Is Google Chat HIPAA compliant?

Google Chat can carry protected health information (PHI) only under certain conditions. The practice must use a Google Workspace account, on an edition eligible for Google's Business Associate Agreement (BAA). The organization must have reviewed and accepted that BAA, and Chat must be on the list of services the BAA covers. Google Chat is named on Google's HIPAA Included Functionality list (dated "As of August 31, 2026") (workspace.google.com). A personal Gmail account has no BAA, so PHI does not belong there. Even with the BAA in place, your practice still owns the configuration, the access controls and the staff rules.

Short answer: Google Chat and HIPAA

Whether Google Chat is acceptable for PHI depends on four conditions:

• Account type. A managed Google Workspace account can be covered. A consumer Google account cannot. Google offers its BAA only to Google Workspace and Cloud Identity organizations, and only an admin can accept it in the Admin console, so a personal Google account cannot accept it (knowledge.workspace.google.com).
• Edition. Not every Workspace edition can accept the BAA. Google publishes no list of eligible editions: an admin of any Google Workspace or Cloud Identity account can accept it, and Google names only the legacy free edition (sometimes called Google Apps Standard Edition) as unable to accept it (knowledge.workspace.google.com).
• An accepted BAA. A super admin has to accept it for the organization. It does not apply automatically.
• Admin configuration. Services the BAA does not cover, third-party apps and external chat all need to be restricted.

No software is "HIPAA compliant" by itself, and HIPAA has no official certification for tools. Under HIPAA, a vendor that creates, receives, maintains or transmits PHI for your practice is a business associate and needs a BAA. 45 CFR 160.103 defines a business associate, and 45 CFR 164.502(e) and 164.504(e) require a written contract with it (ecfr.gov). The BAA is required, but it is only the starting point. Configuration, policies and training make up the rest.

Account type	BAA available?	OK for PHI?
Personal Gmail / consumer Google account	No (knowledge.workspace.google.com)	No
Google Workspace, BAA not accepted	Not in effect	No
Google Workspace, eligible edition, BAA accepted and configured	Yes (Workspace or Cloud Identity account, not the legacy free edition; Chat and Meet are on the covered list) (workspace.google.com)	Yes, for covered services, with policies and training

To see how other staff chat tools handle the same question, see team chat tools compared for HIPAA.

What the Google Workspace BAA covers, and what it doesn't

Covered services. Google publishes a list of Workspace functionality included under its BAA at https://workspace.google.com/terms/2015/1/hipaa_functionality/ (dated "As of August 31, 2026"). The BAA defines its covered services by reference to that list, and Google must give 12 months' notice before removing a service (workspace.google.com). Before you approve Chat for PHI, have your IT lead confirm that Google Chat and Google Meet are still named on the current list. Do not assume a service is covered because it is part of your Workspace subscription.

Eligible editions. Not every edition can accept the BAA. Google names only one edition that cannot accept it: the legacy free edition (sometimes called Google Apps Standard Edition). Any other Google Workspace or Cloud Identity account can accept it through an admin (knowledge.workspace.google.com). If your practice started on a small or legacy plan, check eligibility before anyone sends a patient name in Chat.

Common exclusions. The BAA does not extend to third-party applications, including Chat apps and Marketplace add-ons; any Google service not on the included functionality list; Additional Google Services such as YouTube, Blogger and Google Photos, which must be turned off for users who handle PHI; or Gemini in Chrome (knowledge.workspace.google.com). In practice, that means:

• Third-party Chat apps and bots. A scheduling bot added to the front-desk space is a separate vendor. It needs its own BAA if it touches PHI.
• Google Workspace Marketplace add-ons.
• Google services outside the core Workspace list.

AI features (Gemini). Coverage of Gemini for Google Workspace under the BAA, and any conditions attached to it, must be confirmed against Google's current terms. As of August 31, 2026, Google's covered list includes Gemini in Workspace, the Gemini app (excluding Gemini in Chrome) and the Gemini Mac App, though some Gemini app features may be blocked for organizations that signed the BAA (workspace.google.com). Until your admin has confirmed coverage in writing, keep AI features turned off for staff who handle PHI.

How the BAA is accepted. Google's BAA is accepted in the Admin console by a super admin. The path is Account > Account settings > Legal and compliance > Security and Privacy Additional Terms > "Google Workspace/Cloud Identity HIPAA Business Associate Amendment" > Review and Accept, where the admin answers three questions and clicks OK; Google suggests a screenshot of the acceptance as your record (knowledge.workspace.google.com). Keep a copy of the accepted agreement with your HIPAA records.

How to set up Google Chat for PHI: an admin checklist

1. Confirm the BAA is accepted. Record the acceptance date, the admin who accepted it, and where the signed copy is stored. Your privacy officer will need this during a risk assessment or audit.
2. Turn off or restrict non-covered services. Disable services that are not on the covered list for the organizational units that handle PHI. In the Admin console, go to Apps > Google Workspace > Service status and set each service to "Off for everyone" (or on), per organizational unit or access group (support.google.com).
3. Restrict third-party Chat apps. Allowlist only approved apps, or block installation entirely. In Chat settings, use "Allow users to install Chat apps" to block installs; to allowlist specific apps, use the Google Workspace Marketplace allow/block settings (services.google.com).
4. Set retention. Configure Google Vault or Chat retention rules to match your record retention policy. Vault is included in Business Plus, Enterprise Standard and Plus, Frontline Standard and Plus, Enterprise Essentials and Essentials Plus (domain-verified only), all Education editions and legacy G Suite Business; other editions need add-on licenses, and since November 1, 2025 Vault admins also need a Vault license (knowledge.workspace.google.com). Decide how long a front-desk thread about a referral should stay searchable, and document the decision.
5. Control external chat. Decide whether staff can chat with people outside your domain. Set rules for guests and space sharing. Under Apps > Google Workspace > Google Chat, turn off "Allow users to send messages outside your organization" (settable per organizational unit) and "Allow users to create & join spaces & group direct messages with people outside their organization" (organization-wide) (support.google.com). For example, a billing contractor should not be able to join the space where medical assistants coordinate prior authorizations.
6. Enforce 2-step verification. Make it mandatory for all users, not optional.
7. Manage mobile devices. Front desk and clinical support staff often check Chat on phones. Require device management for any phone that can access Workspace data.
8. Write an offboarding procedure. When a staff member leaves, suspend the account, revoke mobile access and transfer ownership of spaces and files on their last day.

Where practices still carry the risk

The BAA covers Google's side. Most HIPAA exposure in staff chat comes from how people use the tool.

• Personal accounts and unmanaged phones. A medical assistant logs in to Chat with a personal Gmail account to message a coworker about a patient's lab result. That conversation falls outside your BAA. The same risk applies when staff drift to texting or consumer apps. See personal messaging apps and HIPAA. For WhatsApp specifically, see Is WhatsApp HIPAA compliant?.
• External participants in spaces. Someone pastes a patient's name and date of birth into a space that includes an outside vendor or an IT contractor.
• Non-covered apps. Someone shares PHI through a bot or add-on that has no BAA.
• No minimum-necessary rules or training. Staff need to know what they may post, for example "Room 3 patient needs a ride home" rather than a full name and diagnosis. They also need to know where clinical details belong.
• Using chat as a clinical system. Google Chat is not an EHR, a clinical alerting tool or a patient messaging channel. Clinical documentation stays in the EHR, and urgent clinical escalation follows your clinical protocols.

This is the shared-responsibility model. The vendor secures the platform, and the practice secures use, access, devices and training.

When Google Chat is a good fit

Google Chat is a reasonable choice when:

• The practice is already standardized on Google Workspace, with email, calendar and Drive under one BAA. Gmail, Google Calendar and Google Drive are all on Google's included functionality list (workspace.google.com).
• Admin or IT staff are comfortable managing the Workspace Admin console, organizational units and Vault.
• The team mainly needs chat and Meet calls. Task tracking is light or happens in another system.

Adding a second chat tool in that situation creates another place for PHI to live and another BAA to manage. Practices standardized on Microsoft 365 face the same decision, covered in Is Microsoft Teams HIPAA compliant?. If you are weighing Slack, see Slack and HIPAA.

When a dedicated staff chat tool may fit better: Chanty

A separate staff chat tool makes sense when the practice isn't on Workspace. It also makes sense when front desk and deskless staff need a simple, WhatsApp-like app they can use with little training.

Chanty brings staff chats, voice and video calls, announcements, files and assigned tasks into one workspace. Any message can become a task with an owner and a due date, and tasks are tracked on a built-in Kanban board. For example, "Fax the updated insurance card to the imaging center" can be assigned to the front-desk lead and due Thursday, instead of getting lost in the thread. Apps are available for iOS, Android, macOS, Windows and web.

Compliance, stated precisely: HIPAA with a signed BAA is available on the Business and Enterprise plans. The Enterprise BAA comes with a negotiated MSA. The Free plan has no BAA, so staff should not store PHI on it. Chanty does not make a practice compliant by itself. Your team still configures roles, manages access and offboarding, secures devices, and trains staff. More on this: HIPAA-compliant chat for staff.

Controls on Business:

• Customizable roles and permissions (120+ settings).
• Customizable retention.
• 2FA, SSO and IP allowlisting.
• Guest access limited to selected conversations.

SAML SSO, directory sync, SCIM and data residency (US, EU or APAC) are available on Enterprise.

Honest limits:

• Integrations. The native integration catalog is smaller than on larger platforms. Third-party integrations, including Google Drive and Google Calendar, sit outside Chanty's BAA scope.
• Task management. Tasks are basic (list and Kanban) and not built for complex projects.
• AI agents. These are available on Enterprise only. BAA coverage of agent processing and external models is not documented.

Chanty is for internal staff coordination. It is not patient messaging, telehealth, an EHR or clinical alerting.

Google Chat vs Chanty for HIPAA: side-by-side

	Google Chat (Google Workspace)	Chanty
BAA availability by plan	Workspace or Cloud Identity accounts after BAA acceptance (not the legacy free edition; source: Google HIPAA Included Functionality list and BAA acceptance help page; checked Oct 19, 2026) (workspace.google.com)	Business and Enterprise (Enterprise adds a negotiated MSA)
Free / consumer tier for PHI	Consumer Google accounts not suitable (Google offers its BAA only to Workspace and Cloud Identity organizations; source: Google BAA and acceptance help page; checked Oct 19, 2026) (workspace.google.com)	Free plan has no BAA; not for PHI
Chat, calls and tasks in one app	Chat and Meet within Workspace (Google Meet and Google Tasks are both on Google's covered list; source: HIPAA Included Functionality list; checked Oct 19, 2026) (workspace.google.com)	Chats, voice and video calls, announcements, files, tasks and Kanban in one app
Guest and external access controls	External chat and space-sharing settings (Service status per organizational unit; "Allow users to install Chat apps"; External Chat settings; source: Google Workspace Admin Help; checked Oct 19, 2026) (support.google.com)	Guests limited to selected conversations; 3 free guest seats per paid member on Business
Retention	Google Vault, by edition (Vault included in Business Plus, Enterprise, Frontline and Education editions, add-on licenses for others; source: Google Vault overview; checked Oct 19, 2026) (knowledge.workspace.google.com)	Customizable retention on Business and Enterprise
SSO / SCIM	Identity and provisioning options depend on the edition; confirm them in Google's Admin Help for your edition	SSO on Business; SAML SSO, directory sync and SCIM on Enterprise
Encryption	Encrypted in transit and at rest (source: Google Chat Help; checked Oct 19, 2026) (support.google.com)	Encrypted in transit (TLS 1.2+) and encrypted file storage
Pricing	Varies by edition; check Google's current Workspace pricing for your edition	Business and Enterprise plans; check current pricing at chanty.com

Neither tool makes a practice HIPAA compliant on its own. Compliance depends on the BAA, configuration, policies and staff training.

For BAA terms and certifications, see Chanty security, HIPAA and BAA details. To try Chanty, sign up and sign the BAA on the Business plan before anyone handles PHI. To check other software your practice uses, see other popular tools checked for HIPAA.

FAQ

Is Google Chat HIPAA compliant with a free Gmail account?

No. Personal and consumer Google accounts are not covered by Google's BAA. Google offers its BAA only to Google Workspace and Cloud Identity organizations, through an admin in the Admin console (knowledge.workspace.google.com). Staff should not discuss PHI in Chat on a personal account.

Does the Google Workspace BAA cover Google Chat?

Google Chat is named on Google's current list of included functionality at https://workspace.google.com/terms/2015/1/hipaa_functionality/ (dated "As of August 31, 2026") (workspace.google.com). Coverage applies only after your organization accepts the BAA on an eligible edition, meaning any Google Workspace or Cloud Identity account except the legacy free edition.

Which Google Workspace plans can sign a BAA?

Google publishes no list of eligible editions: an admin of any Google Workspace or Cloud Identity account can accept the BAA, and only the legacy free edition is excluded (knowledge.workspace.google.com). Check your current edition in the Admin console before relying on the BAA.

Are Google Chat apps and bots covered by Google's BAA?

Generally, third-party Chat apps, bots and Marketplace add-ons fall outside Google's BAA. Google's HIPAA FAQ states that third-party applications, including add-ons, are not included in the covered functionality (knowledge.workspace.google.com). Any app that touches PHI needs its own BAA with that vendor.

Can we use Google Meet for staff calls that involve PHI?

Only if Meet appears on Google's current list of covered services and your BAA is accepted. Google Meet is named on the current list (as of August 31, 2026), and Google's implementation guide says Meet supports HIPAA compliance (workspace.google.com). Apply the same minimum-necessary rules you use in chat.

Is Gemini in Google Chat covered by the BAA?

Check Google's current terms. As of August 31, 2026, Gemini in Workspace, the Gemini app (excluding Gemini in Chrome) and the Gemini Mac App are on Google's covered list, though some Gemini app features may be blocked for organizations that signed the BAA (workspace.google.com). Until coverage is confirmed in writing, keep Gemini turned off for users who handle PHI.

Is Google Chat end-to-end encrypted?

Google says Chat data is encrypted in transit and at rest and does not describe standard Chat as end-to-end encrypted (support.google.com). Do not describe it as end-to-end encrypted unless Google says so for the feature you use.

Does Chanty sign a BAA, and on which plan?

Yes. A signed BAA is available on the Business and Enterprise plans, and Enterprise also includes a negotiated MSA. The Free plan has no BAA and should not be used for PHI. See sign up to start on the Business plan.