With billions of users, Gmail currently stands as one of the most popular email services in the world. However, a pressing question for healthcare organizations is whether Gmail can email protected health information (PHI) to comply with the Health Insurance Portability and Accountability Act (HIPAA).
Let’s break down the steps in making Gmail HIPAA-compliant.
Table of Contents
Why Gmail HIPAA Compliance Is Important
Gmail is not inherently compliant by default. This free service is intended for personal use and is not HIPAA-compliant. Even with a paid Google Workspace account and a signed BAA, you must implement secure email communications measures and follow best practices to comply.
Given this information, using Gmail or any email in healthcare poses a privacy and security risk. After all, email platforms are vulnerable to phishing, viruses, malware, ransomware, human error, and other dangers. Prioritize using email that complies with HIPAA first, then implement strict privacy protocols to protect your customer’s data and your business.
10 Steps to Achieve Gmail HIPAA Compliance
1. Sign Up for a Paid Google Workspace Account
To enjoy the security features of HIPAA-compliant email, you need a paid account. This gives you access to the business associate agreement, which is required by HIPAA for covered entities and business associates.
2. Sign a Business Associate Agreement (BAA)
You cannot ensure HIPAA compliance without a BAA from your providers. According to Google’s information on HIPAA Compliance, administrators must review and accept the Google Workspace HIPAA Business Associate Addendum before using Gmail with PHI. This legal contract outlines Google’s responsibility to handle PHI in compliance with HIPAA regulations.
3. Configure Security Settings
Once the BAA is signed, configure security settings to ensure HIPAA compliance. Encourage users to create strong, unique passwords and enable multi-factor authentication (MFA) for their Google Workspace accounts. Remind your staff to regularly update their passwords and implement policies to enforce password changes. Access controls should be used to manage user permissions and restrict access to PHI.
4. Use HIPAA-Compliant Encryption Software
Sending unencrypted email does not violate HIPAA, but you should still take steps to protect data to avoid HIPAA violations. Google’s email encryption FAQs show that Gmail provides encryption capabilities for data at rest and in transit using TLS. Encryption prevents anyone from snooping on your emails. However, data can still be intercepted if the receiver’s email provider doesn’t support TLS encryption. To address this issue, consider third-party HIPAA-compliant encryption solutions, which encrypt all outbound emails by default, ensuring complete HIPAA compliance in email communication.
5. Get Patient Consent
Obtain patient consent for sending PHI via email. The patient consent form should ideally inform clients of the HIPAA law, warn them of email communications risks, and outline how your healthcare organization forwards emails. For instance, you may tell them you only deliver emails appropriate for diagnosis, reimbursement, or other related reasons.
6. Use an Email HIPAA Disclaimer
Including a disclaimer or privacy statement is one of the ways to be HIPAA-compliant on Gmail. This disclaimer warns recipients that the email may contain sensitive PHI and should be treated with care.
While HIPAA doesn’t require disclaimers, including them in your emails helps avoid unintentional access.
7. Limit Information to the Minimum Necessary
Whenever possible, avoid sending highly sensitive PHI via email. If you need to send PHI, only include the most necessary information for healthcare or billing reasons. Cyberattackers have become more sophisticated in their methods, so refrain from providing unnecessary data that can be used for criminal activities.
8. Educate Employees on HIPAA Compliance
Conduct regular HIPAA training sessions to ensure that employees understand the importance of protecting PHI, recognize potential risks, and know how to handle PHI securely within the Google Workspace environment. Provide guidelines on proper email usage, data handling, and reporting procedures for suspected security incidents. Employees must be adequately trained on the correct use of email when handling and transmitting PHI.
9. Monitor Account Activity
Google has an Admin console that makes examining user reports and logs easy. Here, you can check for security risks, track user activity, and measure user collaboration. Turn on notifications so Google can send you alerts for activities such as suspicious login attempts, changed passwords, deleted users, and suspended users made active.
10. Use Gmail Controls
Gmail has controls to ensure messages and attachments reach the right people. When you compose emails and add files from Google Drive that might contain sensitive information, you can choose to share them with only intended recipients. By default, files from Drive attached in Gmail are marked as “Restricted,” meaning extra steps are needed for sharing.
If you haven’t already shared a file with everyone receiving your email, you can decide to share it with “Anyone with the link” within your Google Workspace. Administrators can also adjust the default settings and create rules to protect personal info in emails.
(See: Google Workspace and Cloud Identity HIPAA Implementation Guide)
Bonus Tip: Regularly update your Gmail app
Keep Google Workspace applications and related software up to date. Avoid delaying in pushing updates for newer versions and software patches. This addresses potential vulnerabilities and protects against emerging threats.
Make Gmail HIPAA-Compliant
Gmail is a convenient and popular email solution, but it requires careful setup to meet the stringent standards of HIPAA.
While Gmail has security protocols, it’s essential to sign a BAA, ensure that staff understand the importance of HIPAA compliance, and take extra measures to mitigate the risks associated with using email. More importantly, remember that achieving Gmail HIPAA compliance requires a collaborative effort.
