Is Gmail PHIPA compliant in Canada?

No, Gmail isn’t PHIPA compliant by default. If you’re a therapist in Ontario using Gmail or Google Workspace to communicate with clients, your current setup likely has gaps that PHIPA requires you to address. This guide covers what PHIPA actually requires for email, where Gmail falls short, what you can do about it, and what limitations remain even after you make changes.

What does PHIPA require for email?

PHIPA doesn’t ban email. Section 12(1) of the Personal Health Information Protection Act requires health information custodians to take reasonable steps to ensure that personal health information (PHI) in their custody is protected against theft, loss, and unauthorized use or disclosure.

The Information and Privacy Commissioner of Ontario (IPC)‘s guidance on safeguards has consistently interpreted reasonable steps to include administrative, technical, and physical safeguards. For email, it helps to look at four safeguards:

1. Encryption. Encryption is the IPC’s preferred safeguard for email containing PHI, and it expects it between custodians. For unencrypted email to a client, it expects a written policy, notice and the client’s consent.

2. Consent. Clients must understand and agree to electronic communication before you send PHI by email. PHIPA distinguishes between implied and express consent, and for email containing PHI, express consent is the safe standard.

3. Audit trail. You need a record of what PHI was communicated, when, and to whom. This isn’t the same as Gmail’s admin audit log, which tracks login activity and admin actions, not the content of clinical communications.

4. Access controls. Only authorized individuals should be able to access PHI. For email, this means strong authentication on the account that sends and receives client communications.

These four safeguards are a useful framework for evaluating any email tool. Gmail covers some of them partially. It doesn’t cover all of them by default.

Where Gmail falls short of PHIPA requirements

Encryption

Gmail encrypts email in transit using TLS (Transport Layer Security). When you send an email from Gmail, it’s encrypted between Google’s servers and the recipient’s email provider, provided the recipient’s server also supports TLS. Most major email providers do.

The gap is that TLS is opportunistic, meaning it only works if both sides support it. If the recipient’s server doesn’t support TLS, Gmail sends the message unencrypted. Gmail shows a red lock icon when a recipient’s server doesn’t support TLS, but it doesn’t block the message from sending. There’s no way to enforce TLS for every message.

For PHI, opportunistic encryption isn’t sufficient. Not even close. PHIPA’s reasonable steps standard doesn’t name encryption, but encryption that depends on the recipient’s server is a weak answer if the IPC asks what protected a message. A therapist can’t guarantee that every client, insurance provider, or referring physician uses an email service that supports TLS.

Gmail’s Confidential Mode adds a layer of access control (expiration dates, passcodes), but it isn’t end to end encryption. Google can still access the content. The message isn’t encrypted at rest in a way that prevents Google from reading it. And while Confidential Mode lets the sender choose an expiration period (from 1 day to 5 years), the access controls it provides are not a substitute for encryption.

Data residency considerations

Your client’s intake email: where does it actually live? Google’s global infrastructure. Google operates data centres in North America, Europe, and Asia, but it publishes no per edition map of where any given message body sits, so the honest answer is that the location is not something you can pin down by default. Google Workspace’s data region settings (available on Business Standard and above, which is Google’s mid tier paid plan) let you pin covered service data at rest, including backups, to the United States or Europe. Controlling the processing region, not just data at rest, requires the Enterprise data regions tier (Enterprise Plus or an add-on).

PHIPA doesn’t mandate Canadian data residency the way some other provincial laws do. Ontario takes a risk based approach: storing data outside Canada isn’t automatically a violation, but it’s a factor you must address in your risk assessment and Privacy Impact Assessment. Cross border data transfers carry additional risks, including potential exposure to foreign government access requests (a point the federal OPC has raised in its cross border processing guidelines). PHIPA s.50(1) permits disclosure outside Ontario either with consent or on listed non-consent bases, so express consent is mandatory only where the disclosure relies on consent to a non-custodian (s.18(3)). Routing PHI through a service provider acting as your agent is not itself a disclosure.

This isn’t a binary pass or fail. It’s a consideration you must document and justify.

Audit trail

Say the IPC contacts you about a complaint. They want to know what PHI you sent to a specific client and when. Gmail’s admin tools won’t help much. The admin audit log tracks account activity (logins, settings changes, admin actions). Email Log Search shows who you emailed and when, with subject lines, but only for 30 days, and it never shows the content. It’s designed for IT administrators managing a Google Workspace domain, not for therapists responding to a privacy investigation.

It doesn’t produce a lasting send report you can hand to the IPC during a breach investigation. Email Log Search can export who you emailed and when, but only for the last 30 days.

Maintaining this record manually is possible (see our manual audit log guide), but manual processes depend on consistency over time, and consistency is difficult to sustain alongside clinical work. That inconsistency is exactly what reasonable steps is designed to address.

Consent documentation

A client agrees to email communication during your first session. Six months later, the IPC asks for proof of that consent. Gmail won’t produce it. It doesn’t track whether a client has agreed to electronic communication, what the scope of that consent covers, or when consent was obtained.

Consent is the therapist’s responsibility, separate from the email tool. Gmail won’t help you here. The absence of any consent management feature means you must build and maintain a separate consent process. In practice, many therapists handle this on paper or skip it entirely. Our client communication templates include a consent form specifically designed for electronic communication of PHI that you can adapt for your practice.

Can you make Gmail PHIPA compliant?

You can reduce the gaps, but you can’t close all of them through configuration alone. Here’s what you can do:

1. Configure your Google Workspace admin security settings. Review every security relevant setting in your admin console. This includes enforcing two-factor authentication, signing the HIPAA BAA (a US HIPAA instrument; Google’s processing agreement is the Cloud Data Processing Addendum), and configuring data region settings if your edition supports them. We wrote a setting by setting walkthrough that covers this in detail. Budget 30 to 45 minutes. You only need to do this once.

2. Disable AI features. Google Workspace includes several AI features that process the content of your email: Smart Compose, Smart Reply, Gemini summaries, and more. The IPC’s January 2026 guidance on AI scribes in healthcare covers AI scribes. For email AI features, whether you need your client’s consent depends on what the vendor does with the information: a vendor that uses it for its own purposes, such as training its models, needs consent. If you haven’t obtained that consent, these features create a compliance gap. Our guide on disabling AI features walks through every toggle.

3. Use email disclaimers. Add email disclaimers to inform clients about the limitations of email communication. A disclaimer doesn’t make email compliant, but it’s part of demonstrating reasonable steps. Include the limitations of email encryption, the possibility that messages may be stored outside Canada, and the client’s right to choose an alternative communication method.

4. Maintain a manual audit log. Until an automated solution is available, keep a manual audit log of client communications containing PHI: who you emailed, when, and the general nature of the content. Our guide includes a Google Sheets template you can set up in 30 minutes.

5. Enable Confidential Mode selectively. Gmail’s Confidential Mode adds expiration and passcode protection. The sender can choose an expiration period from 1 day to 5 years, and recipients can’t forward or download the message. But it isn’t true encryption, and Google still has access to the content. Use it as an additional layer, not a replacement for encryption.

6. Complete a Privacy Impact Assessment. The IPC recommends that health information custodians complete a PIA before implementing any new system that processes PHI. Most therapists haven’t done one. Our PIA template for Google Workspace walks through every section in about 60 to 90 minutes.

These steps reduce your risk. They don’t eliminate it. The fundamental gaps (opportunistic TLS, no communication level audit trail, no consent management, data stored outside Canada) remain even after you configure everything correctly.

What about Google Workspace’s HIPAA BAA?

Google offers a HIPAA Business Associate Amendment for Google Workspace. This is a contractual commitment under HIPAA, the US health privacy law. Signing it is worth doing because it commits Google to specific data handling obligations, but it doesn’t make Google Workspace PHIPA compliant.

Three things the BAA doesn’t address:

1. Canadian privacy law. The BAA is a HIPAA instrument. HIPAA is a US federal law. PHIPA is an Ontario provincial law. They have different requirements, different enforcement mechanisms, and different definitions of key terms. Signing a HIPAA BAA doesn’t satisfy PHIPA obligations.

2. Data residency. The BAA doesn’t require Google to store your data in Canada. Data region settings in Google Workspace are a separate configuration, and they offer only the United States or Europe, never Canada.

3. Audit trail requirements. The BAA doesn’t add a communication level audit trail for email. It commits Google to making certain logs available, but those logs are admin level, not clinical communication level.

HIPAA compliance and PHIPA compliance aren’t interchangeable. They’re different laws with different requirements, and a product that meets one doesn’t automatically meet the other.

What other provinces require

PHIPA applies in Ontario. If you see clients in other provinces or are considering expanding your practice, the requirements change.

Alberta PIPA governs private practice therapists in Alberta: s.34 reasonable security arrangements, s.34.1 notice of a breach, s.8 consent. Alberta’s Health Information Act (HIA) reaches you only as an affiliate inside a custodian organization, where the custodian must prepare a PIA and submit it to the Office of the Information and Privacy Commissioner of Alberta (OIPC) before implementing a new information system (HIA s.64(1)). Read our full guide to Alberta email requirements for therapists.

British Columbia’s Personal Information Protection Act (PIPA) takes a different approach to cross border data transfers. PIPA does not mandate Canadian data storage for private sector organizations, and cross border transfers are allowed. FOIPPA, BC’s public sector law, no longer mandates Canadian storage either: the former s.30.1 requirement was repealed in 2021 (SBC 2021 c.39 s.17), and public bodies may now disclose outside Canada under FOIPPA s.33.1 and its regulations. PIPA itself contains no blanket residency requirement.

BC PIPA does not require you to tell clients when their personal information gets sent outside Canada for processing. That out of Canada notice duty sits in Alberta PIPA s.13.1(2), not BC’s law. What BC PIPA does require is that you make reasonable security arrangements to protect the information (s.34), and the OIPC BC recommends being transparent about foreign storage as guidance. Most therapists using Gmail end up going with Canadian hosting anyway, since the documentation and safeguard burden of cross border transfers isn’t worth the hassle. Our PIPA guide for therapists (planned) will cover BC specific requirements in detail.

For a complete walkthrough of what PHIPA requires for email, see our PHIPA email requirements guide. For a full comparison of how PHIPA, Alberta PIPA and BC PIPA apply to therapist email, see our cross provincial overview.

Frequently asked questions

Is Gmail PHIPA compliant?

No. No email product is, on its own. Gmail provides TLS encryption in transit, but on its own it leaves gaps against PHIPA s.12(1) and your college’s standards: encryption that depends on the recipient’s server, no lasting record of each send, no consent tracking, and content stored outside Canada. You can reduce the gaps through configuration (admin security settings, disabling AI features, maintaining a manual audit log), but you can’t eliminate them entirely within Gmail’s native capabilities.

Can I use Gmail as a therapist in Canada?

Yes, but with additional safeguards. You’ll want to configure your Google Workspace admin settings correctly, sign the HIPAA BAA, disable AI features that process email content, and maintain a manual audit log. The IPC also recommends a Privacy Impact Assessment, though PHIPA doesn’t require one. Even with these steps, gaps remain. The IPC has not issued a blanket prohibition on Gmail for health information custodians, but the burden is on the custodian to demonstrate that their safeguards are reasonable.

What encryption does PHIPA require for email?

PHIPA s.12(1) requires reasonable steps to protect PHI, which the IPC has interpreted to include encryption as a technical safeguard. For email, reasonable steps means more than relying on Gmail’s default TLS, because TLS is opportunistic and depends on the recipient’s email provider supporting it. The IPC hasn’t published an encryption standard for email. Its fact sheet expects encryption between custodians and, for unencrypted email to a client, a written policy, notice and consent.

Does Google have a PHIPA compliance agreement?

No. Google offers a HIPAA Business Associate Amendment for US health privacy law. There’s no equivalent agreement for PHIPA. The HIPAA BAA is worth signing because it commits Google to specific data handling obligations, but it doesn’t satisfy Ontario’s PHIPA requirements. It’s a US legal instrument designed for US health privacy law.

What to do next

If you haven’t locked down the rest of your admin console, start with the full security settings guide. Then work through the AI features guide. Between those two guides and this post, you’ll have covered the most important configuration steps for a Canadian therapy practice on Google Workspace.

The gaps that remain after configuration: reliable encryption, automated audit trail, consent management. On a Business edition, no admin console setting closes them.

Tools like Curio aim to address the encryption and audit trail gaps by adding automatic encryption and a Canadian audit trail to your existing Gmail workflow. Consent management remains a gap you’ll need to solve through your own intake process. Other approaches include switching to a provider with built in encryption — like Hushmail or ProtonMail (see our Hushmail vs Gmail comparison for a detailed breakdown written for Canadian therapists) — or adding a third party encryption layer to your current setup. The right choice depends on your practice size, technical comfort, and which gaps matter most for your situation.

---

This content is for informational purposes only and does not constitute legal advice. Privacy regulations vary by province and are subject to change. Verify current requirements with your provincial regulatory body.