Gmail Can Be HIPAA Compliant. Your Patient Newsletter Still Shouldn't Go Out From It.

Gmail can be HIPAA compliant. That's the part most practices get right. The part they get wrong is assuming that makes Gmail a reasonable way to email patients in bulk.

Which Gmail we're talking about

Free, personal Gmail accounts are not covered. There's no business associate agreement for an @gmail.com address, so PHI doesn't belong there. Full stop.

Google Workspace is different. Google offers a BAA that a super administrator reviews and accepts inside the Admin console, and Google's own guidance is clear that customers who haven't accepted it shouldn't put PHI in Workspace at all. Once it's accepted, Gmail is on Google's list of covered services, alongside Calendar, Drive, and Meet.

So a front desk coordinator emailing one patient from a Workspace account with a signed BAA, configured properly, is a defensible setup. Plenty of practices run exactly that and should keep running it.

Where the setup quietly breaks

The trouble starts when the practice decides to send a recall campaign, a reactivation email, or a newsletter to the whole patient list, and Gmail is the tool already open.

The add-ons aren't covered. Gmail doesn't do mail merge well for large lists, so someone installs a third party extension that does. Google states plainly that third party apps and add-ons fall outside the Workspace BAA. The moment that extension reads your spreadsheet of patients and their last visit dates, PHI has moved to a vendor with no agreement, even though Gmail itself is covered.

The limits are built for people, not campaigns. Workspace caps each user at 2,000 messages a day, with mail merge lower still. A twelve location group with a modest inactive list hits that ceiling on day one, and staff start splitting sends across several mailboxes to get around it.

The reputation is shared. Every message from your primary domain counts toward Google's bulk sender threshold, and campaign mail sent from the same domain your doctors use for referrals puts both on the same reputation. We covered how that plays out across locations in why Google counts your forty locations as one sender.

Nobody owns the opt out list. When a patient replies asking to stop, that request lives in one person's inbox. The next campaign goes out from a different mailbox, built from the same spreadsheet, and reaches them anyway.

The better split

None of this is an argument against Workspace. It's an argument for using it for what it's good at.

Keep one to one conversations in Gmail under the BAA. A question about a bill, a follow up from a provider, a referral back and forth. That's what it's designed for, and the covered services list reflects it.

Move anything that goes to a list into a platform built for sending to lists, with its own BAA, its own sending domain, and real unsubscribe handling. That's the lane PatientCampaign sits in, and it's also why our guide on emailing patients without violating HIPAA spends more time on workflow than on encryption.

The quick audit for a practice on Workspace is two questions. Has a super admin actually accepted the BAA? And what Gmail extensions are installed across staff accounts? The second answer is usually the more interesting one.