Compare

Google Workspace with a BAA, and what is still missing.

Google will sign a BAA on Business Starter and above. That makes Google a business associate. It does not change what happens to a message once you hit send. Here is the honest comparison, line by line.

Requirement	Google Workspace + BAA	+ PXCMail Gateway
Business Associate Agreement	Yes (Starter and up)	Yes, covering the encryption layer too
Encryption in transit	Opportunistic TLS; falls back to plain text	TLS required; encrypted delivery when the recipient can’t
Encrypted delivery to any patient	Client-side encryption only on Enterprise Plus, recipients need setup	One-time code on any phone; no account
PHI detection before sending	DLP on Business Standard+ with manual rule building	Healthcare templates out of the box
Audit trail of encryption outcome per message	No	Yes, exportable
Archive independent of mailboxes	Vault on Business Plus+ ($22)	Included; 6-year immutable on add-on
Annual compliance letter	No	Yes
Support from someone who knows HIPAA	General support	Yes, 15-minute response
Cost for 10 seats (yearly)	$84/mo (Starter) – $220/mo (Plus)	Starter $84 + Gateway $60 = $144/mo

Google prices are list prices as of October 2026 and change; check Google’s site. “Plus” includes Vault but still not enforced encryption or per-message audit.

When Google alone is enough

If every patient and partner you email is on Gmail or Microsoft 365, your staff never type identifiers into email, and nobody will ever ask you for a per-message record — then a BAA and good habits may be enough. Most practices cannot promise all three.

Keep Google. Add the layer.

Gateway takes 15 minutes to connect and changes nothing for staff. Setup guide →

What Google’s BAA covers

Google will sign a Business Associate Agreement for Workspace customers and lists the services it covers on its HIPAA compliance page. Signing it makes Google your business associate for PHI stored and processed in those services. That is necessary and it is the right first step. It does not change what happens to a message after you hit send: Gmail still uses opportunistic TLS, which falls back to plain text if the receiving server does not offer encryption; it does not notice that the message contains a patient name beside an insurance ID; it keeps no record of whether that message was encrypted in transit; and nobody at Google will write your auditor a letter. Google’s own page tells you to configure the services appropriately. The configuring is yours.

What Gateway adds

TLS required on every outbound message, and encrypted delivery with a one-time code when the recipient’s server cannot do TLS. S/MIME automatic when the recipient publishes a certificate.
Detection packs for healthcare: identifiers, insurance IDs, ICD-10 and CPT codes, attachment scanning; five actions (deliver, encrypt, warn, hold, block); test mode before enforcement.
A per-message audit record: sender, recipient, policy decision and reason, encryption method, opens. Exportable.
An archive of 100% of mail for one year on every plan, immutable, independent of the mailbox; six years for $3 more per seat.
Paper. Our BAA covering the encryption layer, a quarterly compliance report, an annual safeguards letter and evidence packs mapped to regulator questions.
Someone who knows HIPAA email on chat within 15 minutes, and DNS done on a call.

A week at Lakeside Family Dental

Lakeside is a 12-person dental office on Google Workspace Business Starter with a signed Google BAA and Dentrix. Before Gateway, a treatment plan from frontdesk@ to a patient on a small ISP mailbox went out over whatever that ISP offered, and nobody knew which. After Gateway: Monday’s treatment plan is encrypted because detection found a name beside an insurance ID, and the patient opens it with a one-time code. Tuesday’s referral to an oral surgeon goes S/MIME because the surgeon publishes a certificate. Wednesday’s pre-authorization to a payer goes over TLS and is logged as delivered that way. Thursday a new hire tries to send a balance spreadsheet to her own Gmail; the policy holds it and the office manager sees why. Friday the office manager pulls the audit export for the insurance renewal. Dentrix changed nothing, because it already sends through the office’s Google account.

Cost for a 10-person practice

Option	Per month, 10 seats, billed yearly	What you have for HIPAA email
Business Starter + Google BAA	~$84	BAA, opportunistic TLS, 30 GB
Business Starter + Gateway	~$84 + $60 = ~$144	Above + enforced TLS, encrypted delivery, detection, 1-year archive, audit trail, our BAA
Business Starter + Gateway with 6-year archive	~$84 + $90 = ~$174	Above, with 6-year immutable retention
Business Plus (Vault)	~$220	BAA, Vault retention and eDiscovery, DLP you build; still opportunistic TLS and no per-message record

Google prices are list as of October 2026 and change. The $49 minimum per organization equals eight Gateway seats, so it does not change the math at 10.

Vault versus the PXCMail archive

Vault is Google’s retention and eDiscovery tool, available on Business Plus and above. It holds what is in Gmail, Drive and Chat according to rules you write, and it is good at that. It is not a record of what happened to each message in transit, and it retains what the rules say, not everything by default. The PXCMail archive journals 100% of mail into immutable storage (S3 Object Lock), applies a retention profile (healthcare six years), supports legal hold by person, matter or date range on Pro, and exports in EML, MBOX or PST with a sha256 manifest and a chain-of-custody statement. It covers email only. If you need Drive and Chat retention, you need Vault; if you need an email record an auditor can trust, you need an archive with a per-message audit trail beside it.

By the numbers

HHS treats encrypted PHI as secured; its loss does not trigger breach notification (HHS guidance on unsecured PHI). Opportunistic TLS cannot prove a message was encrypted.
The Security Rule’s technical safeguards, including transmission security, are at 45 CFR 164.312; documentation must be kept six years under 164.316.
NetDiligence: 98% of cyber claims in its 2025 study came from small and mid-sized businesses (NetDiligence 2025).

What the auditor or carrier asks

“Is PHI encrypted in transit to every recipient?”: With Google alone: TLS when the other side offers it. With Gateway: TLS required, encrypted delivery otherwise, and a record per message.
“How do you stop PHI going to the wrong place?”: With Google alone: training, or DLP rules you write on Business Standard and above. With Gateway: healthcare detection packs and the hold or warn action, in test mode first.
“Show me the last quarter.”: With Gateway: the quarterly compliance report and the audit export. With Google alone: the admin audit log, which does not record encryption outcome.
“Who is your business associate for email?”: Google, under its BAA, for the mailbox; PacinfraX, under ours, for the encryption layer and archive. Both signed, both on file.

Steps to add Gateway

Start the trial and sign our BAA electronically; nothing is charged for 14 days.
Add the outbound relay route in Google Admin and the three DNS records; the wizard re-checks every five minutes. Setup guide
Run the Healthcare pack in test mode for a day or a week and read the log.
Switch to enforce. Staff keep using Gmail.

Questions practices ask

Does Gateway replace Google’s BAA?

No. Keep Google’s BAA for the mailbox. Ours covers what we do: the encryption layer, the archive and support access. Our BAA

Will staff have to change how they work?

No. Gmail, phones and Dentrix stay as they are. Detection decides; [SECURE] in a subject forces encryption. A Gmail add-in is ROADMAP.

Can I do this with Google DLP and Vault instead?

Partly. Business Standard DLP rules can warn or block on patterns you write; Vault on Business Plus retains mail. Neither enforces TLS or records the encryption outcome per message, and Business Plus is ~$220 a month for 10 seats against ~$144 for Starter plus Gateway. Why a Gmail BAA is not enough

What if PXCMail is down?

Google queues outbound mail and retries; nothing is lost. We run in AWS us-east-1 with us-west-2 for disaster recovery and publish a 99.9% SLA. Status

Does Gateway see internal mail between staff?

No. Internal mail stays inside Google. Gateway handles mail leaving your domain.

Add Gateway to Google for $6 a seat.

Start free trial

Also compare: Microsoft 365 alone vs. Microsoft 365 + PXCMail · Hushmail · Paubox.