Is Google Workspace HIPAA Compliant? BAA, Plans and Setup

Google Workspace can hold patient information, but it is not HIPAA compliant by default. Google Workspace HIPAA compliance starts when a super administrator accepts the Google BAA, Google’s Business Associate Amendment, in the Admin console. That agreement covers only the services on Google’s list of covered Workspace services, and your organization still has to configure those services.

We read every Google page cited here in September 2026 and rechecked them on October 10, 2026, by which time Google’s list of covered services had moved to a new page. This is general information, not legal advice. If you are still choosing a suite, our Google Workspace vs Microsoft 365 price comparison covers cost and features for any small business; this post answers only the HIPAA question.

Does Google sign a BAA for Workspace?

Yes, electronically. Google makes its BAA available for acceptance in the Admin console. A super administrator opens Account settings > Legal and compliance, finds the Google Workspace/Cloud Identity HIPAA Business Associate Amendment under Security and Privacy Additional Terms, answers three questions confirming the organization is a HIPAA covered entity, and accepts. Google’s help center (checked September 2026) says the electronic acceptance has the same legal effect as a paper agreement, and that a screenshot of the acceptance can serve as your record.

Four points in Google’s BAA text are worth knowing before you rely on it:

• It applies only to Covered Services, not to PHI you keep outside them, including in third-party applications.
• It requires you to use the controls available in the services, including those in Google’s HIPAA Implementation Guide, to keep PHI inside covered services.
• Google must report a breach it discovers without unreasonable delay and no later than 60 calendar days after discovery.
• Google can remove a service from the covered list only with at least 12 months’ notice.

Which Google Workspace services does the BAA cover?

Google’s list of covered services now sits on its HIPAA compliance page for Google Cloud and Google Workspace; the old Included Functionality address redirects there, and the Workspace section showed a last-updated date of August 31, 2025 when we checked in October 2026. Anything not on the list is outside the BAA, even inside your Workspace account. The right-hand column comes from Google’s implementation guide and help center.

One inconsistency to know about: Google’s current list names Google Photos inside Google Drive’s covered functionality, while its September 2025 implementation guide lists Google Photos among the additional services to switch off for staff who handle PHI. Until Google reconciles the two, keep patient photos in Drive folders with restricted sharing rather than in Google Photos.

Which Workspace plans cover HIPAA?

Google does not publish a list of eligible editions. Its acceptance instructions say you must be signed in to an administrator account for your organization’s Google Workspace or Cloud Identity account, and that users of the legacy free edition, sometimes called Google Apps Standard Edition, cannot review and accept a BAA. A personal @gmail.com address has no organizational Admin console, so it cannot be covered. If your Admin console does not offer the HIPAA amendment, ask Google before any patient data goes in.

The edition still decides which tools you get around the BAA. Google Vault, Google’s retention and eDiscovery service, is included in Business Plus, Enterprise Standard and Enterprise Plus, all Education editions, and Frontline Standard and Plus. On editions without it, such as Business Starter and Business Standard, Google’s answer is an upgrade or add-on Vault licenses where compatible. Google also says Vault isn’t a data archive, while HIPAA requires a data backup plan with retrievable exact copies of ePHI (45 CFR 164.308(a)(7)(ii)(A)). Plan backups separately.

What should you set up after accepting the BAA?

The BAA makes configuration your job: Google’s terms require you to use the available controls to keep PHI inside covered services. These are the settings we start with, drawn from Google’s HIPAA Implementation Guide:

1. Separate the people who handle PHI. Put them in their own organizational unit and turn off services outside the covered list, such as YouTube, for that unit.
2. Tighten Drive sharing. Restrict sharing outside the domain, make new files private to the owner, keep patient names out of file and folder titles, and review Google’s file exposure reports.
3. Limit calendars. Share only free/busy information outside the domain and mark appointments that contain PHI as private.
4. Close side doors. Block unreviewed Marketplace apps, Docs add-ons and Chat apps, and turn off Gemini in Chrome for staff who handle PHI.
5. Watch the account. Turn on alerts for suspicious sign-ins, new admin privileges and passwords changed by an administrator.

We add 2-Step Verification for everyone in that unit, which supports the Security Rule’s person or entity authentication standard (45 CFR 164.312(d)). Gmail is on the covered list, but sending patient information to outside addresses still raises the transmission question. Our guide to HIPAA rules for email covers encryption and patients who ask for plain email.

How do you make Google Voice HIPAA compliant?

Google Voice can carry PHI only inside a Google Workspace account with the BAA accepted, and only for managed users. Google lists it as covered for managed users only, and its implementation guide says licensed users of Google Voice are covered under the Workspace BAA; a personal Google Voice number is not. To set it up:

1. Accept the BAA in the Admin console before any patient calls or texts go through Voice.
2. Assign Google Voice licenses to every staff member who handles PHI on Voice, as Google’s guide recommends.
3. Move personal Voice numbers into managed accounts. Google’s guide points administrators to migrating existing users to managed accounts, so nobody keeps patient conversations on a personal number.
4. Keep meeting names private. When a Meet call dials out to a Voice user, the meeting name can display on that person’s device, so Google suggests marking calendar entries that contain PHI as private and limiting calendar sharing to free/busy information.
5. Apply the same account controls: 2-Step Verification, the PHI organizational unit described above, and a retention decision recorded in your risk analysis.

Voicemails and texts with patient details are electronic PHI once they sit in the service, so treat them with the same care as email. Our HIPAA email guide covers the rules for messages that leave your domain.

Where NetSys fits

We administer Google Workspace and Microsoft 365 for clients. Our HIPAA compliance services for practices turn the settings above into documented controls and keep Google’s BAA in a vendor register next to every other business associate agreement your practice holds. A HIPAA compliance audit shows whether your current setup matches what you accepted. Practices on Microsoft should read our Microsoft 365 HIPAA guide, and more on how we support clinics is on our IT for medical practices page.

Frequently asked questions

Is Gmail HIPAA compliant?

Gmail can carry PHI once your organization accepts Google’s BAA, because Gmail is on Google’s HIPAA Included Functionality list. The BAA does not make every message safe. You still decide how patient information leaves your domain, for example with data loss prevention rules, and you record that decision in your risk analysis.

Is Google Docs HIPAA compliant?

Google Docs can hold PHI once your organization accepts Google’s BAA, because Docs is covered as part of Google Drive, along with Sheets, Slides, Forms and Vids. Use it with a Workspace account, never a personal one, keep patient names out of document titles, and restrict sharing outside your domain, since a shared link can expose a document to anyone who has it.

Is Google Drive HIPAA compliant?

Google Drive, including Docs, Sheets, Slides and Forms, is covered by Google’s BAA after an administrator accepts it. Coverage is not the same as safe sharing. Google’s implementation guide recommends restricting sharing outside the domain, making new files private by default, keeping PHI out of file titles, and reviewing file exposure reports.

Can a practice use a free Gmail account for patient information?

No. Google’s BAA is accepted by an administrator of an organization’s Google Workspace or Cloud Identity account, and Google says users of the legacy free edition cannot accept it. A personal Gmail address has no organizational Admin console. Move patient communication to a Workspace account with the BAA accepted.

Is Gemini covered by Google’s HIPAA BAA?

Partly. Google’s covered list includes Gemini in Google Workspace, the Gemini app used as a Workspace core service and the Gemini Mac App, but excludes Gemini in Chrome, and its guide says the Gemini app offered as an Additional Product is not HIPAA compliant. Turn off those routes for staff who handle PHI. We compare other AI tools and their BAAs separately.

Does the Workspace BAA cover Google Cloud?

No. The Workspace BAA covers the Workspace services on Google’s Included Functionality list. Google’s implementation guide tells Apps Script developers not to send PHI to Google Cloud Platform services and APIs without signing a BAA with Google Cloud Platform, which is a separate agreement. Review it on its own before building there.

Does Google charge for its BAA?

Google offers the BAA for acceptance in the Admin console; there is no separate BAA product to buy. The costs sit around it: Google Voice licenses for staff who use Voice with PHI, Vault on editions that do not include it, a backup service, and the administrator time to configure and document the settings.

Can we share patient information with Google support?

No. Google’s implementation guide says technical support services are not part of the covered functionality, so leave patient details out of support cases, chats and screenshots, and describe problems with test data instead.

Sources (checked September and October 2026)

• HIPAA Compliance with Google Workspace and Cloud Identity, Google Workspace Admin Help, rechecked October 10, 2026.
• Privacy compliance and records for Google Workspace and Cloud Identity, the BAA acceptance steps and the legacy free edition note, checked September 2026.
• HIPAA compliance on Google Cloud and Google Workspace, Google’s current list of covered Workspace services (Workspace section last updated August 31, 2025), checked October 10, 2026; the old Included Functionality address now redirects there.
• Google Workspace HIPAA Business Associate Addendum, the agreement text, checked September 2026.
• Google Workspace and Cloud Identity HIPAA Implementation Guide (PDF), September 2025 edition, including its Google Voice section, rechecked October 10, 2026.
• Google Vault overview, the editions that include Vault, checked September 2026.
• 45 CFR 164.308 and 45 CFR 164.312, HIPAA Security Rule safeguards on the eCFR, checked September 2026.