AK: Can I email PHI?
GV: HIPAA mandates that you protect PHI (Protected Health Information) in transit, in storage, and at rest. There is a common misconception that email is a secure way to send and receive PHI. On its own, email is not a secure platform to transmit PHI. In fact, using Google’s email service, Gmail, to send PHI without encryption is against Google’s Terms of Service. Emailing PHI without encryption could very easily lead to a breach if the email ended up in the hands of the wrong party.
AK: Is Gmail HIPAA compliant? What about G Suite (now Workspace)?
GV: Gmail is not automatically HIPAA compliant, however, you can implement security measures to ensure the safety of sensitive information you send via Gmail. When it comes to protecting emailed information, email encryption is the name of the game. You need to use a third-party email encryption service to protect any PHI you send over Gmail.
End-to-end email encryption configures the data so that only the sender and intended recipient can read the email’s content. It assigns a unique “key” for unlocking the contents of the email that only the intended recipient gets. This way, if you send the email to the wrong address, the information is still safe. There are several services you can use to make Gmail HIPAA compliant, including but not limited to: Virtru, RMail, LuxSci, Identillect, and Zix.
G Suite (Workspace) is the paid version of Gmail. You can make Gmail HIPAA compliant without purchasing Workspace, but it is more difficult. There are several security benefits to purchasing this program, like administrator controls on users. For example, administrators can mandate the use of two-factor authentication for all employees. Additionally, admins can limit employees’ email usage on mobile devices. Most notably, in order to be effective, you must implement these security measures on all employee accounts. Lear more about HIPAA Compliant GMAIL.
AK: Do I need a Business Associates Agreement with Google to make Gmail HIPAA Compliant?
GV: To make Gmail HIPAA compliant, you must enter into a Business Associates Agreement with Google. Because Google is such a large company, the process of signing a Business Associates Agreement is different. Unlike your other Business Associates, Google will not send you a signed document. Instead, you will virtually enter into the agreement when you set up the administrator account on your company’s Workspace profile. When you click on the tab “Privacy Additional Terms” there is an option to accept Google’s Business Associates Agreement.
AK: Does sending HIPAA compliant emails mean I am fully compliant with HIPAA law?
GV: No. Sending HIPAA compliant emails does not ensure HIPAA compliance. For example, imagine an employee is drafting an encrypted email containing PHI, and she gets up to go to lunch, leaving her computer unlocked. Now, the PHI is exposed to everyone who walks by, putting her company at risk of a breach.
HIPAA requires organizations to protect PHI they come into contact with at all times. Safe email practices are just one piece of the puzzle. Therefore, using achieving HIPAA compliance with Gmail requires constant mindfulness and effort.
As with every HIPAA compliance security measure, organizations must train their employees how to correctly use programs like Gmail. Employers must include email practices for making Gmail HIPAA compliant in their policies and procedures.
Additionally, entities should assign an administrator who is knowledgeable and readily available to help with all matters concerning email security. Penalties for violating HIPAA via email are just a severe as any other punishments, with fines ranging from $100 – $50,000 per violation (with an annual cap at $1.5 million per incident). Your company can make Gmail HIPAA compliant with a little concentrated effort.
For more information on HIPAA Compliance and Gmail here:
To purchase HIPAA Compliant GMAIL