Usually yes, unless you can document a low probability of compromise. An auto-forward rule effectively transfers protected health information (PHI) from your work email to a personal email account your organization doesn't manage.

According to the HHS breach notification guidance, an impermissible use or disclosure of PHI "should be presumed to be a breach" of PHI unless a determination can be made there is a low probability of compromise based on at least 4 factors. The burden of proof falls on the covered entity.

Paubox's Healthcare Email Security Maturity Index 2026 found that 58% of healthcare IT leaders surveyed in the US experienced an email-related breach in the last 24 months. Since all those surveyed considered real-time breach detection excellent or good, anyone with a forward rule ought to be able to demonstrate a low probability of breach using mail logs.

 

Why the forward counts as an impermissible disclosure

Under the HIPAA Privacy Rule, as summarized by HHS, you may use or disclose PHI only when the rules allow it or when the patient has given you written permission. If you have a rule set up to forward your work email to your personal email account you are violating this rule. Any referrals, lab results, or billings forwarded to a personal email account are outside of your organization's control.

The breach definition's three exceptions rarely help. They cover unintentional access, disclosures between authorized staff, and recipients unable to retain the information. A forwarding rule is deliberate, sends mail outside the organization, and leaves copies in Gmail until someone deletes them.

Covered entities have reported breaches from employees storing PHI at home. Jiang and Bai found in their JAMA Network study that, out of 1138 breach reports submitted to the HHS between 2009 and 2017, 74 (6.5%) of the reports involved employees storing PHI at home. Some reports were about employees sending PHI to their personal devices or email accounts. They concluded "more than half of the cases were not from external causes" but stated it is possible the companies reporting the breaches used HHS reporting criteria incorrectly.

Read also: Does forwarding work emails to personal accounts violate HIPAA?

 

What a personal Gmail account changes

For those using Google Workspace or Cloud Identity, a HIPAA business associate amendment can be accessed from Google. However, they are not allowed to store PHI in these products unless they have a BAA with Google. Personal Gmail accounts can't be covered for this BAA.

A quote from a study in Nature Medicine points out why you should avoid using PHI on your personal device or account. It states, "HIPAA focuses its regulation on particular actors and their activities, not the data themselves."

Once PHI is stored on your personal device or account, there is nothing your organization can do to prevent the person from sharing that information. According to Google's help article about forwarding in Google Workspace, they state forwarding can be turned on by default and give forwarding to a personal email account as one reason why someone may want to use this feature.

 

Who created the forwarding rule?

Before you can conclude that a breach is unlikely, you need to establish whether an employee or a criminal set up this rule. In November 2020, the FBI sent a notification to private industry stating criminals have been setting up auto-forward rules on compromised web-based email accounts to mask their activity. One company in the US manufacturing medical equipment was compromised and criminals were able to obtain $175,000. The auto-forward rules placed on their email account went completely unnoticed.

Phishing has been shown to be one of the top ways criminals gain access to employee email accounts. Gordon et al. looked at just under 3 million simulated phishing emails that were sent to a convenience sample of healthcare institutions in the US between 2011 and 2018. They found "almost 1 in 7 simulated emails sent were clicked on by employees." Paubox found 64% of healthcare organizations have had a confirmed or suspected phishing email attack that contained AI-generated content.

By looking at the sign-in history and what emails the rule is forwarding you can determine if an employee or criminal created the rule. If you see that the rule is set up to forward emails that contain certain keywords like "invoice" or "payment," then this is a red flag that a criminal took over the email account, and you need to dig deeper.

 

Apply the four factors to what left the mailbox

The first thing to do is review the creation date of the forward rule along with the emails that landed in the personal account. Administrators can look up the date or time an email was forwarded using Email Log Search in Google Workspace. According to the FBI, you should retain log data for any mailbox changes for a minimum of 90 days.

Factor one will be what PHI was sent to the personal email account. Maybe the rule was created for an employee that scheduled patients for oncology and forwarded treatment plans, path reports, and insurance member ID numbers. Factor two will look at who received the PHI. In this case it would be the personal email account and the company that owns the email account.

Factor three will determine if the PHI was actually obtained or viewed by anyone. Since the rule forwarded the emails to the personal account, we can assume that someone viewed the PHI. Factor four is what you have done to mitigate the situation. Did you turn off the rule and have the employee confirm that they deleted the emails?

Employees have to delete the name of the patient from their emails, but factor one also includes the chance of the PHI being re-identified. A Nature Communications study found that "99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes." While you may not have that many attributes in one email over the course of several months you could collect information about a patient that would allow them to be re-identified.

 

Meet the deadline and apply the sanction policy

According to 45 CFR 164.404, discovery is considered to have occurred on the first day that the breach is known by a member of the workforce other than the person that committed the breach or could have reasonably been known with due diligence. The employee who created the rule does not count.

You must notify all patients that their information may have been compromised as soon as possible but no later than 60 days from the day that you discovered the breach. If you choose to notify the patients via email they must have consented to receive notifications by email. Make sure that you are using a HIPAA compliant email service to send these notifications to your patients.

Another thing that you should do is follow your organization's sanction policy. The HIPAA Privacy Rule requires that you take appropriate action against any member of your workforce who violates your privacy policies. An Inquiry survey found that "punishment severity and punishment certainty" were factors that contributed to an employee's intention to follow security policies. Paubox found that 18% of organizations that had a breach did not make any changes that were significant after the breach occurred. Make sure that you notify your patients and fix the problem that caused the forwarding rule to be created.

 

Disable auto-forwarding to prevent future breaches

If you are using Google Workspace, you can disable automatic forwarding or allow it to forward only to an internal email address. If you use Microsoft 365 new organizations have automatic external forwarding disabled by default. Microsoft recommends that you still set your outbound policy to disable external forwarding. The FBI also recommends that you disable automatic forwarding to an external address.

By disabling the forward rule, you are not fixing the problem that caused the employee to set up the rule in the first place. Paubox found that 48% of organizations always use a portal to send encrypted emails to their patients and 34% of those organizations have staff working around the encryption. A recent scoping review of 58 studies looked at why nurses work around best practices in the acute care environment. Most of the studies were conducted in the US, and they concluded that "Workarounds enable, yet potentially compromise, the execution of patient care."

Paubox email solution automatically encrypts every email that leaves your organization and delivers the message to your recipient's inbox without the use of a portal or password. If you upgrade to our Premium plan you will have the ability to use data loss prevention (DLP). DLP allows you to create rules that will quarantine an email if it contains certain content and alert an admin that an email was quarantined.

 

Why a low probability of breach is not enough

When you are trying to determine if there is a low probability of a breach you will be relying on information that you cannot verify. In November of 2016, a random audit was performed on an email account at the Multnomah County, OR Health Department. They found that the employee had been forwarding all of her work email to a personal Google account since August of 2012. The Health Department was able to verify that the email account was deleted and determined that there was a low probability of further disclosure. Their letter to patients stated that the email account was "maintained by Google and not the county."

You will also have to rely on your employees telling you the truth. In a study of final year medical students at the University of Toronto they found that 68% of students believed that using their personal phone to communicate with patients was a risk to confidentiality. However, 22% of students said that they "still use their personal phone to text or email identifiable patient data."

By disabling auto-forwarding you are preventing one method of an employee stealing PHI from your organization. They can still manually forward emails, download them, or take screenshots of the information they have access to. You can only hope that they are telling you the truth when you ask them to delete the emails from their personal account.

 

FAQs

Does encrypting the forward in transit change the answer?

No, encryption in transit protects messages on their way to Gmail, but the copies in the personal inbox stay readable to anyone who can open the account.

 

Can the organization notify patients without completing the risk assessment?

Yes, HHS gives covered entities discretion to send the required breach notifications without first performing a risk assessment.

 

Do breaches affecting fewer than 500 patients go to HHS?

Yes, covered entities log them and report them to HHS within 60 days after the end of the calendar year of discovery.