GP-: Google Workspace: Email Access, Communication Standards, and Security

Module Overview

Opening Statement

Email is an essential tool for communication, collaboration, and daily operations at Granite Pointe Eye Care. Knowing how to access and navigate Gmail is the first step toward using it effectively. Understanding how to communicate professionally, manage messages, protect confidential information, and recognize potential security threats is equally important.

This training provides practical instruction on using Gmail and establishes the expectations for responsible company email use. From composing a professional message to identifying a suspicious email, every team member plays a role in keeping communication clear, information secure, and work moving forward.

Module Purpose

The purpose of this module is to equip team members with the knowledge and skills needed to use Gmail confidently, follow company email standards, and recognize and respond appropriately to potential email security threats.

Team members will learn how to access their company account, navigate the Gmail interface, send and manage messages, and organize their inbox. They will also understand expectations for professional communication, timely responses, accountability, confidentiality, and the appropriate use of email. Finally, they will learn how to identify suspicious messages, inspect them safely, and follow the appropriate reporting procedures.

Key Learning Outcomes

By the end of this module, team members will be able to:

Access and navigate their Granite Pointe Google Workspace account and identify essential Gmail features.
Compose and manage emails by sending, replying, forwarding, searching, and organizing messages appropriately.
Apply company email standards for professional communication, response expectations, confidentiality, and follow-through.
Recognize security risks by identifying common signs of spam, phishing, impersonation, and suspicious attachments or links.
Respond to suspicious messages by verifying unusual requests, avoiding risky actions, and following appropriate security procedures.
Report potential threats through the designated company process and promptly escalate suspected account or information compromises.

Learning Experience

Google Workspace

What Is Google Workspace?

Google Workspace is a collection of cloud-based tools designed to help people communicate, collaborate, organize information, and complete work. It includes Gmail for email, Google Drive for file storage, Google Docs for documents, Google Sheets for spreadsheets, Google Slides for presentations, and Google Calendar for scheduling.

These tools work together to make information easier to access, share, and manage. Depending on their assigned permissions, team members can use them to communicate with coworkers, access shared resources, collaborate on documents, and stay informed about important tasks and schedules.

Why Do We Use Google Workspace at Granite Pointe?

At Granite Pointe Eye Care, consistent communication and access to reliable information are essential to our daily operations. Google Workspace provides a centralized set of tools that helps our team stay connected, collaborate across locations, and access the information needed to perform their responsibilities.

We use Google Workspace to support:

Communication: Gmail allows team members to exchange information, communicate updates, and coordinate work.
Collaboration: Shared documents and files allow authorized team members to work together and access current information.
Organization: Tools such as Google Drive and Google Calendar help organize resources, schedules, and shared responsibilities.
Accessibility: Cloud-based tools allow authorized users to access work resources from supported devices and locations, subject to company policies and permissions.
Consistency: Using shared company tools helps reduce fragmented communication and supports consistent processes across our offices.

Your Responsibility as a Team Member

Google Workspace is a company resource. Every team member is responsible for using assigned accounts appropriately, protecting login credentials, respecting access permissions, and handling company and patient information according to Granite Pointe's policies.

Not every employee will have access to every file or feature. Access is determined by assigned permissions and business needs. If you cannot access a resource required for your role, contact your manager.

The goal: Use Google Workspace to communicate clearly, work efficiently, access the right information, and protect the information entrusted to us.

Sign into my Google Workspace

Frequently asked questions

Every team member is responsible for using company email professionally, protecting confidential information, and following established communication and security procedures. When uncertain, pause, verify, and ask for guidance rather than taking unnecessary risks.

Open an approved web browser on your computer.
Navigate to Gmail or the Google Workspace sign-in page.
Enter your Granite Pointe company email address. Your email is your first initial, your last name, @GranitePointeEyeCare. ie. Jane Smith = jsmith@GranitePointeEyeCare.com
Select Next.
Enter your password and complete any required verification steps. The default password is your last name, your first name, and the current year, and an exclaimation point. ie. SmithJane2026!
Once signed in, select Gmail (top right corner) if it does not open automatically.

Important: Use your assigned company account for company business. Do not share your password or verification codes with another person. If you cannot access your account, contact your manager for account support.

Company email should be used for legitimate business communication and in accordance with company policies.

Employees are expected to:

Use their assigned company account for company business.
Communicate respectfully and professionally.
Use appropriate recipients and distribution lists.
Avoid unnecessary messages, excessive Reply All responses, and irrelevant copying.
Never use company email to send inappropriate, discriminatory, harassing, or otherwise prohibited content.

To: People who are directly responsible for responding or taking action.
CC: People who need visibility into the communication but are not the primary action owner.
BCC: Recipients whose addresses should not be visible to other recipients. Use only when appropriate and consistent with company policy.

Use Reply All only when everyone on the original message needs the response. Avoid copying additional people simply to keep them informed when they do not need the information.

Step 5: Review Before Sending

Before selecting Send, ask yourself:

Is the recipient correct?
Is the subject line clear?
Is the message accurate and easy to understand?
Is the tone professional?
Have I identified the action required?
Have I included the necessary attachment?
Does the message contain confidential information that requires an approved method of communication?

Practice Activity 3

Compose a practice email that includes an appropriate subject line, a clear request, a deadline, and a professional closing. Review the recipient fields before sending it to the designated trainer or using a training environment.

Completion standard: The message is clear, appropriately addressed, complete, and professional.

5. Lesson Four: Replying, Forwarding, and Managing Follow-Up

Replying to an Email

Use Reply when your response is intended for the original sender.

Before responding:

Read the entire conversation.
Identify the question or request.
Answer the specific question or confirm the requested action.
Include relevant information without adding unnecessary detail.
State what will happen next if the issue is not yet resolved.

Reply All

Use Reply All only when the response is relevant to all recipients in the conversation.

For example, a schedule change involving several employees may require a response to the group. A question directed to one person generally does not.

Forwarding an Email

Before forwarding:

Confirm the new recipient has a legitimate business reason to receive the information.
Review the original message and remove unnecessary content where appropriate.
Verify that the message does not disclose confidential information improperly.
Add a brief explanation of why you are forwarding the email and what action is needed.

Forwarding an email does not transfer accountability automatically. If you are responsible for the issue, ensure the work is completed or explicitly handed off.

Managing Emails That Require Action

Use a consistent process for every actionable message:

Read: Understand the request.
Determine ownership: Identify who is responsible.
Determine urgency: Check deadlines and potential impact.
Respond: Acknowledge or answer as appropriate.
Track: Record the task or deadline in the appropriate system.
Close the loop: Confirm completion or communicate the next step.

If you cannot complete a request immediately, do not leave the sender uncertain. Acknowledge the request when appropriate, communicate when you expect to provide an answer, and follow through.

Practice Activity 4

Review a sample email containing a request. Draft a response that acknowledges the request, identifies the next step, and communicates a realistic completion timeframe.

Completion standard: The employee demonstrates appropriate response practices and a clear plan for follow-through.

6. Lesson Five: Company Email Standards and Expectations

Why Company Standards Matter

Technology provides the tools for communication, but consistent standards determine how those tools are used.

Without shared expectations, important messages can be overlooked, requests may go unanswered, responsibilities become unclear, and patient or business information may be handled improperly. Consistent standards reduce avoidable confusion and help team members work together across departments and locations.

Company email standards establish a common understanding of what professional communication looks like, when action is required, and how employees are expected to protect information and follow through on commitments.

Receiving an email does not automatically complete the work it describes. Employees are responsible for recognizing requests that relate to their duties and ensuring the appropriate next step occurs.

Employees must:

Complete assigned actions within the required timeframe.
Communicate when a deadline cannot be met.
Clarify unclear instructions rather than making avoidable assumptions.
Ensure tasks are handed off explicitly when another person must take ownership.
Avoid treating an archived, starred, or read message as proof that its underlying task has been completed.

All company emails should be clear, respectful, accurate, and appropriate for the intended audience.

Email is a written business record. Write with the understanding that messages may be retained, forwarded, or reviewed later.

Employees are expected to:

Use descriptive subject lines.
Write in complete, understandable sentences.
Check spelling, names, dates, figures, and attachments.
Avoid sarcasm, hostile language, and emotionally reactive responses.
Keep messages focused on the issue and the action required.
Correct errors promptly when inaccurate information has been sent.

Confidential patient data and protected health information must always adhere to our privacy standards. Never include unnecessary patient identifiers in subject lines or unencrypted correspondence.

Patient information must be handled in accordance with applicable privacy requirements and Granite Pointe's approved procedures.

Employees must:

Use only company-approved systems and communication methods for patient information.
Verify recipient identity and authorization before sending sensitive information.
Avoid including patient information in subject lines.
Never send patient information to personal email accounts or unauthorized recipients.
Follow established procedures for secure messaging and approved attachments.
Report suspected misdirected emails or unauthorized disclosures promptly through the appropriate reporting process.

Important: Do not assume that an email is appropriate for patient information simply because it can be sent through Gmail. Follow Granite Pointe's approved privacy and security procedures for the specific type of information being communicated.

Employees are responsible for monitoring their company email during their assigned working hours and addressing messages relevant to their role.

Email must not be used as a substitute for immediate communication when a delay could affect patient safety, time-sensitive operations, or an urgent business issue.

A timely response does not always mean providing an immediate solution. It means recognizing the request, assessing its urgency, acknowledging it when needed, and ensuring that the next step is clear.

Employees should:

Prioritize urgent issues based on their impact and applicable escalation procedures.
Employees are expected to acknowledge or respond to internal inquiries within one business day during working hours.
Urgent clinical or operational concerns should be communicated directly in person or via telephone.
Communicate when additional time is needed to provide a complete answer.
Follow through on commitments and deadlines.
Escalate messages that require a decision or authority beyond their role.

When using a shared or public computer:

Select your Google profile picture.
Choose the sign-out option for your account.
Close the browser window if appropriate.
Never leave company email open and unattended on a shared device.

To: People who are directly responsible for responding or taking action.
CC: People who need visibility into the communication but are not the primary action owner.
BCC: Recipients whose addresses should not be visible to other recipients. Use only when appropriate and consistent with company policy.

Use Reply All only when everyone on the original message needs the response. Avoid copying additional people simply to keep them informed when they do not need the information.

If you experience login issues or suspect unauthorized activity, contact your manager.

Identifying Spam, Suspicious Emails & Phishing Scams

Learning Outcome:

By the end of this lesson, team members will be able to:

Identify at least five common warning signs of suspicious email.
Explain the difference between spam, phishing, and email impersonation.
Verify a sender's email address rather than relying solely on the display name.
Recognize risky links, unexpected attachments, and unusual requests.
Explain what to do when an email appears suspicious.
Demonstrate how to report a suspicious message in Gmail.
Identify the appropriate response if they have already clicked a suspicious link or disclosed information.

Relevance-Why this Matters:

Email is an important business tool, but it can also be used to distribute spam, steal account credentials, spread malicious software, and trick employees into disclosing confidential information.

Suspicious emails are not always obvious. Some messages appear to come from legitimate companies, coworkers, managers, or service providers. Others create a sense of urgency, offer unexpected rewards, request payment, or ask employees to open an attachment or click a link.

Every team member is responsible for recognizing potential email threats and handling them appropriately. Knowing what to look for—and what to do when something seems suspicious—helps protect company accounts, patient information, financial resources, and business operations.

Spam

Spam is unsolicited or unwanted email, often sent in bulk. It may advertise products, promote questionable services, or direct recipients to unfamiliar websites.

Not all spam is dangerous, but some messages contain malicious links or attempts to steal information.

Phishing

Phishing is an attempt to trick someone into revealing sensitive information, such as passwords, financial details, or account verification codes, or into taking another unsafe action.

Phishing messages may imitate banks, technology providers, delivery companies, or other trusted organizations.

Impersonation and Business Email Compromise

Impersonation occurs when a sender pretends to be someone the recipient knows or trusts. A message may appear to come from a manager, coworker, doctor, vendor, or company executive.

These messages may request:

An urgent payment or purchase.
A change to vendor banking information.
Gift card purchases.
Employee or patient information.
Passwords or verification codes.
An unusual favor that bypasses normal procedures.

Important: A familiar name, professional appearance, or convincing writing style does not prove that an email is legitimate.

Recognize the warning signs

Warning Sign 1: An Unfamiliar or Incorrect Sender Address

Check the actual email address, not just the sender's displayed name.

For example:

Expected: billing@trustedvendor.com
Suspicious: billing@trusted-vendor-payments.com

An unfamiliar domain, misspelling, extra word, or unusual character may indicate impersonation.

However, a familiar address alone does not guarantee safety. Legitimate accounts can be compromised, and some fraudulent messages use convincing sender information.

Warning Sign 2: Urgent or Threatening Language

Suspicious messages often pressure recipients to act before they have time to verify the request.

Examples include:

"Your account will be disabled in 30 minutes."
"Immediate payment is required."
"You must respond confidentially."
"Do not discuss this request with anyone."
"Your password expires today. Click here to prevent suspension."

Urgency is not proof of fraud, but it is a reason to pause and verify the request independently.

Warning Sign 3: Unexpected Links

A message may ask you to click a link to:

Sign in to Google Workspace.
Review a shared document.
Confirm account information.
Download an invoice.
Track a package.
Verify a payment.

Before opening a link, inspect the destination when it is safe to do so. On a computer, you can generally hover over a link to preview its destination without clicking it.

Be cautious of misspelled domains, unfamiliar websites, shortened links, or destinations that do not match the organization referenced in the message.

Never enter your company password or verification code into a website reached through an unexpected email link. Instead, open the known company service directly using a trusted bookmark or by typing its established address.

Warning Sign 4: Unexpected Attachments

Be cautious of attachments you were not expecting, especially files that ask you to enable macros, run software, install an application, or enter credentials.

Common attachment types that require particular care include executable files, script files, password-protected archives, and documents requesting that you enable active content.

Even a PDF or Word document can be used in an attack. The file extension alone does not establish that a file is safe.

If you were not expecting the attachment, verify it with the sender through a separate, trusted communication method before opening it.

Warning Sign 5: Requests for Confidential Information

Treat unexpected requests for passwords, verification codes, payment information, employee records, or patient information as high risk.

Granite Pointe team members should never disclose passwords or authentication codes in response to an email request.

Requests involving patient information must follow approved company privacy and security procedures.

Warning Sign 6: Unusual Payment or Account Changes

Be especially careful when an email requests:

A new vendor payment method.
A change to bank account information.
An urgent wire transfer.
Gift card purchases.
A refund or payment outside the normal process.

Verify these requests using an established phone number or other trusted contact method—not the phone number or link supplied in the suspicious message.

Warning Sign 7: Unexpected Messages From Familiar People

A message from a manager or coworker may still be fraudulent, especially if it asks for confidential information, urgent financial action, or an unusual favor.

If a request seems out of character, verify it directly with the person using a known communication method.

Warning Sign 8: Generic Greetings, Odd Formatting, or Unusual Language

Messages containing awkward wording, inconsistent branding, unexpected spelling errors, or generic greetings may be suspicious.

However, polished writing and correct grammar do not establish legitimacy. Modern phishing emails can be highly convincing.

The following behaviors are proposed as a working framework for the GPE Patient Experience Standard and require leadership approval before being represented as official policy.

Welcome intentionally. Acknowledge each patient with warmth, professionalism, and attention.
Listen and understand. Give the patient an opportunity to express concerns, questions, and needs.
Anticipate and personalize. Notice opportunities to improve the experience through appropriate, thoughtful action.
Own the next step. Communicate what happens next and ensure responsibility for follow-through is clear.
Close the loop. Confirm understanding, address unresolved concerns, and avoid leaving the patient uncertain about the outcome.
Granite Pointe mission, values, and patient experience.
Approved patient communication and service recovery standards, where available.
Role-specific SOPs and job aids.

Practice

Match each behavior to an example from their own department.

Examples: include welcoming a patient at check-in, explaining a testing delay, preparing a patient for the next stage of an appointment, or helping an optical patient understand the next step in an order.

How to inspect a suspicious email in Gmail

Follow these steps without interacting with suspicious content.

Step 1: Pause Before Acting

Do not click links, download attachments, reply, or provide information while you assess the message.

Step 2: Check the Sender

Open the message details if necessary to review the sender's actual address and other available delivery information.

Look for unfamiliar domains, spelling differences, or inconsistencies with the organization the sender claims to represent.

Step 3: Review the Request

Ask yourself:

Was I expecting this message?
Does the request make sense for the sender?
Is there unusual urgency or secrecy?
Is the sender requesting information they should not need?
Does the request bypass normal company procedures?

Step 4: Verify Independently

If the message claims to come from a coworker, manager, vendor, or service provider, contact that person through a known phone number, established email thread, or trusted internal channel.

Do not use contact details provided only in the suspicious message.

Step 5: Report the Message

Use the company's designated reporting process. If Gmail provides a Report phishing or Report spam option, use the appropriate option in accordance with company procedures.

If you are unsure whether the message is malicious, ask your manager or the designated IT/security contact. Do not forward suspicious attachments or links to coworkers as a warning unless the approved reporting process specifically requires it.

What to do when you find a suspicious email

If You Have Not Clicked Anything

Do not interact with the message.
Report it through the approved company process.
Follow instructions from the designated IT/security contact.
Do not forward it to other employees unnecessarily.

If You Clicked a Link but Did Not Enter Information

Stop interacting with the website.
Do not download files or approve prompts.
Report the incident promptly to the designated IT/security contact.
Follow instructions on whether further device or account checks are needed.

A click does not automatically mean your account or device has been compromised, but it should be reported so the risk can be assessed.

If You Entered Your Password or a Verification Code

Contact the designated IT/security contact immediately using a trusted communication method.
From a trusted device, change your password if instructed or if the account may be compromised.
Follow instructions to revoke suspicious sessions, review account security, and reset authentication methods if needed.
Report any unusual account activity.

Do not wait until the end of the workday to report a possible account compromise.

If You Opened an Attachment or Ran a File

Stop interacting with the file.
If you suspect malware or the device behaves unusually, follow company instructions for disconnecting it from the network.
Contact the designated IT/security contact immediately.
Do not delete evidence or attempt to investigate the file yourself unless instructed.

If You Sent Confidential Information or Approved a Payment

Report the incident immediately through the appropriate security, privacy, or financial escalation process. Prompt reporting can help limit further exposure or loss.

Reporting suspicious email

At Granite Pointe Eye Care, the expected response to a suspicious email is to pause, verify, report, and follow instructions.

Team members must:

Never knowingly provide passwords or verification codes in response to an email request.
Never bypass established payment, privacy, or account-security procedures because a message appears urgent.
Verify unusual requests through a trusted, independent communication channel.
Report suspected phishing, impersonation, or accidental disclosure promptly.
Follow the direction of the designated IT/security contact or company leadership.

Company procedure to finalize: Identify the person, team, or support channel responsible for receiving security reports. Include the exact reporting steps and any required incident-reporting form on this Academy page.

Lession 6: Making the Experience Personal

Learning Outcome: Identify appropriate opportunities to personalize the patient experience while respecting privacy, preferences, and professional boundaries.

Relevance-Why this Matters: Patients want to feel recognized as individuals, not processed as appointments. Thoughtful personalization can make routine interactions feel more considerate and reassuring. Personalization should be based on what the patient communicates, what is relevant to the interaction, and what can appropriately be done—not assumptions about the patient's preferences or circumstances.

Content and Resources

Examples of appropriate personalization include:

Using the patient's preferred name when appropriate.
Remembering a stated preference when permitted and relevant.
Offering clear explanations to a patient who expresses uncertainty.
Recognizing a practical concern and coordinating appropriate assistance.
Adjusting communication style to support understanding without being patronizing.

Employees must follow privacy requirements and organizational rules for using and documenting patient information.

Practice Activity

Present three brief examples and ask the employee to distinguish thoughtful personalization from inappropriate assumptions or overstepping professional boundaries.

Knowledge Check