How to review and accept the Google Workspace BAA

What is a Business Associate Agreement?

A Business Associate Agreement (BAA) is a contract that HIPAA requires when a vendor creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity or another business associate. It sets out how the vendor protects that information and what happens if something goes wrong.

Google signs a BAA for the Google Workspace services it designates as covered. Personal Gmail accounts are not covered. The BAA is one part of a HIPAA program, not the whole thing. Compliance still depends on how you configure and use the account, as our Google Workspace security and HIPAA guide explains.

This article is general information, not legal advice. Confirm your obligations with your compliance officer or legal counsel.

Who should review the BAA before you accept it?

Your compliance officer or legal counsel should review the BAA before anyone accepts it. It is a legal agreement between your organization and Google, and the person who accepts it should have the authority to commit your organization.

When you review it, pay attention to:

• The list of services the BAA covers, which Google maintains separately and updates over time
• The responsibilities the agreement places on you as the customer
• How security incidents and breaches are reported
• What happens to the agreement and your data if you close the account

If you are not sure whether HIPAA applies to your organization at all, settle that question first. Is Google Workspace HIPAA compliant? covers the basics of who is responsible for what.

How do you accept the BAA in the Admin console?

You accept the BAA by signing in to the Admin console as an administrator with access to account settings, which usually means a super administrator, and opening the legal and compliance section of the account settings. From there, Google shows the HIPAA BAA and the prompts to review and accept it.

1. Sign in to the Admin console with a super administrator account.
2. Open the account settings and find the legal and compliance section.
3. Locate the HIPAA Business Associate Agreement, review it, and follow the prompts to accept.
4. Record who accepted it and when, and save a copy with your compliance records.

Google changes Admin console menus from time to time. If the path above does not match what you see, search the Admin console or Google's help center for the BAA.

What should you do right after accepting?

Right after accepting, configure the account so PHI stays inside covered services and behind strong access controls. The BAA does not change any settings on its own.

• Decide which covered services your team will use with PHI, and turn off services that are not covered for those users.
• Review third-party apps connected to your account. Marketplace apps are not covered by Google's BAA, so any app that handles PHI needs its own agreement with that vendor.
• Enforce 2-Step Verification. See rolling out 2-Step Verification without the help desk chaos.
• Tighten external sharing using Google Drive sharing settings that protect your data.
• Decide how PHI is sent by email. Is Gmail encrypted? explains what Gmail protects by default.

What if you are migrating from another platform?

If you are migrating, accept the BAA before any mail or files containing PHI move into Google Workspace. Migration copies data into the account, so the agreement and your core settings should be in place before the first batch runs.

Ask any partner involved in the move how they handle PHI and whether they will sign a BAA with you. Add the BAA review to your project plan using our Google Workspace migration checklist, so it is done before data starts moving rather than after.

Next step

If you want help reviewing the BAA and setting up the account around it, see our HIPAA setup service or contact us.