Small practices do not fail HIPAA email because they lack an enterprise security team. They fail because PHI still lives in personal Gmail tabs, forwarded threads, and printers next to the front desk.
What "compliant email" means in a clinic
Encryption in transit is the starting point, not the finish line. A covered entity also needs a signed Business Associate Agreement with the vendor, unique staff accounts, a way to turn access off when someone leaves, and logs you can produce if a patient or an investigator asks who saw a message.
HIPAA Companion is built for that checklist. Healthcare email security sits next to secure fax and personalized forms under one BAA, so the privacy officer is not chasing three vendor packets every year.
A workable rollout for a five-to-twenty person office
- Move PHI off consumer accounts first. Keep personal mail for lunch orders, not labs.
- Give each user a named inbox on your practice domain so messages look like they come from you.
- Turn on archiving before the first production referral is sent.
- Train the front desk on one rule: if it identifies a patient and their care, it goes through the HIPAA channel.
If your team still needs Gmail for operations, keep it. Just stop using it as the documented channel for protected health information. See our related guide on sending PHI from Gmail only after a BAA and a real workflow are in place.