HIPAA and Google Workspace
HIPAA compliant Google Workspace, configured correctly
Reviewed October 2026
Google Workspace can support HIPAA compliance. Google signs a Business Associate Agreement for covered services, and Gmail encrypts mail in transit with TLS. Compliance still depends on how your account is configured and how your team uses it. We handle the configuration, training, and annual reviews.
Foundations
What makes Google Workspace HIPAA-ready
- 01
A Business Associate Agreement. Google offers a BAA that an administrator reviews and accepts in the Admin console.
- 02
Covered services. Google's HIPAA included functionality covers core services such as Gmail, Calendar, Drive, Docs, Sheets, Slides, Forms, Meet, Chat, and Vault. Google updates this list, so we verify it against Google's current documentation during setup.
- 03
Encryption. Mail is encrypted in transit with TLS when the receiving server supports it, and data is encrypted at rest.
- 04
Configuration. Sharing limits, data access controls, and audit logging decide whether daily use stays compliant.
Service
What we set up
BAA and covered services
We confirm the BAA is accepted and turn off services that are not covered, so protected health information stays where it belongs.
Sharing and access controls
External sharing rules, Drive restrictions, 2-Step Verification, and admin roles set for least privilege.
Email security
SPF, DKIM, and DMARC records, plus TLS enforcement for partners you exchange patient data with.
Training
Staff guidance on what can and cannot be shared, and how to handle PHI in email and Drive.
Annual audits
A yearly review of settings and usage so configuration does not drift.
Getting started
Three ways to start
Not on Google Workspace yet
We migrate your data and configure HIPAA controls in one project.
Migration processAlready on Google Workspace
Move your subscription to us at the same price and we review your configuration.
Partner licensingNeed a configuration review only
We audit your current setup and give you a prioritized fix list.
Request a reviewHIPAA questions
Is Gmail HIPAA compliant?
Gmail can be used in a HIPAA compliant way when it is part of a Google Workspace account with an accepted BAA and correct configuration. Personal Gmail accounts are not covered.
Does the BAA make us compliant by itself?
No. The BAA covers Google's responsibilities. Your organization is still responsible for configuration, access control, staff training, and how protected health information is handled.
Which Google Workspace plan do healthcare teams need?
Any business or enterprise edition can sign the BAA. Many practices choose Business Plus for Vault, which supports retention and eDiscovery.
Related guides: Is Google Workspace HIPAA compliant? and How to review and accept the Google Workspace BAA.
This page is general information, not legal advice. Confirm your obligations with your compliance officer or counsel.
Get a HIPAA configuration review
Tell us about your practice or organization. We reply with next steps and a scope for the review.