G
On some plansIs Google Workspace HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
Google offers a BAA for Workspace that a super administrator accepts in the Admin console, covering services on its HIPAA Included Functionality list. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Customers who have not signed a BAA, who Google says must not use PHI in these services | Not covered |
| Legacy free Google Apps Standard Edition, whose users Google says cannot accept a BAA | Not covered |
| Google Workspace customers whose super admin has accepted the BAA (Google’s HIPAA page names no specific editions) | Covered |
What the BAA leaves out
- Gemini in Chrome, and Gemini as an Additional Product
- Google Contacts, which Google’s guide says may not hold PHI
- Additional Google Services such as YouTube and Blogger, which must be off for PHI users unless under a separate BAA. Google’s guide also lists Photos, but its October 2026 list covers Photos under Drive
- Third-party apps and add-ons
- Pre-GA offerings
- Google Voice for users other than managed users
How to get the BAA
From a super administrator account, open the Admin console and go to Account settings, then Legal and compliance, to review and accept the BAA.
What the vendor says to do
- A super admin accepts the BAA in the Admin console under Account settings, Legal and compliance
- Disable non-covered services for users handling PHI
- Set Drive sharing defaults to restrict external sharing and default visibility to private
- Keep PHI out of file, folder and shared drive names
- Review third-party apps and consider disabling them
- Avoid sharing PHI with technical support
Proof from the vendor
- HIPAA Compliance with Google Workspace and Cloud IdentityBAA acceptance steps, no PHI without a BAA, third-party and Additional Services exclusions
- HIPAA compliance on Google Cloud and Google WorkspaceList of covered Workspace services and Gemini scope
- Google Workspace and Cloud Identity HIPAA Implementation GuideSetup recommendations and service warnings
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.