How does Gmail encrypt email in transit?
Gmail uses TLS to encrypt messages as they travel between Google's servers and the receiving mail server, as long as that server supports TLS. Most large mail providers do. If the receiving server does not, the message can still be delivered, but without that protection along the way.
Administrators can close that gap for important partners. In the Gmail compliance settings, you can require a secure TLS connection for mail sent to specific domains. Mail to those domains is then delivered only over TLS, and is not delivered if a secure connection is not available. This is useful for a hospital, a lab, or a law firm you exchange sensitive mail with often.
For how email fits with your other settings, see our Google Workspace security and HIPAA guide.
How does Google protect stored email?
Google encrypts stored Gmail data at rest in its data centers. That protects your mail if storage hardware is lost or stolen.
Encryption at rest does not protect against someone who signs in to the account. If an attacker has a user's password, Gmail shows them the mail just as it would the user. That is why enforcing 2-Step Verification matters as much as encryption.
Is Gmail end-to-end encrypted?
Standard Gmail is not end-to-end encrypted. End-to-end encryption means only the sender and recipient can read a message, and no server in between can. Gmail's TLS and encryption at rest protect mail on the network and on disk, but Google's systems process the content to deliver it and filter spam.
Some higher Google Workspace editions offer stronger options, such as S/MIME and client-side encryption. Check which features your edition includes before you plan around them.
Gmail also has confidential mode. It lets you set an expiration date, revoke access, require a passcode, and stop recipients from forwarding, copying, printing, or downloading a message. Confidential mode is not end-to-end encryption, and recipients can still take screenshots or photos of the message.
Is Gmail encrypted enough for HIPAA?
Whether Gmail's encryption is enough for protected health information depends on your risk analysis and how you send it. There is no single answer that fits every organization, and compliance depends on how you configure and use the account. Confirm your approach with your compliance officer or counsel.
Common approaches include:
- Requiring TLS for mail to the partners you exchange PHI with most
- Using a separate encrypted email service that signs its own BAA with you
- Sending patients to a portal instead of putting PHI in email
- Sharing a link to a restricted Drive file instead of attaching the document
Start with Is Google Workspace HIPAA compliant?, and make sure your team has accepted the Google Workspace BAA before any PHI goes through Gmail.
How can you make your email more secure?
You make email more secure by combining encryption with authentication, access controls, and good habits.
- Publish SPF, DKIM, and DMARC records so attackers cannot easily spoof your domain
- Enforce 2-Step Verification for every account
- Require TLS for the partners you exchange sensitive mail with
- Turn on the warning Gmail shows when a user writes to external recipients
- Train staff to check recipients before sending anything sensitive
Next step
If you want help configuring Gmail for sensitive mail, our HIPAA setup service covers these settings, or you can contact us.
Frequently asked questions
Is email between two Google Workspace accounts encrypted?
Mail between two Google accounts stays within Google's systems, where Google encrypts data in transit and at rest. It is still not end-to-end encrypted, so strong sign-in protection on both sides, including 2-Step Verification, remains important.
Can Google read our Gmail?
Google's systems process your mail to deliver it, filter spam, and run features you turn on. Google states that it does not use Google Workspace customer data for advertising. Review Google's Workspace privacy and data processing terms for the details that apply to your account.
