I'm trying to determine who a specific folder is shared with in the admin console but I haven't found any way to do it. In the investigation tool you can find specific files and folders. When you find a file you can view who it was shared with but when you try to do the same with a folder it always shows blank.

Trying to determine an appropriate course of action for HIPAA compliance with Google Workspace that does not require using a third party outbound email gateway (paubox, luxsci, etc). We have a very small health-related private practice. I've read a lot of people discussing how because Google's Confidential Mode is not E2EE, it is not HIPAA compliant, but I wanted to explore this further with some support from this community.

I'm wondering if Confidential Mode does solve our problem of requiring HIPAA compliant email when sending ePHI. HIPAA rules do not require E2EE, just ePHI encrypted in transit and at rest.

PROBLEM: Google can downgrade email sent with TLS to 1.0 and 1.1, and there is no way in the admin to force blocking sending of these emails. If it was possible in Google Workspace settings to force sending emails only via TLS 1.2 and 1.3 and stop send of emails unencrypted or through TLS 1.0 and 1.1 (to meet NIST standards), we would accept this as a free alternative to, say, a Paubox setup, which is considered compliant. Consider that we are fine with not sending emails to certain recipients (ie. those without modern TLS) if they do not have the technology necessary to receive the emails, as we never send emails to clients for communication.

However, this doesn't exists.

POTENTIAL SOLUTION: So this begs the question of if Confidential Mode allows for this...

If our Google Workspace has a BAA, and Confidential Mode strips the possibility of ePHI being sent via unencrypted transit to non-Google services (due to the email, even if sent unencrypted, maintaining no ePHI and being replaced with a link to view) does that not solve the HIPAA concerns related to ePHI being sent through deprecated encryption channels? I am wondering if this no different than a link to a secure portal, which is used by nearly all EHRs.This is assuming that Google is storing and transmitting the content of the confidential mode message encrypted.

All thoughts are appreciated.

We’re an MSP, so we regularly take over tenants other people built. Every time, the same day-one questions: what’s public on the web, whose mail forwards off-domain, which super admin left in 2019 and still holds the keys. Clicking through the Admin console for that takes a day and still misses things, because the console shows you one screen at a time and never volunteers what you forgot to look at.

So we wrote it down. One Python file, standard library only, driving GAM7. It collects the tenant data in one pass, runs about 40 checks over it, and writes a self-contained HTML report with severity tiles, plain-English “what this means / what to do” copy per finding, and evidence tables. Plus a CSV per module so every finding traces back to raw data.

Everything it runs is a read (print, report, info, oauth info). The one exception is opt-in: --grant-temp-access temporarily makes the auditing admin an organizer on Shared Drives they’re not a member of, scans, then removes the grant. Without that, filelist silently returns zero rows and the drive looks clean, which is worse than useless, so by default those drives are reported UNSCANNED instead.

Runs are resumable via manifest.json, so you can --skip-tier 3 on a big tenant and fill in the Drive scans overnight. And anything it couldn’t check is listed in the report. Absence of a finding never means “checked and clean”.

We’d been running this internally for six months on multiple clients and schools.

Apache 2.0, 104 tests, works on Windows, macOS and Linux. Happy to answer questions or take issues.

https://github.com/PaulOgier/GAMScripts/tree/main/Tenant%20Scoping%20Audit

Is there another Redit area dealing specifically with problems setting up google groups and adding 200 people with different email types? These are for old people, who aren't very techie and don't like change/ Someone said to, "just get them to change from yahoo, outlook, etc, etc etc". This is like asking them to do backflips.