Is a free Gmail account HIPAA compliant? (2025 update)

Gmail, short for Google mail, is a free service provided by Google that enables users to send and receive e-mail over the internet. 

In many ways, Gmail is like any other email service: You can send and receive emails, block spam, create an address book, and perform other basic email tasks.

Is a free Gmail account HIPAA compliant? No, based on our research, a free Gmail account is not HIPAA compliant. 

Will Gmail sign a business associate agreement (BAA)?

No, Google will not sign a business associate agreement for a free Gmail account, so it is not HIPAA compliant.

However Gmail offers HIPAA compliant email services for healthcare organizations, but only for paid accounts and only when configured properly. A paid Workspace account (which includes Gmail) provides many services covered by its BAA. This is not true for a free Gmail account.

Conclusion

Google does not sign a BAA for free Gmail and is, therefore, not HIPAA compliant.

Learn more: HIPAA Compliant Email: The Definitive Guide

FAQS

What is a business associate agreement?

A business associate agreement (BAA) is a legally binding contract establishing a relationship between a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and its business associates. The purpose of this agreement is to ensure the proper protection of personal health information (PHI) as required by HIPAA regulations.

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting the privacy and security of certain health information, known as protected health information (PHI).

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in big fines and penalties for covered entities.

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.