Usually, yes. You need a paid Google Workspace or Microsoft 365 account with a signed business associate agreement (BAA) before you email client information at all. Neither platform guarantees that every email you send arrives encrypted.

That matters most for the emails a private practice sends every week: intake paperwork, superbills, treatment summaries, and referrals to colleagues. Here's what Google and Microsoft cover, what they leave to you, and how to check your own setup.

What a BAA with Google or Microsoft covers

HIPAA requires a BAA with any vendor that stores or sends protected health information (PHI) for you. Both companies sign one, and Google says customers who haven't signed its BAA "must not use PHI" in Google Workspace.

Microsoft says it "enters into Business Associate Agreements" with its healthcare customers. A free Gmail or Outlook.com account doesn't come with a BAA, so it shouldn't carry client information at all.

A BAA is one part of HIPAA compliant email, along with encryption on every message you send.

Where the encryption gap comes from

Email is protected on its way to the recipient by a type of encryption that both your email provider and the recipient's provider have to support. Google's own help page says that if the receiving server doesn't support it, "Gmail still sends messages but the connection isn't secure."

Google also offers a setting that requires encryption for addresses you've added ahead of time. A new client's address won't be on that list.

In Microsoft 365, message encryption doesn't happen automatically. When it is applied, clients who read email in Gmail, Yahoo, or another service get a link and have to sign in or request a one-time passcode to read your message.

What Paubox found when it tested both platforms

In May 2025, Paubox sent test emails from Google Workspace and Microsoft 365 to mail servers that only accept old, weak versions of email encryption, the kind still found at some small clinics, vendors, and rural networks.

Google sent the messages with that old, weak protection. Microsoft sent them with no encryption at all, and neither platform told the sender.

The full results are in Paubox's report, How Microsoft and Google put PHI at risk. Paubox notes that results can vary with admin settings, and for a practice without an IT person, the default settings are often the only settings.

What HIPAA expects from you

HHS allows clinicians to email clients, as long as you use reasonable safeguards. If a client prefers unencrypted email after you've explained the risk, HHS says you can honor that, while limiting what you share.

That guidance is about you and one client. A referral or treatment summary you send to a colleague doesn't come with that client's sign-off, and the HIPAA Security Rule still expects you to protect PHI while it's being sent.

Questions to ask about your own setup

  • Is your email on a paid Google Workspace or Microsoft 365 plan, with a signed BAA?
  • Could you tell whether last week's email to a client's Yahoo address was encrypted?
  • Do you have to remember to do something, like type a word in the subject line, before an email is encrypted?
  • If a client can't open a protected message, what do you send instead?

If one of these stops you, that's the part of your setup to fix first.

How to add HIPAA compliant email to Google or Microsoft

You can keep your Google or Microsoft account. Paubox Email Suite works with Google Workspace and Microsoft 365 and encrypts every outbound email automatically, so you keep your address and keep writing in Gmail or Outlook.

When a client's email provider supports modern encryption, your message lands in their inbox like any other email, with nothing for them to open or log into. Only when it can't does Paubox send a secure link instead of sending the email unencrypted, and by default the client clicks it to read and reply in their browser, with no account or app.

Because encryption happens automatically, there's nothing for you to remember before you send. Paubox also signs a business associate agreement with its customers and is HITRUST certified.