Google Workspace security and HIPAA guide

What does Google Workspace security cover?

Google Workspace security covers the accounts your team signs in with, the email you send and receive, the files you store, and the records you keep. Google runs the infrastructure, encrypts data at rest, and uses TLS to protect mail in transit when the receiving server supports it. Your administrators control almost everything else from the Admin console.

That second part is where most small organizations have gaps. The defaults are reasonable for a brand new account, but they are not tuned for a medical practice, a law office, or a firm that handles client financial records. A few hours of focused configuration closes most of the common gaps.

This guide groups the work into six areas:

• Account protection: passwords, 2-Step Verification, and admin roles
• Email protection: authentication records and encryption
• File protection: Drive and shared drive sharing rules
• Retention and eDiscovery: what you keep, for how long, and how you find it
• People changes: removing access when someone leaves
• Regulated data: HIPAA and the Business Associate Agreement

Who is responsible for security in Google Workspace?

Security in Google Workspace is shared between Google and your organization. Google is responsible for its data centers, its network, and the software that runs the service. You are responsible for who has access, how they sign in, what they share, and how long you keep data.

In practice, a loose sharing setting or an account without 2-Step Verification is your risk, not Google's. The good news is that your security can improve quickly, because you control the settings that matter most. Name one person, inside your team or at a partner, who owns the Admin console and reviews it on a schedule.

Can Google Workspace be used for HIPAA?

Yes, Google Workspace can support HIPAA compliance, but the product alone does not make you compliant. Compliance depends on how you configure the account and how your team uses it. Google signs a Business Associate Agreement (BAA) that covers specific services, and an administrator reviews and accepts it in the Admin console. Personal Gmail accounts are not covered.

There is no official HIPAA certification for software. A covered entity or business associate is responsible for its own safeguards, policies, and risk analysis. Google provides the tools and the contract. Your organization provides the configuration, the training, and the daily discipline.

Read Is Google Workspace HIPAA compliant? for the fuller answer, then follow how to review and accept the Google Workspace BAA before anyone stores protected health information in the account. This guide is general information, not legal advice. Always confirm your specific obligations with your compliance officer or legal counsel.

How do you protect accounts from takeover?

The most effective protection against account takeover is 2-Step Verification, enforced for every user. With it in place, a stolen password alone is not enough to sign in. Google Workspace supports several second steps, including Google prompts on a phone, authenticator apps, and physical security keys.

Enforcement is where rollouts go wrong. If you switch it on for everyone on a Monday morning, the help desk hears about it all day. A staged rollout with an enrollment window, clear instructions, and backup codes works far better. Our guide to rolling out 2-Step Verification without the help desk chaos lays out the steps.

A few other account controls matter just as much:

• Keep super administrator accounts to a small number, and use them only for admin work
• Give other admins narrower roles that match their actual job
• Set a minimum password length and turn on password strength enforcement
• Keep recovery phone numbers and email addresses current for every admin account

How do you protect email?

You protect email with two things: authentication records that prove your mail really comes from you, and encryption that protects messages as they travel. Authentication makes it much harder for attackers to send mail that looks like it came from your domain. It also helps your legitimate mail reach the inbox instead of spam.

The three records are SPF, DKIM, and DMARC. SPF lists the servers allowed to send for your domain. DKIM adds a digital signature to each message. DMARC tells receiving servers what to do when a message fails those checks. Our guide to SPF, DKIM, and DMARC for Google Workspace walks through each record in order.

Encryption is the other half. Gmail encrypts mail in transit with TLS when the receiving server supports it, and Google encrypts stored mail at rest. That is not the same as end-to-end encryption, and the difference matters for regulated data. Is Gmail encrypted? explains what each layer protects and where the gaps are.

How do you keep files from being overshared?

You keep files from being overshared by setting sharing rules in the Admin console, rather than trusting every user to pick the right option every time. Google Drive makes sharing easy, which is good for collaboration and risky for sensitive files.

Start with three decisions. Can users share files with people outside your organization? If so, should Drive warn them first? And what should the default be when someone creates a link? Many organizations allow external sharing but limit it to trusted domains, or turn it off for the teams that handle the most sensitive data.

Shared drives deserve their own rules, because they hold team files that outlive any one employee. See Google Drive sharing settings that protect your data for a setting-by-setting walkthrough.

How do retention and eDiscovery work?

Retention and eDiscovery in Google Workspace run through Google Vault. Vault lets you set how long email, Drive files, Chat messages, and other supported data are kept, place legal holds, and search and export data when you need it. Vault is included in Business Plus and Enterprise editions, not in Business Starter or Business Standard.

Retention is a policy decision first and a technical setting second. Decide how long each type of record should be kept, with input from your compliance officer or counsel, and then build Vault rules to match. Read Google Vault retention and eDiscovery basics before you create your first rule, because a short retention rule can permanently delete data.

What happens to data when an employee leaves?

When an employee leaves, their account and data stay in Google Workspace until an administrator acts. A clean offboarding process cuts off access the same day, keeps the mail and files the business needs, and stops you paying for a license nobody uses.

The order matters. Reset the password and sign the user out first, then transfer files, route their mail, and only then delete or archive the account. Deleting too early can remove data you meant to keep, including data Vault was holding. Our guide to offboarding employees in Google Workspace gives you a step-by-step process.

Where should a small business start?

A small business should start with the controls that stop the most common attacks: 2-Step Verification, email authentication, and sensible sharing defaults. Those three changes take the least time and close the biggest gaps. After that, work through device management, third-party app access, retention, and offboarding.

Our Google Workspace security checklist for small businesses puts every step in one list, in priority order. Assign an owner to each item and set a date to review the list again in six months.

If you handle protected health information, or you would rather have experienced hands configure the account, our HIPAA setup service helps you review the BAA and put the settings in this guide in place, working alongside your compliance officer. Google Migrations is a service of Lingows, a Google Cloud Partner since 2013, and every managed migration includes 14 days of support after switchover.