HIPAA Business Associate Amendment, and answers three questions confirming the account is a HIPAA covered entity (Google's steps). Google says the electronic agreement "is as binding as a paper-based agreement" and that "a screenshot of their Admin Console/HIPAA acceptance" can serve as proof. Take the screenshot and file it with your practice records.

3Understand encryption in transit, then decide what you need

Gmail tries to encrypt mail in transit by default. Google's admin help explains: "By default, Gmail always tries to send messages over a secure TLS connection." It also says what happens when the other side doesn't cooperate: "If the receiving server doesn't use TLS, Gmail still sends messages but the connection isn't secure." Google's Gmail help adds that "Almost all major email services use TLS," so most client email is protected on the way. You can check:

  • On a message you received, open the details next to the recipient and look at the "security" line (Gmail Help).
  • A red open lock means the message isn't encrypted. Gmail's help advises you to "Not send sensitive information" in that case.
  • For people you exchange client information with often, such as a group practice, a supervisor or a biller, an administrator can add their domains to the Secure transport (TLS) compliance setting (Admin console, Apps, Google Workspace, Gmail, Compliance). Mail to those domains then has to travel over TLS; if it can't, "Messages aren't delivered, and will bounce."

Gmail offers stronger options, with limits worth knowing:

  • Hosted S/MIME encrypts the message itself, but it is available on Frontline Plus, Enterprise Plus and Education editions (Google), and it uses "keys provided by you and your recipients." Most clients won't have S/MIME keys, so it suits email between professionals more than email to clients.
  • Client-side encryption, where your organization holds the keys, is available on Frontline Plus, Enterprise Plus, Education Standard and Education Plus (Google).
  • Confidential mode lets you set an expiration date, revoke access, turn off forwarding, copying, printing and downloading, and require an SMS passcode. Google is candid about its limits: recipients "can still take screenshots or photos of your emails" (Gmail Help). It's a useful control on access, not a substitute for a decision about encryption.

HIPAA doesn't name one method. Under the Security Rule, encryption of data in transit is an "addressable" specification (45 CFR 164.312(e)), and HHS's FAQ on email says the covered entity "must assess its use of open networks, identify the available and appropriate means to protect e-PHI as it is transmitted, select a solution, and document the decision." One approach many solo practices take: rely on TLS by default, require it for regular professional contacts, keep clinical detail out of client email, and get written client consent. Whatever you choose, write down the decision and why.

4Lock down the account

  • Turn on 2-Step Verification and require it. Google calls security keys "the most secure form of 2SV" because they "protect against phishing threats" (Google), and Google already enforces 2SV for administrator accounts.
  • Set up alerts. The Implementation Guide says admins can get alerts for "suspicious login attempts," new admin rights and password changes. Turn them on and read them.
  • Turn off automatic forwarding. Google's admin help says the option to let users forward their mail "is on by default." For a practice, a rule that quietly copies client email to a personal address is the last thing you want. Turn it off, or limit it to internal addresses (Apps, Google Workspace, Gmail, End User Access).
  • Review third-party apps. Remove extensions and add-ons that read your mail unless they come with their own BAA.
  • Turn off services outside the BAA for your account, such as YouTube, Blogger and Google Photos, as the guide describes.
  • Keep client details out of Contacts. Change "Create contacts for auto-complete" so Gmail doesn't save everyone you email, and don't create contacts labeled "client" or with notes about why someone sees you.
  • Share attachments narrowly. When you attach a Drive file, share it with the specific people on the email, never "Anyone with the link." Google's HIPAA FAQ points to "sharing with specific recipients as opposed to anybody with the link."
  • Protect the devices. A screen lock and passcode on every phone and laptop that opens the practice inbox, and no practice account signed in on a shared family computer.

5Put it in writing

HIPAA asks covered entities to do a risk analysis and keep written policies. Your email policy can be one page: which account you use, the BAA screenshot, your encryption decision, who has access, what you will and won't send by email, and what you do if a message goes to the wrong person. The Google Meet guide links the Security Risk Assessment Tool that HHS and ONC built for small and medium practices.

Emailing clients: what HHS allows

Most of the worry about Gmail is really about emailing clients. HHS has answered that question directly in its FAQ on email with patients:

  • Email is allowed with safeguards. "The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so." HHS's examples: "checking the e-mail address for accuracy before sending, or sending an e-mail alert to the patient for address confirmation prior to sending the message."
  • Unencrypted email isn't banned. "The Privacy Rule does not prohibit the use of unencrypted e-mail for treatment-related communications," but HHS asks for other safeguards, "such as limiting the amount or type of information disclosed through the unencrypted e-mail," and for Security Rule compliance.
  • Clients can ask for email, or refuse it. Covered providers must "accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or at alternative locations" (45 CFR 164.522(b)). If unencrypted email "is unacceptable to a patient," HHS says to offer another way, such as "more secure electronic methods, or by mail or telephone."
  • When a client emails you first, you "can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable." If you think the client may not know the risks, you "can alert the patient of those risks, and let the patient decide whether to continue e-mail communications."

The FAQ dates from 2008 and was last reviewed in 2013, but it is still on HHS's site and still the agency's plainest statement on the subject.

When a client asks for records by regular email

The right of access has its own rule. HHS's right of access FAQ says clients "have a right to receive a copy of their PHI by unencrypted e-mail if the individual requests access in this manner." Before you send, you "must provide a brief warning to the individual that there is some level of risk that the individual's PHI could be read or otherwise accessed by a third party while in transit, and confirm that the individual still wants to receive her PHI by unencrypted e-mail. If the individual says yes, the covered entity must comply."

Three points follow from the same guidance. Once the client has been warned and still wants regular email, you aren't responsible for a disclosure while the message is in transit, though you must still enter the address correctly. You can't make a client accept an unsecure method: "a covered entity is not permitted to require an individual to accept unsecure methods of transmission." And the right of access doesn't extend to psychotherapy notes kept separately from the record. Whether your notes meet that definition is a question for your attorney.

What your ethics code adds

The professional codes ask you to talk about this up front. The ACA Code says counselors "inform clients about the inherent limits of confidentiality when using technology" (H.2.c), and the APA Ethics Code asks psychologists who work "via electronic transmission" to "inform clients/patients of the risks to privacy and limits of confidentiality" (4.02(c)). Our informed consent template has an email and messages section you can pair with the consent wording below.

If an email goes to the wrong person

Autocomplete makes this an easy mistake to make. HIPAA presumes that an impermissible disclosure is a breach unless you can show "a low probability that the protected health information has been compromised," based on a risk assessment of at least four factors: what information was involved, who received it, whether it was actually viewed, and how far you reduced the risk (45 CFR 164.402). Ask the recipient to delete it, write down what happened, and talk to your attorney about notification. TLS doesn't help here: it protects a message on the way, not after it lands in the wrong inbox.

What not to put in an email subject line

Treat the subject line, the first line of the message and the sender name as public. They show up in phone notifications, on lock screens, on smartwatches and in inbox lists on shared computers, often before anyone unlocks anything. Keep these out of subject lines:

  • A client's name together with words like therapy, counseling, session or appointment
  • Diagnoses, symptoms, medications or words like crisis or risk
  • Anything the client said in session ("Following up on what you shared about your marriage")
  • Measure names with results ("Your PHQ-9 results")
  • Insurance, claim or balance details tied to treatment
  • Family members' names ("Your son's session")

Subject lines that work: "Your appointment on Thursday," "Forms for your next appointment," "Scheduling," "Message from [practice name]." Two related habits: name attachments neutrally ("Intake form.pdf," not a file named after the client and a diagnosis), and remember that a practice name with "Counseling" or "Therapy" in it tells anyone who sees the sender what kind of appointment it is. Ask new clients how they'd like you to contact them, and honor a request for another method.

A Gmail HIPAA checklist for therapists

Checklist21 checks in 5 groups

Account

Security

Encryption

Every client email

Clients

Consent-to-email wording you can copy

Paste this into your intake packet or consent document and fill in the brackets. Keep it short enough that clients actually read it. Have a healthcare attorney check it against your state's rules before you use it.

Consent to communicate by emailTemplate · 5 parts to fill in
CONSENT TO COMMUNICATE BY EMAIL
Client name: [name]Email address to use: [address]
I use email for scheduling, forms and short practical messages.Email is not for emergencies. In an emergency, call 911 or 988.I don't discuss therapy content by email. We save that for sessions.
Regular email is not fully secure.It can be read by others while it travels or once it arrives.Anyone with access to your phone, computer or account may see it.I keep subject lines neutral and messages short.Messages about your care may become part of your record.
You can change this choice, or choose another way, at any time.
Please choose one:Yes, you may email me about the topics I tick belowNo, please contact me by: [phone / mail / other]
Topics, if yes:SchedulingForms and documentsShort messages between sessions
Client signature: [signature]Date: [MM/DD/YYYY]

When a client asks for a copy of their records by regular email, send a short warning first and keep the reply in their record:

Wording to copy4 lines · 1 part to fill in
Before I send your records: regular email can be read by otherswhile it travels to you, or once it is in your inbox.Do you still want me to send them to [address] by regular email?Reply "yes" to confirm, or tell me if you'd prefer another way.

How this works in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and client forms in one place. It changes where the clinical paperwork lives, and that paperwork is often the most sensitive thing a practice sends by email.

  • Forms are filled in online, not emailed back.Instead of sending an intake packet as an attachment and getting completed PDFs back in your inbox, you send forms from a library of ready-made templates, including intake forms, consent to treat, telehealth consent, release of information, PHQ-9 and GAD-7. The client fills them in online, and the answers wait with the session. TranqBay doesn't score forms automatically; our PHQ-9 scoring page does the arithmetic if you need it.
  • Video sessions are HIPAA-ready.You hold sessions in TranqBay rather than in a meeting tool tied to your inbox.
  • TranqBay signs a BAA.It applies automatically when a therapist who is a covered entity accepts the Terms of Service; there's no separate document to sign. You can read TranqBay's Business Associate Agreement before you decide anything.

TranqBay's BAA covers TranqBay, not your inbox. If you keep using Gmail for anything about clients, keep Google's BAA and the settings above in place too. To see what a client sees before you set anything up, look at a practice website and booking page on practice.tranqbay.health.

Frequently asked questions about Gmail and HIPAA

Is Gmail HIPAA compliant for therapists?

Gmail in a Google Workspace account can be used for client email once an administrator accepts Google's BAA and the account is set up as Google's Implementation Guide describes. Personal Gmail can't. Either way, the safeguards in how you write and send email are your responsibility.

Can I use my personal Gmail for my therapy practice?

Not for client information if you're a covered entity. A personal account has no Workspace agreement and no Admin console, so there's no BAA to accept. Use a Workspace account on your practice domain, or keep client communication in a system that signs a BAA with you.

Is Gmail encrypted?

Gmail uses TLS in transit whenever the receiving server supports it, and Google's help says "All Gmail messages use TLS automatically." If the other server doesn't support TLS, Gmail still sends the message unencrypted unless an administrator has required TLS for that domain. Hosted S/MIME and client-side encryption add more protection on certain editions.

Does Gmail confidential mode make email HIPAA compliant?

No single feature does. Confidential mode controls access: expiration, revoking, no forwarding or printing, an SMS passcode. Google notes recipients can still take screenshots. It can be part of your safeguards, alongside the BAA, account security and careful content.

Is a BAA with Google enough?

No. The BAA makes Gmail eligible for client information and sets Google's duties. You still have to configure the account, secure it, decide on encryption, limit what you send and document your choices. Google's BAA says the customer is "solely responsible" for compliant use.

Can I email clients without encryption?

HHS says the Privacy Rule "does not prohibit the use of unencrypted e-mail for treatment-related communications," provided you use reasonable safeguards and limit what you send. Explain the risks, let the client choose, and offer another method to anyone who doesn't want email.

A client asked me to email their records. Can I?

Yes, if they ask for it. HHS says you must give "a brief warning" about the risk, confirm they still want regular email, and then send it. You can't require a client to accept an unsecure method, and psychotherapy notes kept separately aren't covered by the right of access.

I'm private pay only. Does any of this apply?

HIPAA applies to providers who send health information electronically in connection with standard transactions, such as insurance billing. You may not be a covered entity, but your ethics code and state law still ask you to protect client information and explain the limits of email. Many therapists follow these steps either way. Check with a healthcare attorney.

Are Gemini features in Gmail covered by Google's BAA?

Google's HIPAA help page says "help me write, contextual smart replies, and side-panel features are covered as part of Google Workspace with Gemini in HIPAA Included Functionality." Third-party add-ons are not.

Before you send your next client email

Open your Admin console and confirm the BAA shows as accepted, save the screenshot, require 2-Step Verification, turn off automatic forwarding, and add the consent wording above to your intake packet. Then read your last few client emails with fresh eyes: subject line, first line, attachments, recipients.

If you'd rather keep intake forms and consent out of your inbox, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources

22 sources

Google 14HHS 3Regulations 3Associations 2

Updated October 25, 2026. Found it useful? Send it to a colleague.

Run your practice in one place.

Your own website, online booking and video sessions.

  • Your own website
  • Online booking
  • Video sessions
See how it workspractice.tranqbay.health

More guides for therapists

All guides
HIPAA and telehealth8 min

Is Google Workspace HIPAA Compliant? BAA, Apps and Settings

Checklist
Running a practice13 min

Clinical Supervision Topics: 57 Questions and 10 Activities

57 questions
Running a practice7 min

Therapist Email Signature: 10 Examples and What to Include

Examples

In crisis? Don't use this site. Get immediate help or call emergency services.