Is Your Practice Email HIPAA Compliant? Services and SettingsWhat HHS says about email, which services sign a BAA, and the settings a practice should check.

Only if the email service has signed a Business Associate Agreement (BAA) with your practice and you apply reasonable safeguards. A mailbox with no BAA does not meet that test. We read HHS, Google, Microsoft, Proton and Paubox pages on October 9, 2026. This guide covers the rules, the services and the settings.

HIPAA compliant email at a glance

• HHS says providers may email patients "provided they apply reasonable safeguards when doing so."
• Google lists Gmail as covered functionality under its BAA, as of August 31, 2026. An administrator must accept the BAA first.
• Microsoft says its BAA is available "by default" through its Data Protection Addendum. Exchange Online is in scope.
• Proton states: "We offer BAAs to all Proton users." Paubox states: "Paubox includes a BAA with all accounts."
• Ahrefs shows 2,000 US searches a month for "hipaa compliant email" (checked October 9, 2026).

Is email HIPAA compliant?

Email is allowed. Compliance depends on how the practice uses it. An HHS FAQ states: "The Privacy Rule allows covered health care providers to communicate electronically" with patients, "provided they apply reasonable safeguards when doing so." HHS created that FAQ on December 15, 2008 and last reviewed it on July 26, 2013.

The FAQ gives examples of safeguards. Check the address before you send. Limit the information in the message. Honor a patient's request for another way to communicate.

What is HIPAA compliant email?

It is email on a service that has a BAA with the practice, used with safeguards. The email provider stores every message, so it is a business associate. HHS gives this example of one: a "Cloud service provider engaged to create, receive, maintain, or transmit electronic PHI." HHS says a practice may disclose PHI to a business associate once it has "satisfactory assurances, in the form of a contract or other written arrangement."

Which email services sign a BAA?

We read four vendors' own pages on October 9, 2026. Each one offers a BAA. The route differs.

How do you send HIPAA compliant email in Gmail?

Use Gmail inside a Google Workspace account that has accepted the BAA. Google says the BAA is "made available to customers for electronic acceptance via their Admin console." Our guide Is Google Workspace HIPAA Compliant? covers Drive, Docs and Meet as well.

1. 1

   Use a Workspace account

   Move patient email to the practice's Google Workspace account. Google's HIPAA help page covers Workspace and Cloud Identity only.

2. 2

   Accept the BAA

   A super administrator opens the Admin console, then Account settings, then Legal and compliance, and accepts the BAA.

3. 3

   Review add-ons

   Google says third-party applications and add-ons "are not included in the Included Functionality covered by the BAA." Remove any that touch patient mail.

4. 4

   Check each address

   Confirm the patient's address before you send. Keep clinical detail to the minimum the message needs.

5. 5

   Record patient preferences

   Note how each patient wants to be contacted. Honor reasonable requests for another method.

Is encrypted email required by HIPAA?

The rule does not use the word "required" for encryption in transit. The Security Rule at 45 CFR 164.312(e) lists encryption as an "Addressable" specification, to be used "whenever deemed appropriate." HHS also states that "the Privacy Rule does not prohibit the use of unencrypted e-mail for treatment-related communications." Ask your compliance adviser what the Addressable label requires of your practice.

Patients have a say. An HHS FAQ dated June 24, 2016 says a patient may ask for records by unencrypted email. The practice "must provide a brief warning to the individual that there is some level of risk" and confirm the choice.

Which email settings should a practice check?

Check five areas. They follow from the Security Rule duty to "guard against unauthorized access to electronic protected health information." The list is our working guide.

• BAA on file

  Confirm the BAA is accepted for the account you use today. Save proof.

• Sign-in security

  Turn on two-step sign-in for every mailbox. Remove accounts of former staff.

• Add-ons and apps

  List every app with mailbox access. Remove those without a BAA.

• Forwarding rules

  Look for rules that forward practice mail to personal mailboxes. Turn them off.

• Website forms

  Check where contact forms send their email. A form can push patient details into an uncovered inbox.

How Webpatch helps

Website forms are the most common way patient details land in a practice inbox. Webpatch builds and manages websites for healthcare practices. We trace each form to the mailbox and vendor that receive it. We check that a BAA covers each stop. We run The Webpatch Tracker Check on the pages that hold those forms. See Which Online Forms Are HIPAA Compliant? for the form tools. We are not a law firm. Contact Webpatch to review how your website and email work together.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.