Last verified: October 2026, against Google's HIPAA covered-services list, Workspace Admin Help and Google Voice Help. General information, not legal advice — confirm with your compliance officer or attorney.
Is Google Voice HIPAA compliant? Only in one form: Google Voice for Google Workspace, for licensed users in an organization that has accepted Google's business associate agreement (BAA). The Google Voice number tied to a personal Google Account has no BAA with your practice and shouldn't carry patient calls, voicemails or texts.
Is Google Voice HIPAA compliant? Google's own answer
Short answer (verified October 2026): Google's HIPAA covered-services list (opens in a new tab) includes "Google Voice (managed users only)" among the Google Workspace services in its BAA. Google's HIPAA implementation guide (opens in a new tab) says "Licensed users of Google Voice are covered under the Google Workspace BAA" and "Administrators should obtain Google Voice licenses for users that handle PHI." Google's Workspace HIPAA page (opens in a new tab) says "Administrators must review and accept a BAA before using PHI in Google services."
There is no standalone Google Voice BAA. Voice rides on your Workspace agreement, which a super administrator accepts in the Admin console under Account settings, then Legal and compliance.
Practice managers ask this a lot: "is google voice hipaa compliant" gets about 720 searches a month in the US, at a CPC of $41.96 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What HIPAA requires before patient information goes in
Under 45 CFR 164.502(e) (opens in a new tab), a practice may let a vendor "create, receive, maintain, or transmit protected health information on its behalf" only after getting "satisfactory assurance" that it will safeguard the information. Those assurances "must be documented through a written contract" that meets 45 CFR 164.504(e) (opens in a new tab). That contract is the BAA.
A phone service can't dodge this by calling itself a pipe. HHS's cloud computing guidance (opens in a new tab) says the "conduit" exception "is limited to transmission-only services for PHI." Google Voice keeps voicemails, transcripts and texts in your account, so Google is a business associate for that data.
A BAA alone doesn't make you compliant. Google lists the customer's own duties throughout its guide, and third-party add-ons aren't covered. For what the contract should contain, see business associate agreements.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Which Google Voice plans a BAA can cover
Google sells Voice as an add-on: every plan's sign-up reads "Add Voice to a Google Workspace plan" (Google Voice (opens in a new tab)).
| Version | Price shown (per user/month) | Covered by Google's BAA? |
|---|---|---|
| Personal Google Voice (personal Google Account) | Not a Workspace plan | No: not a managed user |
| Voice Starter (up to 10 users) | $10 | Yes, for licensed managed users, once the Workspace BAA is accepted |
| Voice Standard | $20 | Same |
| Voice Premier | $30 | Same |
The BAA follows the user, not the phone number. Google's admin FAQ says you can "migrate existing users to managed accounts," and an admin can turn Voice on or off per organizational unit, which "Requires the Google Voice Admin role" (Turn Google Voice on or off (opens in a new tab)). Give Voice only to staff who need it, and remove it when they leave. Our google workspace guide covers the rest of the account.
Texting and voicemail: where PHI ends up
Every feature that stores something creates a copy to manage:
- Texts. Google says "Voice currently supports SMS messages only in the U.S." (Voice FAQ (opens in a new tab)). Once a text reaches the patient's phone, it's outside any agreement you have with Google. For what to put in a text, see our texting guide.
- Voicemail by email. The setting "Get voicemail via email" sends voicemails to the user's inbox (Google Voice Help (opens in a new tab)). That's fine when the inbox is covered Workspace Gmail. It isn't when someone forwards to a personal address.
- Transcripts. Starter includes voicemail transcription, so a patient's spoken message becomes searchable text.
- Recordings. Standard offers on-demand recording and Premier automatic recording. Record only with a reason and a retention rule.
- Meet dial-outs. Google's guide warns that Voice users "will see Meet meeting names displayed on their devices" when dialed from a meeting. Don't put patient names in meeting titles.
Safe uses and unsafe uses for a practice
| Use | Personal Google Voice | Voice for Workspace, BAA accepted |
|---|---|---|
| Vendor and recruiting calls | Fine | Fine |
| Appointment reminders by text | No | Yes, with minimal content |
| Patients leaving symptoms on voicemail | No | Yes; manage email forwarding |
| Sending results by text | No | Avoid; use the portal |
| A clinician's "work number" on a personal phone | No | Yes, if the phone is secured |
The quiet failure is drift. A personal Voice number set up for a marketing campaign ends up printed on a flyer, and patients start texting it. Audit every number your practice publishes.
Safer setup or alternatives
- Accept the Workspace BAA first. Then license Voice only for staff who handle patient calls.
- Retire personal Voice numbers that patients use, or migrate those users to managed accounts.
- Restrict voicemail forwarding to covered practice inboxes.
- Write a texting rule: logistics only, no diagnoses or results.
- Separate tracking numbers. If you use a Google Voice number to track an ad campaign, keep it on a covered account or keep patients from replying to it.
If you'd rather not run patient conversations through Voice at all, use your EHR's patient messaging, or a business phone system whose vendor signs a BAA for voice and texting. The hub page on HIPAA and everyday tools covers the other tools a practice uses.
Medfy doesn't sell phone or texting tools. The patient information it does hold arrives through your website: form and chat submissions are stored in separate, encrypted HIPAA databases in the US or Canada, under a BAA Medfy signs with each practice for its own services (how Medfy handles patient data). A free marketing audit scores your Google listing alongside your website, SEO and ads, and flags privacy risks such as pixels on patient forms.
Frequently asked questions
Will Google Voice sign a BAA?
Google doesn't sign a separate Google Voice BAA. As of October 2026, Google lists "Google Voice (managed users only)" among the Workspace services included in its BAA, and its implementation guide says licensed Voice users are covered. A super administrator accepts that BAA in the Admin console under Account settings, then Legal and compliance. Accept it before any patient calls or texts go through Voice, and confirm the setup with your compliance officer or attorney.
Is the free version of Google Voice HIPAA compliant?
No. The Google Voice number many people add to a personal Google Account isn't a managed user, and Google's BAA covers Google Voice for managed users only. There's no BAA between your practice and Google for a personal account, so patient calls, voicemails and texts on it sit outside HIPAA's contract requirement. Move practice lines to Google Voice for Google Workspace and accept the BAA first.
Can a practice use Google Voice without patient information?
Yes. A personal or uncovered Google Voice number is fine for calls that never involve patients, such as vendors, recruiting or a marketing tracking line. The risk is drift: a patient finds the number and calls or texts it. Put the number nowhere patients will see it, keep voicemail greetings generic, and move the line to a covered account if patients start using it.
What is a HIPAA-compliant alternative to Google Voice?
The closest one is Google Voice itself on a Google Workspace subscription, with the BAA accepted and Voice licenses for every user who handles patient calls. Other options are your EHR's patient messaging or a business phone system whose vendor signs a BAA covering voice, voicemail and texting. Whichever you choose, check the vendor's own BAA terms and confirm the setup with your compliance officer.