Episode 623: Now You Can Secure Outbound Email in Google Workspace

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we have an exciting update about how to make your Google Workspace email HIPAA-secure.

We discuss:

• The encryption mechanism, TLS, and how it fits into HIPAA Security Rule standards
• Ways that behavioral health practices typically manage email security
• Escrow style email
• The transmission security standard under HIPAA
• Google’s transparency report about safer email
• HIPAA-friendly conventional email vs. HIPAA secure email
• Two limitations to be aware of and a risk management and ethics perspective 
• How to set up this configuration in Google Workspace

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

PCT Resources:

• Article: A Practical Way to Secure Outbound Email in Google Workspace: What Mental Health Practices Need to Know
  • Read PCT’s complete explanation of the global routing rule, what enforced TLS changes for mental health practices, what it does and does not protect, and the steps practices should take before relying on it for email containing protected health information.
• PCT’s Free Google Workspace Configuration Help Center
  • Access PCT’s video tutorial demonstrating how to configure the global outbound routing rule, along with additional step-by-step guidance for configuring Google Workspace for HIPAA-compatible use.
• Office Hours for Solo Practitioners
  • Get direct consultation and ongoing support for applying HIPAA requirements to the particular needs of your practice—including email, client communication, technology selection, policies, and implementation.
• Group Practice Office Hours
  • Practice leaders can receive direct support with developing communication systems and workflows that are HIPAA-compatible, effective, efficient, and workable for the practice, its team, and its clients.
• Article: 3 Kinds of Email Security: How to Make an Informed and HIPAA-Aware Choice
  • Learn about PCT’s framework for distinguishing among conventional email, TLS-secured email, and escrow or portal-style secure messaging—and choosing the option that fits the information, workflow, and client circumstances involved.

Resources:

• Google Workspace Admin Help: Send Email Over a Secure TLS Connection
  • Google’s instructions for requiring TLS when sending email to specified recipients and preventing delivery when a secure connection cannot be established.
• Google Transparency Report: Email Encryption in Transit
  • View Google’s current data on the percentage of email sent and received by Gmail that is encrypted while traveling between email providers.
• HHS: Does the Security Rule Allow for Sending Electronic PHI in an Email?
  • HHS guidance explaining how the HIPAA Security Rule applies when electronic protected health information is transmitted by email.
• HHS: Does the HIPAA Privacy Rule Permit Providers to Use Email With Patients?
  • HHS guidance addressing email communication with patients, reasonable safeguards, and patients’ requests to communicate through alternative means.