A BAA from Google isn’t a control

Every week a practice owner tells us the same thing: “We’re fine, we signed the BAA with Google.” You do need it. A BAA assigns responsibility, as 45 CFR 164.308(b) requires; it does not change what happens to a message.

What the BAA does

It makes Google a business associate: Google commits to safeguard the PHI in your account, to report breaches on its side, and to support your obligations. It covers Gmail, Drive, Calendar and the other core services listed in Google’s HIPAA documentation. Without it, storing PHI in Gmail is a violation on its own.

What it doesn’t do

1. It doesn’t encrypt a message to a server that can’t do TLS. Gmail uses opportunistic TLS: it encrypts when the other side agrees and sends in plain text when it doesn’t. You won’t be told which one happened, and the transmission security standard at 45 CFR 164.312(e) asks what you did to protect the message, not what usually happens.
2. It doesn’t stop a staff member from emailing a social security number. Google offers DLP rules on some of its tiers, but you have to build the rules, and nobody at a 12-person practice does.
3. It doesn’t give you a record. When a patient asks who saw their information, or an auditor asks for every message about a patient, an inbox is not an archive and a search is not the audit trail that 164.312(b) describes.
4. It doesn’t make the patient’s side safe. A message sent in plain text to an old ISP mailbox is readable by whoever runs that mailbox. HHS’s guidance on unsecured PHI is clear that only encrypted PHI is outside the breach notification rules.

The four things you still need

• Enforced TLS with an encrypted fallback.
• PHI detection that acts before delivery.
• An archive and per-message audit trail you can export.
• A policy, written down, that says when staff must use the secure path, and evidence that they do.

You don’t have to leave Google

This is the part people expect to be a sales pitch, so we’ll keep it short: all four can be added to the Gmail account you already have. That is what Gateway is. It is also, roughly, what Google would sell you on its higher tiers, with an admin to configure it.

The full comparison, line by line →

Sources

• 45 CFR 164.308, Administrative safeguards, (b) — requires a covered entity to obtain satisfactory assurances from each business associate through a written contract, which is what a BAA is.
• 45 CFR 164.312, Technical safeguards, (b) and (e) — requires audit controls and transmission security for ePHI sent over electronic networks.
• HHS, Guidance on securing PHI (unsecured PHI and encryption) — defines when PHI is “secured” and therefore outside breach notification.
• Google Workspace, HIPAA compliance with Google Workspace — states which Google services the BAA covers and what the customer remains responsible for.