Last verified: October 2026, against Google's HIPAA help page, included functionality list, BAA and implementation guide. General information, not legal advice — confirm with your compliance officer or attorney.
Is Google Workspace HIPAA compliant? Google Workspace can be used with patient information once an administrator accepts Google's business associate agreement (BAA) in the Admin console, and only in the services Google lists as covered. Free @gmail.com accounts can't get a BAA at all. Most small practices that run on Google have Workspace already; what they often haven't done is accept the BAA, or lock down the sharing and add-on settings that the BAA assumes.
Short answer from Google's HIPAA documentation
Short answer (verified October 2026): Google's HIPAA help page (opens in a new tab) says "Administrators must review and accept a BAA before using PHI in Google services" and "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services." PHI is allowed only in services on Google's HIPAA included functionality list (opens in a new tab), and "Third-party applications including add-ons are not included." Google's pages don't name which Workspace editions qualify.
The BAA itself (opens in a new tab) takes effect "as of the date electronically accepted by Customer," requires an existing Workspace or Cloud Identity agreement, and "does not apply to (a) any other Google product, service, or feature that is not a Covered Service."
Workspace vs free Gmail: why the account type matters
| Item | Free Google account (@gmail.com) | Google Workspace (your domain) |
|---|---|---|
| Owned by | An individual | Your practice |
| Admin console | No | Yes |
| BAA | No agreement to attach it to | Accepted by an administrator |
| Control when staff leave | None | Suspend the account, keep the data |
A front-desk inbox on a personal Gmail address, or a shared "practicename@gmail.com," can't be covered. Neither can a Google Form or Sheet created in one. Moving those to a practice-owned Workspace account is step one.
How to review and accept Google's BAA in the Admin console
Google's live help article is the authority here, and menu names change, so follow it as you go. As of October 2026 it describes:
- Sign in to the Google Admin console with a super administrator account.
- From the Admin console Home page, go to Account settings > Legal and compliance.
- Find the HIPAA Business Associate Addendum, read it, and accept it. Google says electronic acceptance has the same legal effect as a paper agreement.
- Take a dated screenshot of the acceptance in Legal and compliance. Google suggests this as your proof; file it with your other business associate agreements.
- Configure the services below before anyone puts PHI in them.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Covered services, and the ones that aren't
Google's Workspace list, exactly as published (last updated August 31, 2025): AppSheet; Cloud Identity Management; Gemini App (excluding Gemini in Google Chrome); Gemini in Google Workspace; Gemini Mac App; Gmail; Google Apps Script; Google Calendar; Google Chat; Google Cloud Search; Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides, and Google Vids); Google Groups; Google Keep; Google Meet; Google Sites; Google Tasks; Google Vault (if applicable); Google Voice (managed users only).
Google's implementation guide (opens in a new tab) adds what's not covered:
- Core services where PHI isn't permitted: Google Contacts.
- Other Google services such as YouTube and Blogger "must be disabled" for users who handle PHI, unless covered by a separate BAA. The guide also lists Google Photos here, which conflicts with the Drive entry above; keep PHI out of Photos until Google reconciles the two.
- Third-party Marketplace apps and add-ons, technical support conversations, and pre-release (pre-GA) features.
Gemini's place on this list has its own nuances; see Gemini in Workspace. Video visits are covered in Google Meet for telehealth.
Settings to lock down: sharing, devices, add-ons
- Separate PHI users. Put staff who handle PHI in their own organizational unit and turn off services outside the covered list for that unit, as the guide recommends.
- External sharing. Restrict sharing outside your domain and set new files to "Private to the owner."
- No PHI in file names. Google recommends keeping PHI out of file, folder and shared drive titles.
- Calendar. Share only free/busy information externally.
- 2-Step Verification. Enforce it under Security > Authentication > 2-step verification; Google's deployment guide (opens in a new tab) notes enforcement needs a super administrator.
- Phones and tablets. Require a screen lock and the ability to remove practice data from any device that opens Gmail or Drive.
- Add-ons and Drive apps. Disable third-party apps and Docs add-ons for PHI users, as the guide suggests.
- Retention. Use Google Vault if your edition includes it.
- Exposure reports. Periodically review which files are shared externally.
Gmail-specific settings, such as data loss prevention rules and Bcc for group emails, are covered in Gmail and HIPAA.
Google Forms, Sheets and Sites on a practice website
All three are on the covered list, and all three are easy to get wrong in public:
- Forms responses flow to a linked Sheet that collaborators can open. Details in Google Forms and HIPAA.
- Sheets often become an informal patient list. Keep them in shared drives with restricted membership.
- Sites can be published outside your domain. The guide says sites containing PHI should have limited editing access, shouldn't be published outside the domain, and must not run AdSense.
A public practice website built on Google Sites shouldn't contain PHI at all. Medfy's HIPAA-compliant forms are an alternative to emailing form data around: submissions go into a patient CRM and inbox, with patient information stored in separate, encrypted HIPAA databases in the US or Canada. See how Medfy handles patient data, run a free marketing audit, or check other tools in HIPAA-compliant software.
Frequently asked questions
Does Google sign a BAA for Workspace?
Yes. Google offers a HIPAA Business Associate Addendum to Workspace and Cloud Identity customers, accepted electronically by an administrator in the Admin console. It covers only the services on Google's HIPAA included functionality list, such as Gmail, Calendar, Drive, Meet and Gemini in Workspace. Google's pages don't name qualifying editions, so confirm yours, and have your compliance officer or attorney review the addendum.
Is a free @gmail.com account HIPAA compliant?
No. Google's BAA is an addendum to a Workspace or Cloud Identity agreement and is accepted in the Admin console, which a personal Gmail account doesn't have. Google says customers who haven't signed a BAA must not use PHI in its services. Move patient email to a practice-owned Workspace account with the BAA accepted, and ask your compliance officer about anything already sent.
Which Google services are not covered by the BAA?
Anything not on Google's HIPAA included functionality list. Google's implementation guide names Google Contacts as a core service where PHI isn't permitted, and says services such as YouTube and Blogger must be disabled for staff who handle PHI. Third-party add-ons and Google technical support are also outside the BAA. Review the live list before each change and confirm with your compliance officer.
Do we need the Google BAA if we only use Gmail?
Yes, if any email contains patient information, including appointment requests, referrals or form notifications. Gmail is on Google's covered list, but only after an administrator accepts the BAA. Without it, Google says not to use PHI in its services at all. Accepting it takes minutes; configuring Gmail and Drive properly takes longer. Confirm the setup with your compliance officer or attorney.