Is Google Cloud HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
Google offers a Cloud BAA, not open to modification, that covers its infrastructure and listed Covered Services and takes effect when the customer accepts it under an existing Services Agreement. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access.
| Plan or product | BAA |
|---|---|
| Customers buying through an unaffiliated Google Cloud reseller; the BAA says the reseller agreement governs instead | Not covered |
| Google Cloud customers with a Services Agreement who accept the BAA, for listed Covered Services | Covered |
What the BAA leaves out
- Any Google product, service or feature that is not a Covered Service
- PHI handled outside Covered Services, including third-party applications and on-premise tools
- Pre-GA offerings unless a notice or other terms say otherwise
- Third-party services and insecure API integration tools in Google SecOps and Looker (original)
- On-demand analyst support in Google SecOps
How to get the BAA
Google’s docs say to review and accept the BAA using its privacy compliance and records instructions; its compliance page says to talk to your account manager.
What the vendor says to do
- Review and accept the BAA
- Disable unsupported services when working with PHI, and avoid PHI in any you cannot disable
- Keep PHI and credentials out of resource metadata, labels, logs, alert settings and build files
- Configure and secure your environment under shared responsibility
Proof from the vendor
- GCP HIPAA BAAEffective on acceptance, Services Agreement needed, exclusions, reseller carve-out; last modified 22 September 2025
- HIPAA compliance on Google Cloud and Google WorkspaceCovered products, pre-GA and service-specific limits, customer duties
- HIPAA: ComplianceAccount manager route, BAA not subject to modification, customer responsibilities
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.