Last verified: October 2026, against Google's HIPAA documentation and Google Meet Help. General information, not legal advice — confirm with your compliance officer or attorney.
Is Google Meet HIPAA compliant? For a practice on Google Workspace that has accepted Google's business associate agreement (BAA), yes: Meet is one of the covered services. On a personal Google account it isn't, because there is no BAA. The details that decide a safe video visit are guest access, where recordings land and whether AI note-taking is switched on.
Short answer (dated) from Google's HIPAA documentation
Short answer (verified October 2026): Google's HIPAA included functionality list (opens in a new tab) names "Google Meet" among the Workspace services covered by its BAA, with no conditions attached. Google's implementation guide (opens in a new tab) says Meet "supports HIPAA compliance," and Google's Workspace HIPAA help page (opens in a new tab) says customers who haven't signed a BAA "must not use PHI" in Workspace.
In short: Meet from a Workspace account under the BAA can carry protected health information (PHI) once configured. Meet from a clinician's personal Gmail account cannot, however convenient it is.
Workspace editions and the BAA
Google's HIPAA pages don't list which Workspace editions can accept the BAA. A super administrator accepts it in the Admin console; the steps are in our Google Workspace BAA guide.
Editions still matter for features. Google's recording article (opens in a new tab) lists recording on Business Standard, Business Plus, Enterprise and Essentials editions, among others. It also lists Google One plans with 2 TB or more. Google One is a subscription on a personal account, and Google ties its BAA to a Workspace agreement, so a recording made there isn't covered.
Two setup steps from Google's guide apply to Meet as much as to email:
- Put staff who handle PHI in their own organizational unit.
- Turn off services outside the included list for that unit, so a visit link doesn't end up in a tool the BAA doesn't reach.
Running a video visit in Meet: invites, guests, waiting
Patients don't need a Google account. Google's join article (opens in a new tab) says: "You can join a meeting without a Google Account, but the organizer or a participant needs to let you in." Your administrator controls whether signed-out guests may join, so confirm it's allowed before the first visit.
Google's Meet security page (opens in a new tab) says people who aren't on the calendar invite must ask to join ("knock"), and "Only the meeting host can admit participants not on the calendar invite." It also says Meet data is encrypted in transit by default.
A visit routine that follows those rules:
- Create one calendar event per visit and invite only the patient.
- Title it "Video visit" and mark it Private. Google's guide recommends private entries for anything with PHI, and external calendar sharing limited to free/busy.
- Turn on Host management in the event's video call options. Google's host controls article (opens in a new tab) says it's off by default and lets hosts remove people, moderate chat and lock audio or video.
- Admit only the name you expect. If someone else knocks, leave them out and call the patient.
- Keep meeting chat for logistics. Google's guide says chat disappears after the call unless the call is recorded.
Recordings, transcripts and AI notes
Recordings are saved to the organizer's Google Drive. Google says participants are notified when recording starts or stops. People in your organization who were invited can get access automatically, and Google's guide adds that chat is saved as a text file beside the recording. Transcripts also land in Drive and follow Drive's sharing permissions. Recordings in Drive are encrypted at rest by default.
So once a visit is recorded, it's a Drive file and Drive's rules apply: no public links, no PHI in titles, regular checks of external shares. The detail is in Gmail and Drive. Administrators can decide who may record at all, and most visits don't need it.
Gemini's "Take notes for me" (opens in a new tab) writes a Google Doc to the organizer's Drive and can share it with every invited guest, including people outside your practice. Meet notifies participants, and admins can require explicit consent, which is off by default. Google's list covers "Gemini in Google Workspace" but doesn't name this feature, and Google's Gemini data-protection page (opens in a new tab) doesn't mention HIPAA. Confirm coverage before using it in visits; see Gemini notes and HIPAA.
The patient side: joining from a browser or app
The patient taps the link, types a name and selects Ask to join. Dial-in by phone works only when a Workspace user organized the meeting, which a practice account is.
Illustrative example (fictional practice): "Your video visit with Riverside Family Clinic is Tuesday at 2:00 p.m. Open this link a few minutes early on a phone or computer with a camera, type your name and tap Ask to join. Your clinician will let you in. Please join from a private room."
Keep the message to time and link. Instructions about the visit's reason belong in your patient portal.
Comparing tools? See Zoom and HIPAA and Teams for video visits. Email, messaging and file checks are on the HIPAA-compliant email and messaging hub.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Medfy doesn't sell telehealth tools. For its own services, it signs a BAA with each practice, and patient information from website forms and chat is stored in separate, encrypted HIPAA databases in the US or Canada; see how Medfy handles patient data. A free marketing audit shows how your website and Google listing present virtual visits to new patients.
Frequently asked questions
Is Google Meet covered by Google's BAA?
Yes, when it's used from a Google Workspace account whose administrator has accepted Google's BAA. Google's HIPAA included functionality list names Google Meet with no conditions, and its implementation guide says Meet 'supports HIPAA compliance.' Meet on a personal Google account isn't covered, because the BAA attaches to a Workspace agreement. Confirm your edition and settings with your compliance officer or attorney.
Can patients join Google Meet without a Google account?
Yes. Google's help says people can join a meeting without a Google Account, but the organizer or a participant must let them in. The patient opens the link in a browser, types a name and clicks Ask to join. Your Workspace administrator controls whether signed-out guests can join at all, so check that setting before your first video visit.
Are Google Meet recordings HIPAA compliant?
They can be kept under the BAA, because they save to the organizer's Google Drive, which is also covered. That makes them ordinary Drive files: invited people in your organization may get access automatically, meeting chat is saved alongside, and your sharing rules apply. Decide whether visits need recording at all and limit who can record. Confirm the policy with your compliance officer or attorney.
Is free Google Meet safe for therapy sessions?
No. Free Meet runs on a personal Google account, and Google's BAA attaches to a Google Workspace agreement accepted by an administrator. Without a BAA, Google isn't your business associate for those sessions. A therapist who likes Meet can move to Workspace on the practice's own domain, accept the BAA and set up guest access first. Confirm the setup with your compliance officer or attorney.