Is Gmail HIPAA compliant?
Yes for Gmail inside a managed Google Workspace account once a super administrator accepts Google's amendment: a free personal Gmail address cannot be covered at all.
Applies to Gmail in Google Workspace. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Use Gmail on a paid Google Workspace or Cloud Identity subscription with your own domain. The amendment requires an existing Services Agreement to be valid and effective.
- A super administrator must accept the amendment before any patient information is sent or received: Admin console → Account settings → Legal and compliance.
- Gmail is named on Google's Included Functionality list effective 14 May 2026.
- Turn off or restrict Additional Google Services for staff who handle patient information.
- Vet Marketplace add-ons, mail plug-ins and third-party clients: Google excludes third-party applications and add-ons by name.
- Keep evidence: a screenshot of the acceptance shown in Legal and compliance.
Does Gmail sign a business associate agreement?
Yes. Google offers one. A Google Workspace or Cloud Identity subscription. Google names no edition requirement. Sign in as a super administrator → Admin console → Account settings → Legal and compliance → accept the amendment.
What this means in practice
Gmail's answer is really Google Workspace's answer. The amendment attaches to a Workspace or Cloud Identity Services Agreement, and Google's own text says the customer must have an existing Services Agreement for it to be valid and effective. Gmail is named on the Included Functionality list effective 14 May 2026, so mail in a managed account sits inside the covered set once a super administrator accepts under Legal and compliance.
A personal address ending in gmail.com is the opposite case. There is no Admin console, no super administrator and no Services Agreement for the amendment to attach to, so nothing about a free account can be brought under it, including the free account a staff member keeps using just for scheduling.
Acceptance is not the finish line either. Google draws a hard line around Included Functionality: Additional Google Services sit outside it, third-party applications and add-ons are excluded by name, and the amendment does not reach patient information handled outside covered services. Restrict those services for anyone touching patient records, and keep a screenshot of the Legal and compliance page as evidence.
How organizations get this wrong
- Letting a clinician forward patient email to a personal Gmail address, which no amendment can reach because free accounts have no Admin console.
- Accepting the amendment but leaving Additional Google Services switched on, so staff drift into products the list does not name.
- Installing a Gmail add-on or Marketplace mail tool that reads the mailbox, when Google excludes third-party applications entirely.
- Assuming acceptance covers everything Google ships: Gemini in Chrome is carved out even though the Gemini app itself is listed.
What the agreement does not cover
- Free personal Google accounts, which have no Admin console and no Services Agreement for the amendment to attach to.
- Additional Google Services.
- Third-party applications and add-ons.
- Gemini in Chrome.
Alternatives
Exchange Online is named on Microsoft's in-scope list and the agreement applies by default
Sits in front of your existing mailbox with the agreement included on every account
Keep a record of your Gmail agreement
Sources
- HIPAA Compliance with Google Workspace and Cloud Identity: Google. Read July 29, 2026.
- HIPAA Included Functionality: Google. Published May 14, 2026. Read July 29, 2026.
Google can change these terms at any time. If something here no longer matches what Google tells you, tell us.