How to encrypt Gmail for your therapy practice
You send a session summary to a client, and a second later it’s sitting in their inbox. Did it cross the internet encrypted?
Gmail knows, and it’ll show you if you know where to look. Your Google Admin console can go further. For the people you email most, it can make the answer yes or nothing: the message travels encrypted, or it doesn’t travel at all.
That second outcome is a real cost, and it’s worth understanding before you change a setting.
This is how to encrypt Gmail for your therapy practice, in five steps, in the order you’d do them. Each step says what it protects and where it stops, and we read every Google page cited here on October 4, 2026, so the setting names match what Google published that day. The guide assumes you’re keeping Gmail. If you’re still weighing that, read is Gmail PHIPA compliant on its own?
What encrypting Gmail means for your practice
Two different things get called Gmail encryption, and Google offers both.
The first protects the connection. When your message leaves Gmail for your client’s mail provider, the two servers can carry it over TLS, so it’s encrypted on the way between them. Google’s help page on TLS is plain about the default: “By default, Gmail always tries to send messages over a secure TLS connection.” Both servers have to use TLS for that to work. If the receiving server doesn’t, “Gmail still sends messages but the connection isn’t secure.”
Google labels this standard encryption and shows it as a gray lock. It’s available on every Gmail account, personal or work.
The second protects the message itself. Hosted S/MIME and what Google calls “client-side encryption” (CSE) are message level options, labelled enhanced encryption (a green lock) and additional encryption (a blue shield). S/MIME needs keys from the people you write to, and CSE needs a key service outside Google. That’s why they get their own step below.
Why does any of this matter legally? None of the four privacy laws below lists encryption as a requirement. Each sets a safeguards duty in its own words. The Personal Health Information Protection Act (PHIPA s.12(1)) asks Ontario custodians for “steps that are reasonable in the circumstances”. Alberta’s and BC’s Personal Information Protection Acts each ask for “reasonable security arrangements” at s.34. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) is the only one of the four that measures safeguards against the sensitivity of the information (Principle 7), and its Schedule 1 clause 4.7.3(c) names encryption as an example. The College of Registered Psychotherapists of Ontario (CRPO) names encrypted electronic transmission as an example in the commentary to Standard 5.6. The regulators’ guidance goes further. Ontario’s privacy commissioner, in its fact sheet on emailing health information, says you should encrypt email with clients where you can, and that before you use unencrypted email you must tell clients about your written email policy and get their consent. The federal privacy commissioner’s safeguards bulletin says organizations sending sensitive personal information over the internet must use sufficient safeguards, such as encryption. For client email, encryption is how you meet those duties in practice. For Ontario in depth, see what PHIPA asks of your email.
None of that tells you which settings to change. The steps do.
Step 1: Open your Google Admin console
The controls that change how Gmail encrypts mail live in the Google Admin console, and the Admin console comes with Google Workspace. A personal Gmail account doesn’t have one.
So if you’re on a personal Gmail address, step 2 still works for you today. Steps 3 and 4 need Workspace, and so does the record check at the end of step 5 (the Message security check in that step works on any Gmail account). If you’re setting Workspace up for the first time, the full Google Workspace setup for therapists covers the account settings this guide leaves out.
Sign in with an administrator account. For the setting in step 3, Google says you need the Gmail Settings administrator privilege. Did someone else set up your Workspace account? Ask them to confirm your admin role includes it before you start.
Step 2: Check how Gmail encrypts mail in transit
Before you change anything, find out what’s already happening. This part needs no admin access.
On a computer or an Android phone, start a new message to someone you email often, then select Message security. Google uses four indicators to show what a message gets:
| What you see | What Google says it means |
|---|---|
| Gray lock | Standard encryption (TLS) |
| Green lock | Enhanced encryption (hosted S/MIME) |
| Blue shield | Additional encryption (CSE) |
| Red open lock | The message is unencrypted |
For a message someone sends you, open the recipient details to see the same thing.
Run the check on the addresses that matter most. A group practice you refer to. An employee assistance program contact. A few of the clients you write to every week.
A gray lock is what you want. A red open lock is the address to decide about in step 3.
Step 3: Require an encrypted connection for the people you email most
This setting turns Gmail’s attempt into a requirement, for the addresses you choose. Google calls it Secure transport (TLS) compliance.
In the Google Admin console, go to Menu > Apps > Google Workspace > Gmail > Compliance. Point to Secure transport (TLS) compliance and click Configure. Inside, you choose:
- Whether it covers inbound mail, outbound mail or both
- The domains or email addresses it applies to
- Require CA signed certificate and Validate certificate hostname, which Google marks as recommended
- An optional Test TLS connection check
Changes can take up to 24 hours, though Google says they typically happen more quickly. So don’t test the same afternoon.
Which addresses to put on the list
The setting applies only to the domains and addresses you list. Everyone else keeps Gmail’s default from step 2.
Start with the organizations you write to often about clients: a clinic you refer to, an employee assistance program, a physician’s office that sends you referrals. For those, a whole domain usually makes sense (every address at the clinic, say). Then add individual clients who’ve agreed to email.
For a client, list their own address rather than their email provider’s whole domain. That way the rule covers exactly the person you mean and nobody else on that provider.
What happens when a listed server doesn’t use TLS
Here’s the part to think through before you add anyone.
For outgoing mail, Google’s help page says a message to a listed address isn’t delivered if the receiving server doesn’t use TLS. It bounces, and you get a report that it wasn’t delivered. Gmail makes only one attempt.
Incoming mail is the one to be careful with. If you require TLS inbound and a client writes to you from a server that doesn’t use it, Google rejects the message. You aren’t notified. The client gets the report instead.
Read that last line again with your caseload in mind. A client could reach out and never reach you, and nothing on your side would show it. Think hard before you require inbound TLS for client addresses.
Put the two outcomes side by side:
| Address on your list | Address not on your list | |
|---|---|---|
| Receiving server uses TLS | Sent over TLS | Sent over TLS |
| Receiving server doesn’t use TLS | Bounces after one attempt, and you get a report | Sent anyway, over a connection that isn’t secure |
So every address you add is a choice about which failure you’d rather have.
Off the list, the risk is plain text. On the list, the risk is a message that never arrives, and you’re the one who has to notice. Decide now what you’ll do when a bounce report lands. A phone call, or a word at the start of the next session, closes the gap; what matters is that the report doesn’t sit unread under a day’s worth of other mail.
Step 4: Decide whether you need message level encryption
TLS covers the trip between mail servers. Message level encryption covers the message itself, and this is where Google Workspace email encryption gets edition specific. Google offers two kinds. Both come with limits you’ll want to see before you plan around either one.
| Option | Google’s indicator | Editions Google lists |
|---|---|---|
| Hosted S/MIME | Green lock, enhanced encryption | Frontline Plus; Enterprise Plus; Education Fundamentals, Education Standard and Education Plus |
| CSE | Blue shield, additional encryption | Frontline Plus; Enterprise Plus; Education Standard and Education Plus |
If your plan isn’t named in that table, Google doesn’t list the feature as supported for it. Check your edition first.
Hosted S/MIME
On a supported edition, an admin turns it on at Menu > Apps > Google Workspace > Gmail > User settings, with the option “Enable S/MIME encryption for sending and receiving emails”.
Then comes the part that matters for a therapy practice. S/MIME only works once you and each recipient have exchanged keys. Google’s instruction is to send a signed message, or ask the recipient to send you one. And Google’s Gmail help page lists S/MIME as available for work or school Gmail accounts, so a client writing from a personal Gmail address isn’t on that list.
What happens when Gmail can’t get a recipient’s key? Google says the message is rejected or sent unencrypted, based on the rules you set, and one optional rule is “Bounce message if unable to encrypt”. It’s the same choice as step 3, one layer up.
CSE
With CSE, the keys are managed by an external key service. That means a service outside Google to arrange as well, on top of a supported edition.
So do you need it?
Probably not for clients. This step is a decision more than a setting. If you exchange email with a clinic or agency that already uses S/MIME, and your plan supports it, it may be worth setting up for them. For clients writing from personal accounts, step 3 is where your effort lands.
Step 5: Send a test and check it worked
Give the change from step 3 time to take effect. Google allows up to 24 hours.
Then compose a message to an address on your list, ideally a colleague who won’t mind a test (a peer at a referral clinic works; leave clients out of it). Select Message security and look for the gray lock, which Google labels standard encryption. Send it.
You may also notice a padlock next to the recipient’s address as you type. Google says that padlock means the message will be sent with TLS, but it only shows for accounts on a Workspace subscription that supports S/MIME encryption. On other plans, a missing padlock isn’t a warning. Go by Message security.
Now check the record. As the admin, look the message up in Email Log Search. Each delivery step shows whether the message was Sent with TLS; Delivered normally, or marked as spam; or Quarantined. You can export the results to Google Sheets or a .csv file.
Keep the record before it ages out
Email Log Search is a real per send record. It’s also short lived. Google’s troubleshooting page says that if a message was received more than 30 days ago, its delivery logs won’t be available.
If you want to be able to show what went out over TLS months from now, export the results every few weeks and file them with your practice records. Put it in your calendar. Thirty days goes quickly.
Where the manual setup stops
Do all five steps and you’ve done real work. Gmail tries TLS with everyone, requires it for the people on your list, and Google keeps a per send record you can check and export.
Three gaps are left, and they’re specific.
The list is yours to keep. Every new client who agrees to email is an address to add (and every client who leaves is one to remove), and every change can take up to 24 hours. Anyone off the list gets Gmail’s default, which means plain text whenever their server doesn’t use TLS. Anyone on it gets encryption or a bounce.
The record is Google’s, and it’s short. Email Log Search tells you a delivery step was Sent with TLS for 30 days. After that, you’re left with whatever you exported.
Nothing in these settings knows about consent. The TLS setting is a list of domains and addresses. If a client withdraws consent to email, none of the settings in this guide reacts to it. The settings have nowhere to record it.
You might be tempted by Gmail’s confidential mode at this point. It isn’t a substitute for any step above. Google’s own help page says recipients “can still take screenshots or photos of your emails”, and that recipients with malicious programs may still be able to copy or download your messages.
Encryption isn’t the whole Workspace picture either. The Google Workspace AI settings to turn off are a separate job. And if you’d rather not run any of this by hand, PHIPA compliant email options for therapists lays out the alternatives.
How Curio handles it
Curio is one of those alternatives, and it works with the Gmail you already use.
Setup happens once. You add the DNS records Curio lists with your domain provider, and once they verify, you route Gmail’s outbound mail to Curio in your Google Admin console. From then on, Curio’s gateway in Montreal checks each send before it goes out.
Every send is encrypted and logged in a Canadian audit trail, stored in Montreal, and Amazon SES delivers the message, handing it over only on an encrypted connection. Your client gets an ordinary email when their mail server accepts an encrypted connection. When it doesn’t, the message waits for them on an encrypted portal.
That’s the difference from step 3. Every send is held to TLS, not only the addresses you list, and when a client’s mail server can’t do TLS, the message waits for them on the encrypted portal instead of going out in plain text.
If a client’s consent directive has been withdrawn, the send is denied, not downgraded. It doesn’t go out some lesser way instead.
Two limits, stated plainly. What’s stored in Canada is the audit trail and the encrypted portal messages; the copy in your Gmail Sent folder stays with Google. And Curio enforces a withdrawal. It doesn’t collect or manage consent, so getting consent stays with you, the same as the rest of the duty. Curio keeps the record that the safeguard was running.
Questions therapists ask
Does Gmail encrypt emails automatically?
In transit, when it can. Google says Gmail always tries to send messages over a secure TLS connection. If the receiving server doesn’t use TLS, Gmail still sends the message, but the connection isn’t secure. To see which one a message gets, select Message security while you compose. A red open lock means unencrypted.
Can I encrypt Gmail on a personal account?
Partly. The Message security check works on every Gmail account. The settings in steps 3 and 4 live in the Google Admin console, which comes with Google Workspace, and a personal Gmail account doesn’t have one. Google also lists S/MIME as available for work or school accounts. To use those controls, you’d move to Workspace.
What happens if I require TLS and a client’s server doesn’t support it?
Outgoing mail to that address isn’t delivered. Google says Gmail makes only one attempt, then the message bounces and you get a report. If you also required TLS for incoming mail, the client’s message to you is rejected, you aren’t notified, and the client gets the report instead.
Is Gmail’s confidential mode enough for client email?
No. It isn’t a substitute for any of the steps in this guide. Google’s help page says recipients can still take screenshots or photos of your emails, and recipients with malicious programs may still be able to copy or download them. Use the TLS setting, and message level encryption where your edition and recipients support it.
How long can I show that an email went out over TLS?
Email Log Search shows, for each delivery step, whether a message was Sent with TLS. Google says delivery logs won’t be available for a message received more than 30 days ago. If you want a longer record, export the results to Google Sheets or a .csv file every few weeks and keep them with your practice records.
Do Canadian privacy laws require S/MIME?
No law this guide covers asks for S/MIME or any other particular kind of encryption, and none lists encryption as a requirement in its text. PHIPA, Alberta PIPA, BC PIPA and PIPEDA each set a safeguards duty in their own words, and encryption is the practical way to meet it for email. Ontario’s privacy commissioner, for one, says you should encrypt email with clients where you can. Whether S/MIME is worth it depends on your edition and on who you email.
Want this handled on every send? Curio encrypts every client email you send from Gmail and logs each send in a Canadian audit trail. Your client gets an ordinary email when their mail server accepts an encrypted connection. When it doesn’t, the message waits for them on an encrypted portal. Start now for $15 CAD a month per therapist, in every province and territory except Quebec.
This content is for informational purposes only and does not constitute legal advice. Privacy regulations vary by province and are subject to change. Verify current requirements with your provincial regulatory body.
Curio holds every client email to Canadian mental health privacy law and keeps the record that it did. It is not a substitute for professional legal or compliance advice. Consult a qualified privacy professional for your specific situation.
Google’s setting names, editions, paths and indicators in this guide were checked against Google’s help pages on October 4, 2026. Google renames settings from time to time, so match each label to what your own Admin console shows.
Now available
Your Gmail. Secure for Canadian mental health privacy law.
