Email · Google Workspace
Google Workspace for practice email: the BAA and access checks
A professional email address does not tell you who can read the inbox. Check your Workspace agreement, staff access, forwarding, and account ownership.
Who can still read the practice inbox?
When the practice was small, sharing a mailbox felt practical. Now several people know the password, messages forward elsewhere, and someone who left months ago may still have access.
Buying Google Workspace does not fix that by itself. You need to know who owns the account, how staff get access, and where messages go after they arrive.
Set up the practice’s access before moving its messages.
Use an organization-managed Workspace account with a named administrator and recovery access the practice controls. Give staff individual sign-ins and appropriate shared-mail access for their roles.
For intended use involving protected health information, confirm the applicable agreement and included services before transferring it. Google publishes BAA acceptance instructions and covered functionality. Those are starting points for configuring the account.
The email address does not tell you where messages end up.
An address at your practice’s domain looks professional, but may forward to a personal inbox. Review forwarding rules, connected apps, shared access, and devices.
Decide who approves new access and removes it when staff leave. That routine matters long after the migration is finished.
Old mail and new delivery are two separate jobs.
Copying messages into Workspace does not redirect tomorrow’s email. The domain’s mail-routing records determine where new messages arrive. Prepare accounts, verify the supported transfer, and test delivery when those records change.
Include aliases, calendars, contacts, and shared resources. Staff should find what they need before the old service closes. The separate GoDaddy guide explains how to identify that starting system.
Your next steps
- 1
Check what you have
List mailboxes, aliases, shared addresses, calendars, contacts, forwarding, and the domain administrator.
- 2
Prepare Workspace
Verify the domain, create accounts, review the agreement, and configure access and security policies.
- 3
Move and compare
Select the migration method for the current provider. Check old mail and separately plan calendars, contacts, and shared resources.
- 4
Change delivery last
Update the domain’s mail-routing records, test incoming and outgoing messages, and check that mail received during the transition reached the new inbox.
What must work before the old mailbox closes?
| Check | Evidence |
|---|---|
| Incoming mail | Message from an external test account arrives |
| Outgoing mail | External recipient receives the reply |
| Old messages | Sample messages from the same folders and dates match |
| Aliases and shared addresses | Each reaches the correct staff |
| Staff access | Approved accounts work; unnecessary access removed |
Use non-patient test messages. Keep source access until the transfer and any retention requirements are resolved.
Before you decide
What is a mail-routing record?
Think of an MX record as the delivery directions for email sent to your practice’s domain. Changing it tells other mail systems where new messages should arrive. It does not copy the messages already in the old mailbox, which is why moving old mail and switching delivery are separate steps.
Other records, called SPF, DKIM, and DMARC, help recipients assess legitimate senders. We plan those changes using the current provider instructions and test delivery in both directions before the old service is retired.
Which Google products are included?
Google publishes a list of Workspace functionality included under its applicable HIPAA agreement. That is the place to check the specific tools you plan to use, alongside the agreement accepted for the practice’s account.
Connected apps introduce another question: a tool does not inherit Google’s coverage just by accessing Gmail or Drive. We document those connections so the practice can review them individually and decide which belong in the email setup.
Sources & further reading
- Google Workspace: HIPAA agreements and configuration
- Google Workspace: HIPAA included functionality
- Google: choose a data migration method
Vendor features and terms can change. Confirm the requirements for your account before making a change.