Estimated reading time: 8 minutes.
Summarize with ChatGPTEveryone knows Gmail, right? You're a longtime Gmail user yourself.
But you've recently learned that a free Gmail account isn't designed to handle protected health information (PHI).
So what does that mean for your practice? Do you need to give up Gmail and switch to a HIPAA-compliant email service like Hushmail?
Not necessarily. Depending on your needs, you may be able to keep using Gmail and add Hushmail for communications involving PHI.
Here's how the two services can work in your small healthcare practice.
TL;DR:
You don’t necessarily have to choose between Gmail and Hushmail. The right setup depends on how you want to handle everyday email and PHI.
Google Workspace: Keep Gmail as your main inbox, but configure it properly for HIPAA compliance and accept Google's BAA.
Gmail + Hushmail: Keep using Gmail for everyday email, then use Hushmail's secure messaging when you need to handle PHI.
Hushmail secure email: Use Hushmail as your main practice inbox for both everyday email and secure communications.
For many therapists, the key question is not "Gmail or Hushmail?” It's which setup best fits the way you want to work.
HIPAA doesn't dictate exactly how practitioners should use email. But the rules require administrative, technical, and physical safeguards to keep protected health information (PHI) secure.
👉 For details on the rules and a list of common email mistakes, read HIPAA email rules.
The goal is to safeguard PHI and stay HIPAA-compliant. This applies to anyone you communicate with about care, including current, past, and prospective clients, as well as insurers and other practitioners.
It's not just about compliance, though. Secure communications are also good practice and build trust with the people under your care.
This is why using a paid HIPAA-compliant email service is a good idea.
But that doesn't necessarily mean you have to ditch your Gmail account. You just have to be careful about which type of Gmail account you use and how you use it.
Most people are familiar with the free version of Gmail. Maybe you even still use the same account you set up as your first-ever email.
But there's also the paid version. Google Workspace is a suite of premium tools purpose-built for businesses. It includes Gmail and other software like Google Calendar and Google Drive, plus additional features not available on free accounts.
Many differences separate the two types of Gmail accounts. These are the key things therapists and healthcare professionals need to know about each version:
| Free Gmail account | Paid Google Workspace account |
|---|---|
|
|
If you use Gmail for your small practice, you have three ways to set up your communications to support HIPAA compliance:
This option lets you stay in the familiar Gmail interface, but you'll need to set it up appropriately for HIPAA compliance.
First, a Google Workspace super administrator must review and accept Google's HIPAA Business Associate Amendment in the Admin console. You'll also need to make sure you're only using Google services covered by the BAA and configure your account appropriately for HIPAA compliance. Depending on your needs, you may also choose to add third-party encryption software.
| Pros | Cons |
|---|---|
| ✅ If you already have a Google Workspace account, you won't need to change your email address | 🟡 Getting Gmail configured properly for a small therapy practice can be difficult for those without technical proficiency |
| ✅ All your email communications in one spot | 🟡 Only provides encryption in transit. Additional encryption software may be needed |
| ✅ Familiar user interface and workflow | 🟡 Not all Google Workspace services are covered under the BAA |
| ❌ Lacks personalized support | |
| ❌ Not built specifically for healthcare users | |
| ❌ No forms with healthcare templates | |
| Starting price: Google Workspace Business Starter is per user/month when billed monthly. Any additional encryption software would cost extra. | |
This option gives you a simpler way to handle sensitive communications while keeping your current Gmail account.
Use either your free Gmail or your Google Workspace Gmail account for everyday emails that don't contain PHI, like confirming the office cleaning schedule or letting your colleagues know when you'll be on vacation. Then sign in to Hushmail's secure messaging for sensitive conversations, like responding to a prospective client, sending intake forms, or talking with third parties like insurance companies and medical billers.
This is a good option for practitioners who want to keep their existing email, as you can create a separate secure workflow for PHI. In this scenario, Gmail and Hushmail work alongside each other.
| Pros | Cons |
|---|---|
| ✅ Keep your current Gmail address | 🟡 You have to remember to sign in to Hushmail when you want to send secure communications and know which emails need that extra level of protection. |
| ✅ No email migration or domain setup required | |
| ✅ Hushmail is built for healthcare | |
| ✅ Hushmail is HIPAA-compliant | |
| ✅ Hushmail provides encryption in transit and protects messages after delivery | |
| ✅ Hushmail includes forms and templates specifically built for therapists | |
| ✅ Support from a Hushmail Customer Care team that works with healthcare practices | |
| Starting price: Hushmail's secure messaging starts at $14.99 per month. | |
If you prefer a dedicated email environment for your practice, Hushmail's secure email can replace your current email provider and become your main inbox.
Use Hushmail for all your email needs and just enable the encryption toggle whenever you need to send or request sensitive information. The recipient will receive an email with a link to a secure web page, which keeps your communication private.
| Pros | Cons |
|---|---|
| ✅ All your email communications in one spot | 🟡 You'll need to move your everyday practice email into a new inbox and get used to a different workflow. |
| ✅ Flexible option to use a @hushmail.com or name@yourpractice.com email address | |
| ✅ Allows multiple users, so works well for small practices | |
| ✅ Built for healthcare | |
| ✅ HIPAA-compliant | |
| ✅ Provides encryption in transit as well as protects emails after delivery | |
| ✅ Includes forms and templates specifically built for therapists | |
| ✅ Support from a Customer Care team that works with healthcare practices | |
| Starting price: Hushmail's secure email starts at per month for one user. Plans that include secure forms start at per month. | |
Which of the three options is right for your therapy practice? It depends on your needs. Choose…
A. Google Workspace if you want to manage all your email in Gmail and you're technically proficient or have good IT support.
B. Hushmail's secure messaging if you want to keep your Gmail account but need an easy, secure way to handle PHI.
C. Hushmail's secure email if you want a dedicated practice email solution specifically built for healthcare practitioners.
Choosing an appropriate email or messaging service is only one part of HIPAA compliance, though. You also need to think about things like risk analysis and policy documentation.
👉 Read our 6-step HIPAA compliance checklist for small healthcare practices.
But at least you can start by making sure your email setup supports HIPAA compliance. You don't necessarily have to choose between Gmail and Hushmail. The right setup depends on how you want to manage everyday email and communications involving PHI.
Explore the Hushmail options to find the one that fits your workflow.
Yes. You can keep using Gmail for everyday emails that don't contain PHI and use Hushmail's secure messaging when you need to communicate sensitive information. This gives you a separate secure workflow for PHI without requiring you to replace your existing Gmail account.
No. Hushmail's secure messaging can work alongside a free Gmail. This helps keep PHI out of your free Gmail inbox and lets you use Hushmail for sensitive communications.
Not if you choose Hushmail's secure messaging. You can keep your existing Gmail address and sign in to Hushmail when you need to handle PHI. If you choose Hushmail's secure email as your main practice inbox instead, you can use a Hushmail address or your own custom domain.
Ready to find the setup that fits your practice?
Reviewed by: Steven O. Youngman, VP of Legal and Compliance, Hushmail.