Legacy G Suite risk assessment

Many organizations still run on legacy free G Suite accounts created before Google ended the free tier in 2012 (Google). Those accounts were a useful utility. Today they are a single point of failure for email deliverability, account security and regulatory exposure.

Key Takeaways

• Many organizations still run on legacy free G Suite accounts created before Google ended the free tier in 2012.
• Gmail now requires SPF or DKIM from all senders, and SPF, DKIM and DMARC from senders of more than 5,000 messages a day, effective February 2024.
• PHI may be used in Google Workspace only after accepting Google's Business Associate Agreement, and only in covered services. A legacy free account has no BAA.
• The legacy free edition has 15 GB per user; Business editions use pooled storage. A user who hits the cap cannot draw on unused company storage.
• puna.one signs HIPAA BAAs. This report is guidance, not a certification or legal opinion.

1. Deliverability (SPF, DKIM, DMARC)

Gmail now requires SPF or DKIM from all senders, and SPF, DKIM and DMARC from senders of more than 5,000 messages a day (Google sender guidelines, effective February 2024). Legacy setups often lack current SPF, DKIM and DMARC records.

• Risk: mail flagged as spam or unverified.
• Impact: lost leads, missed invoices and a damaged sender reputation that is slow to repair.

2. Security and access

Google says upgrading from legacy G Suite to Workspace unlocks premium security features (Google).

• Risk: weak MFA enforcement and no advanced protection options.
• Impact: more exposure to phishing and account takeover, and harder recovery if an admin account is compromised.

3. Compliance

PHI may be used in Google Workspace only after accepting Google's Business Associate Agreement, and only in covered services (Google).

• Risk: no BAA on a legacy free account.
• Impact: a business that handles protected health information (PHI) on that account may be out of HIPAA compliance. Civil penalty tiers are adjusted for inflation each year; check the current HHS figures (45 CFR 102.3).

4. Storage

The legacy free edition has 15 GB per user; Business editions use pooled storage (Google).

• Risk: a user who hits the cap cannot draw on unused company storage.
• Impact: mail or Drive stops at capacity, forcing a rushed upgrade.

HIPAA checklist for businesses handling PHI

• Designate a Privacy Officer and a Security Officer (the owner can hold both roles).
• Don't send PHI in standard email; use S/MIME or a secure portal.
• Sign BAAs with Workspace, cloud storage and IT vendors that touch PHI.
• Have a workflow for patient record requests within the required timeframe. The current limit is 30 calendar days with one 30-day extension (HHS); a 2021 proposal to shorten it to 15 days was not finalized, and HHS plans a new proposal (HHS agenda).
• Encrypt data at rest and in transit to NIST guidance.
• Document an annual risk assessment.

What modernization looks like

Moving to a managed, current Workspace edition provides:

• Hardened email: SPF, DKIM, DMARC and optional S/MIME.
• AI tools: built-in Gemini features, where the edition includes them (Google).
• Retention: Vault-based retention and eDiscovery, plus a signed BAA on eligible editions.

puna.one signs HIPAA BAAs. This report is guidance, not a certification or legal opinion.

Sources

Google, "Email sender guidelines" · Google Workspace Admin Help, "HIPAA compliance with Google Workspace" · Google, "Legacy G Suite editions" · 45 CFR 102.3, civil monetary penalty adjustments · HHS, right of access.

Next step: Book Managed AI Services (Managed AI Services)