HIPAA Compliance & Google Workspace
Security is one of the hallmark features of Google Workspace. With unique controls and protections offered in paid business plans, health providers can use Google Workspace as a powerful, low-cost, and secure practice management tool.
Health providers storing Protected Health Information (PHI) in Google Workspace can ensure HIPAA compliance by signing a Business Associate Addendum (BAA) with Google.
Note that the Business Associate Addendum, also called the Business Associate Agreement, is available for paid Google Workspace business plans only.
Which services are covered in the BAA?
Only a portion of Google’s products and services are covered in the HIPAA BAA
As of December 2024, these include:
AppSheet, Apps Script, Cloud Identity Management, Gemini app, Gemini for Google Workspace, Gmail*, Google Calendar, Google Chat, Google Cloud Search, Google Drive (including Google Docs, Google Forms, Google Sheets, Google Slides, and Google Vids), Google Groups, Google Keep, Google Meet, Google Sites, Google Tasks, Google Vault (if applicable) and Google Voice (managed users only)
(* Full HIPAA compliance with Gmail may require end-to-end encryption using a third party application when emailing outside of your direct organization.)
I am not a lawyer, and this is not legal advice. Please speak with a lawyer for advice specific to your practice.
Video Walkthrough
This video overviews the process to sign Business Associate Addendum or Agreement (BAA) with Google Workspace in order to ensure HIPAA compliance with your paid Google Workspace account.
The BAA can be found in the Admin console, under Account Settings, in the Legal & Compliance section.
This walkthrough video was made in 2020, so the appearance of the Admin console have changed in newer versions of Google Workspace.
Please consult an attorney with any specific questions about HIPAA compliance and your health practice.
For the latest information and updates about Google Workspace & HIPAA Compliance – check out this Google Help Center resource.