Is Gmail HIPAA compliant?

Yes, for Gmail in a Google Workspace or Cloud Identity account after an administrator accepts Google's Business Associate Agreement (BAA) in the Admin console. A personal Gmail account has no route in Google's BAA terms.

Is Gmail listed on Google's HIPAA page?

Google's English HIPAA page lists Gmail as one line in its list of Google services. Listing alone does not cover a practice's account, because coverage needs an administrator to accept the BAA for a Google Workspace or Cloud Identity account. The coverage question therefore turns on the account, not on the Gmail name. An administrator must review and accept the BAA before any PHI is used in Gmail.

Which Gmail features does the BAA cover?

Gmail's smart features are part of the covered set. The table below separates the Workspace account, the smart features and add-ons, because each has a different answer. It sets out each feature group, whether the BAA covers it and how the BAA is accepted.

What do Gmail's smart features cover under the BAA?

Help me write, contextual smart replies and side-panel features are covered as part of Google Workspace with Gemini in HIPAA Included Functionality. Those features therefore follow the Workspace or Cloud Identity account, so the same administrator acceptance applies to them.

What does the Gmail BAA leave out?

The BAA leaves out PHI that leaves the Covered Services, such as PHI kept in a third-party app or in offline storage. The exclusion covers PHI a customer creates, receives, maintains or transmits outside the Covered Services. Third-party apps and add-ons used with Gmail are not covered by the BAA, so PHI handled by an add-on sits outside the BAA. A practice that downloads a faxed referral from Gmail to a laptop folder, or opens it in an add-on, has moved that copy outside the BAA, so the safer habit is to keep patient documents inside the Workspace account.

Is a personal Gmail account covered by the BAA?

Google's BAA covers Gmail only in a Google Workspace or Cloud Identity account whose administrator accepts it in the Admin console. The BAA is valid only with an existing Services Agreement with Google, and its terms name no route for a free or personal Gmail account.

Which setup steps does Google's BAA require for Gmail?

Google's BAA terms set the first two steps below, and the Admin console sets the third. A practice using Gmail with patient information has these steps.

1. Use Gmail in a Google Workspace or Cloud Identity account, since coverage needs one.
2. Confirm an existing Services Agreement with Google is in place, because the BAA is valid only with one.
3. Have an administrator accept the BAA for that account before any PHI is used.
4. Keep PHI out of third-party apps and add-ons used with Gmail, and out of offline storage, since the BAA does not cover them.

Where does fax fit when a practice sends patient documents?

Sending a patient document by fax is a separate task from sending email through Gmail. A practice that must send patient records to an outside fax number needs a fax service that signs a BAA. The Gmail BAA does not reach a fax add-on, because a fax add-on added to Gmail is a third-party add-on. The fax service's own BAA is a separate agreement, since the Gmail BAA covers listed Google services.

A practice that wants to send a HIPAA fax from Gmail can read how to send a HIPAA fax from Gmail or Outlook. A practice weighing fax against email can also read whether online fax is more secure than email. Every Fax Pigeon plan includes the business associate agreement Fax Pigeon signs at signup, along with fax from email.

* Google's HIPAA and BAA terms were read on its own site on October 13, 2026. Fax Pigeon is not affiliated with Google.