Is Google Workspace HIPAA compliant out of the box?
No. Google Workspace is not HIPAA compliant out of the box, and no cloud service is. HIPAA applies to organizations, specifically covered entities and their business associates, not to software products. There is no official HIPAA certification for an app or a cloud service.
What Google Workspace offers is a platform that can support HIPAA compliance. Google provides security controls, encryption, audit logs, and a Business Associate Agreement (BAA). Your organization turns those into compliance through configuration, policies, and everyday habits.
This article is general information, not legal advice. Your obligations depend on your role, your data, and the laws that apply to you, so confirm them with your compliance officer or legal counsel. For the wider picture, see our Google Workspace security and HIPAA guide.
What does Google's Business Associate Agreement cover?
Google's BAA covers a specific list of Google Workspace services that Google designates for use with protected health information (PHI). Google publishes that list and updates it over time, so check the current version before you decide which apps your team can use with PHI.
A few points are worth knowing:
- The BAA applies to your Google Workspace account, not to personal Gmail accounts.
- Google's guidance is to keep PHI out of services that are not covered. Many organizations turn those services off for the people who handle PHI.
- Third-party apps and add-ons from the Google Workspace Marketplace are not covered by Google's BAA. If one of them touches PHI, you need a separate agreement with that vendor.
- An administrator reviews and accepts the BAA in the Admin console. Our guide on how to review and accept the Google Workspace BAA walks through it.
What are you responsible for?
You are responsible for everything on your side of the account: who can access PHI, how they sign in, what they share, and how long you keep records. Google describes this as shared responsibility, and HIPAA places the duty to put safeguards in place on your organization.
Typical responsibilities include:
- Performing and documenting a risk analysis
- Enforcing 2-Step Verification for every user
- Restricting Drive sharing for the teams that handle PHI
- Deciding how PHI is sent by email, and whether you need added encryption
- Setting retention rules and keeping audit logs available
- Training staff, and removing access promptly when people leave
Google publishes a HIPAA implementation guide for Google Workspace. It is a useful starting point for your configuration review, and your compliance officer can map it to your own policies.
Which Google Workspace edition works best for HIPAA?
The edition that works best is one that offers the BAA and includes the tools your policies require. Confirm in the Admin console that the BAA is available for your account before you commit, because editions also differ in what they include.
Business Plus is often a better fit than Business Starter or Business Standard because it adds Google Vault for retention and eDiscovery. If you need to keep records for set periods or respond to legal requests, read Google Vault retention and eDiscovery basics and compare Business Standard vs Business Plus. Business editions are capped at 300 users, so larger organizations look at Enterprise editions.
How do you get started?
Start by accepting the BAA before any PHI enters the account, then lock down the settings that matter most. A practical order looks like this:
- Review the BAA with your compliance officer or counsel, then accept it in the Admin console.
- Decide which services your team will use with PHI, and turn off services that are not covered for those users.
- Enforce 2-Step Verification for everyone.
- Set Drive sharing rules and publish SPF, DKIM, and DMARC records.
- Configure retention, and document every setting as part of your risk analysis.
Our Google Workspace security checklist for small businesses covers the rest of the settings in priority order.
Next step
Our HIPAA setup service helps you review the BAA and configure these settings alongside your compliance officer. If you have questions first, contact us.
Frequently asked questions
Does signing the BAA make us HIPAA compliant?
No. Accepting the BAA is a required step before you use Google Workspace with protected health information, but it does not change any settings. Compliance depends on your configuration, policies, training, and risk analysis. Confirm your obligations with your compliance officer or counsel.
Can we email patients from Google Workspace?
You can, but how you do it matters. Gmail uses TLS when the receiving server supports it, which protects messages in transit but is not end-to-end encryption. Many practices add an encryption tool or a patient portal. Confirm your approach with your compliance officer.
Are personal Gmail accounts ever acceptable for PHI?
No. Google's BAA does not cover personal Gmail accounts. Staff should never use personal Gmail, or any personal account, to send or store protected health information. Use accounts in your organization's Google Workspace with the BAA accepted.
