u/the_devils_music

Trying to determine an appropriate course of action for HIPAA compliance with Google Workspace that does not require using a third party outbound email gateway (paubox, luxsci, etc). We have a very small health-related private practice. I've read a lot of people discussing how because Google's Confidential Mode is not E2EE, it is not HIPAA compliant, but I wanted to explore this further with some support from this community.

I'm wondering if Confidential Mode does solve our problem of requiring HIPAA compliant email when sending ePHI. HIPAA rules do not require E2EE, just ePHI encrypted in transit and at rest.

PROBLEM: Google can downgrade email sent with TLS to 1.0 and 1.1, and there is no way in the admin to force blocking sending of these emails. If it was possible in Google Workspace settings to force sending emails only via TLS 1.2 and 1.3 and stop send of emails unencrypted or through TLS 1.0 and 1.1 (to meet NIST standards), we would accept this as a free alternative to, say, a Paubox setup, which is considered compliant. Consider that we are fine with not sending emails to certain recipients (ie. those without modern TLS) if they do not have the technology necessary to receive the emails, as we never send emails to clients for communication.

However, this doesn't exists.

POTENTIAL SOLUTION: So this begs the question of if Confidential Mode allows for this...

If our Google Workspace has a BAA, and Confidential Mode strips the possibility of ePHI being sent via unencrypted transit to non-Google services (due to the email, even if sent unencrypted, maintaining no ePHI and being replaced with a link to view) does that not solve the HIPAA concerns related to ePHI being sent through deprecated encryption channels? I am wondering if this no different than a link to a secure portal, which is used by nearly all EHRs.This is assuming that Google is storing and transmitting the content of the confidential mode message encrypted.

All thoughts are appreciated.