Gmail can be used for protected health information (PHI) only as part of Google Workspace with a signed business associate agreement (BAA), and even then Google leaves HIPAA compliance to the customer. Microsoft 365 works the same way: Microsoft offers a BAA but states that its services do not on their own achieve compliance.
PreVeil also offers a BAA, and plugs into Outlook or Gmail to act as a secure, end-to-end encrypted channel that can protect PHI. It sits alongside your staff’s existing email and allows free, secure collaboration with external parties, like patients, other providers, and payers. This post compares what each covers and outlines what a small practice still has to add.
Is Gmail HIPAA compliant?
No email service is HIPAA compliant on its own. Google offers a BAA for Google Workspace, and Gmail is on its list of covered services, but Google says customers are responsible for their own HIPAA obligations and that customers without a signed BAA “must not use PHI” in Workspace.
How do Gmail, Google Workspace and Microsoft 365 compare for HIPAA?
Google Workspace and Microsoft 365 both offer a BAA that covers email, and both leave HIPAA compliance with the customer. For outside recipients, Gmail’s standard protection is TLS, while Microsoft 365 offers Purview Message Encryption. PreVeil adds end-to-end encryption inside Gmail and Outlook rather than replacing either. The table uses only what Google and Microsoft state on their own pages.
What does a practice still need beyond the BAA?
A BAA is one requirement among several. The practice still needs a risk analysis that covers email, required audit controls and regular activity review, unique user IDs, a documented decision on encryption, training and documentation kept for six years.
Why does end-to-end encryption matter?
While a BAA covers the vendor relationship, encryption can change what happens if a mailbox or a server is compromised. Under 45 CFR 164.402, PHI rendered unreadable to unauthorized persons by encryption is not “unsecured,” so its loss does not trigger breach notification. End-to-end encryption keeps PHI encrypted inside the mailbox, not only in transit. This safe harbor exemption can prevent practices from needing to report data breaches to the OCR portal.
HHS guidance adds that decryption tools “should be stored on a device or at a location separate from the data they are used to encrypt or decrypt.” PreVeil cannot access or decrypt customer data, because the encryption keys stay on users’ devices.
How does PreVeil work with Gmail and Outlook?
PreVeil works inside Gmail, Outlook and Apple Mail, so your staff keeps the email client they already use. Message contents and attachments are encrypted end to end on the sender’s device, files in PreVeil Drive are encrypted the same way, and PreVeil signs a BAA. External parties, such as patients, other providers, payers, and business associates read and reply for free from their browser.
Replies from those recipients stay encrypted end to end. Administrators on the Business plan get an admin console and system logs that support the required audit controls standard. More than 3,000 organizations use PreVeil to encrypt email and files end to end.
Frequently asked questions
Is free Gmail HIPAA compliant?
Google states that customers without a signed BAA must not use PHI in its services. A BAA is not available with free Google accounts – upgrading to a paid Google Workspace plan adds a BAA, but does not guarantee HIPAA compliance.
Is Outlook HIPAA compliant?
Microsoft does not describe Outlook or Microsoft 365 as HIPAA compliant. It includes a BAA by default for covered entities and business associates and states that using its services does not on its own achieve HIPAA compliance.
Is a BAA with Google or Microsoft enough?
No BAA will guarantee HIPAA compliance. The practice still needs a risk analysis, required audit controls and activity review, unique user IDs, training, documentation and a documented decision on encryption, which is addressable under 164.312(a)(2)(iv) and (e)(2)(ii).
Can PreVeil read email sent from Gmail or Outlook?
No. PreVeil encrypts message contents and attachments on the sender’s device, and the keys stay on users’ devices, so PreVeil cannot decrypt them.
How can a practice on Gmail or Microsoft 365 see where PreVeil fits?
A demo with PreVeil covers how it fits the practice’s email and file sharing.
