Is Gmail HIPAA compliant?
Yes for Gmail inside a managed Google Workspace account once a super administrator accepts Google's amendment — a free personal Gmail address cannot be covered at all.
Applies to Gmail in Google Workspace. Last reviewed against Google's own documentation. Next review January 12, 2027.
Reviewed by Lisa Tran, CISSP — Healthcare Information Security Executive.
What you must do
- Use Gmail on a paid Google Workspace or Cloud Identity subscription with your own domain. The amendment requires an existing Services Agreement to be valid and effective.
- A super administrator must accept the amendment before any patient information is sent or received: Admin console → Account settings → Legal and compliance.
- Gmail is named on Google's Included Functionality list effective 14 May 2026.
- Turn off or restrict Additional Google Services for staff who handle patient information.
- Vet Marketplace add-ons, mail plug-ins and third-party clients — Google excludes third-party applications and add-ons by name.
- Keep evidence: a screenshot of the acceptance shown in Legal and compliance.
Does Gmail sign a business associate agreement?
Yes. Google offers one. A Google Workspace or Cloud Identity subscription. Google names no edition requirement. Sign in as a super administrator → Admin console → Account settings → Legal and compliance → accept the amendment.
What this means in practice
Gmail's answer is really Google Workspace's answer. The amendment attaches to a Workspace or Cloud Identity Services Agreement, and Google's own text says the customer must have an existing Services Agreement for it to be valid and effective. Gmail is named on the Included Functionality list effective 14 May 2026, so mail in a managed account sits inside the covered set once a super administrator accepts under Legal and compliance.
A personal address ending in gmail.com is the opposite case. There is no Admin console, no super administrator and no Services Agreement for the amendment to attach to, so nothing about a free account can be brought under it — including the free account a staff member keeps using just for scheduling.
Acceptance is not the finish line either. Google draws a hard line around Included Functionality: Additional Google Services sit outside it, third-party applications and add-ons are excluded by name, and the amendment does not reach patient information handled outside covered services. Restrict those services for anyone touching patient records, and keep a screenshot of the Legal and compliance page as evidence.
How organizations get this wrong
The specific mistakes we see with Gmail, not generic advice.
- Letting a clinician forward patient email to a personal Gmail address, which no amendment can reach because free accounts have no Admin console.
- Accepting the amendment but leaving Additional Google Services switched on, so staff drift into products the list does not name.
- Installing a Gmail add-on or Marketplace mail tool that reads the mailbox, when Google excludes third-party applications entirely.
- Assuming acceptance covers everything Google ships — Gemini in Chrome is carved out even though the Gemini app itself is listed.
What the agreement does not cover
- Free personal Google accounts, which have no Admin console and no Services Agreement for the amendment to attach to.
- Additional Google Services.
- Third-party applications and add-ons.
- Gemini in Chrome.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
Exchange Online is named on Microsoft's in-scope list and the agreement applies by default
Sits in front of your existing mailbox with the agreement included on every account
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Gmail, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Google’s own published documentation, read on the date shown.
- HIPAA Compliance with Google Workspace and Cloud Identity — Google. No publication date given. Read July 29, 2026.
- HIPAA Included Functionality — Google. Published May 14, 2026. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Google’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.