Why Caring Therapists Added Paubox to Google Workspace

As Caring Therapists has grown, so has the amount of sensitive information moving through our organization.

We have more than 100 team members, multiple locations across Florida, thousands of clients, and a lot of communication happening every day. While most clinical information stays within our electronic health record, email is still a regular part of running a mental health practice. We communicate with clients, insurance companies, referral sources, attorneys, schools, hospitals, and other healthcare providers.

That means email security cannot be an afterthought.

We have used Google Workspace for years, and we did not want to replace it. Our team already knows how to use Gmail, Google Drive, Google Docs, and the other tools within Google Workspace. We also have a Business Associate Agreement in place with Google.

However, signing a BAA with Google does not automatically make every email sent through Gmail HIPAA compliant. Google Workspace can be configured for HIPAA compliance, but it does not guarantee that every outgoing email will be encrypted in every situation.

We also did not want to rely on more than 100 people remembering to type something like “secure” in the subject line every single time an email might contain protected health information.

That is too much room for human error.

Why We Chose Paubox

We decided to add Paubox to our existing Google Workspace system because it allows our team to continue using Gmail normally while automatically encrypting outgoing email.

There is no separate application for our staff to learn. They write and send an email through Gmail just like they always have, and Paubox handles the encryption behind the scenes.

For most recipients, the email arrives directly in their inbox without requiring them to create an account, remember a password, or log into a separate portal. If the recipient’s email system cannot support the necessary encryption, Paubox uses a secure alternative to protect the message.

I liked that Paubox did not require us to completely change how our company operates. It added an additional layer of protection to a system we already use.

And honestly, that matters. A compliance solution is only helpful if people can realistically use it every day.

Preparing for Changing HIPAA Expectations in 2026

HIPAA compliance is not something a healthcare organization can complete once and never revisit.

In February 2026, updated Notice of Privacy Practices requirements took effect. Covered healthcare providers are now required to include additional information regarding the confidentiality of substance use disorder treatment records in their notices.

The U.S. Department of Health and Human Services has also proposed a significant update to the HIPAA Security Rule. As of this writing, that cybersecurity rule has not been finalized, but the proposal gives healthcare organizations a very clear picture of where compliance expectations are heading.

The proposed changes place greater emphasis on safeguards such as encryption, multifactor authentication, documented risk assessments, network mapping, incident response planning, regular compliance reviews, and stronger oversight of vendors and business associates.

We are not waiting until every new requirement becomes final to start strengthening our systems.

For Caring Therapists, implementing Paubox is one part of preparing our organization for increased cybersecurity and compliance expectations. It also helps us address a very practical risk: sensitive information being sent through email without the appropriate protection.

Technology alone, however, does not make a company HIPAA compliant.

The Other Steps We Have Taken

Over the past year, we have taken a much broader look at compliance throughout Caring Therapists.

We hired a Compliance Officer to help oversee our privacy and security practices, answer questions, review incidents, and make sure compliance is an ongoing responsibility within the organization.

We have also worked on developing and updating our HIPAA policies and procedures. These policies address how protected health information should be accessed, used, stored, transmitted, and disclosed. They also outline what staff members should do if they make a mistake or believe a privacy or security incident may have occurred.

Most importantly, policies cannot simply sit in a folder that nobody reads.

We conducted HIPAA training for our entire staff so that employees and clinicians understand their responsibilities. Training included practical issues that arise in a real mental health practice, such as verifying recipients before sending information, using approved communication systems, protecting devices, avoiding personal email accounts, recognizing phishing attempts, and reporting potential incidents immediately.

Our goal is not to create a culture where people are afraid to report a mistake. We want staff to ask questions and tell us quickly when something happens so we can respond appropriately.

Compliance is not one software program, one training, or one policy manual. It is the combination of having the right systems, documented expectations, ongoing education, appropriate oversight, and a team that understands why protecting client information matters.

A Simple Option for Other Private Practices

If you already use Google Workspace, Paubox may be a relatively simple way to add automatic email encryption without changing the email system your staff already knows.

Paubox Email Suite Standard is normally $384 per year for practices with one to five users. You can use my discount code AMANDA to receive $250 off your first bill, bringing the first-year cost down to $134.

The discount is applied one time to your first bill and does not renew annually.

You can learn more or sign up here:

Get Paubox for Your Private Practice

As practice owners, we are responsible for more than providing excellent clinical care. We are also responsible for building systems that protect the people who trust us with some of the most personal information in their lives.

For Caring Therapists, adding Paubox to Google Workspace was one more step toward doing that well.

This post is part of Caring Therapists’ paid partnership with Paubox. HIPAA requirements vary depending on an organization’s services and circumstances. This article is for general informational purposes and is not legal advice.

Sources: HHS HIPAA Security Rule, HHS proposed Security Rule update, HHS 2026 Notice of Privacy Practices guidance, and Paubox for Google Workspace.