Is Google Workspace HIPAA Compliant? Gmail, Drive, Docs, Meet and More

Google Workspace can be used with protected health information (PHI) if three things are true: the practice is on an eligible paid Workspace edition, an authorized person has accepted Google's Business Associate Agreement (BAA), and PHI stays inside the services that BAA covers and that the practice has configured correctly. Free @gmail.com accounts, Google Analytics and consumer tools like Google Translate are a different matter. This page checks each popular Google tool against that test. Every vendor fact is marked for verification against Google's current documents. This is general information, not legal advice. Confirm decisions with your privacy officer or counsel.

Short answer: Google can support HIPAA, but only under a BAA and the right setup

Paid Google Workspace can hold PHI once the organization accepts Google's BAA and limits PHI to covered services, as described in Google's current HIPAA documentation. Outside those conditions, Google is not acting as your business associate, and PHI should not go into the service.

Free consumer Gmail and personal Google accounts are not covered by a BAA. They should not hold PHI, and no setting changes that.

HIPAA has no certification program, so no tool is "HIPAA certified." A product can support HIPAA compliance. Whether your practice is compliant depends on the BAA, how you configure the tools, your written policies, your risk analysis and how well staff are trained.

Google service	Covered by BAA?	Plan required	Main caveat
Gmail	Yes, when listed as a covered service	Eligible paid Workspace edition with accepted BAA	Default TLS depends on the recipient's server; auto-forwarding to personal accounts
Google Drive	Generally yes; confirm on Google's current list	Eligible edition with BAA	Link sharing and external sharing settings
Google Docs	Generally yes; confirm on Google's current list	Eligible edition with BAA	Inherits Drive sharing; add-ons are not covered
Google Sheets	Generally yes; confirm on Google's current list	Eligible edition with BAA	Patient trackers need access review and audit logs
Google Meet	Generally yes; check feature exclusions	Eligible edition with BAA	Recordings, transcripts and captions may be treated differently
Google Calendar	Generally yes; confirm on Google's current list	Eligible edition with BAA	PHI in event titles is visible on shared and delegated calendars
Google Chat	Check Google's current covered-services list	Eligible edition with BAA	Confirm status before staff rely on it
Google Analytics (GA4)	No	Not applicable	Tracking on patient-facing pages can disclose PHI
Google Translate	Not a standard covered service; confirm with Google	Not applicable	Pasted patient text leaves your covered environment
Consumer Gmail (@gmail.com)	No	Not available	Cannot be brought under a BAA

For other vendors staff commonly ask about, see more HIPAA tool checks.

Which Google Workspace plans are HIPAA eligible and how the BAA works

Eligible editions. Google decides which Workspace editions can accept its BAA. Check the current list before you choose or downgrade a plan, especially for Business Starter, Business Standard, Business Plus, Enterprise, Education and Nonprofit editions. A practice that runs one location on Business Starter and another on a different edition should confirm both.

Accepting the BAA. A super administrator reviews and accepts the BAA in the Google Admin console. The IT manager or MSP usually clicks the button. The decision belongs to someone with authority to bind the practice, typically the privacy officer, owner or counsel. Record who accepted it, when and which version they accepted.

Covered services. The BAA applies only to the services Google lists as covered. If a service is not on the list, the BAA does not protect PHI you put into it, even if you pay for that service as part of your plan. The list changes as Google adds or retires products, so review it at least once a year and whenever Google announces a new feature your staff want to use.

Cost. Workspace pricing is per user per month and varies by edition and billing term. Check whether accepting the BAA costs anything extra on eligible editions. The larger cost is often the edition upgrade itself, if your current edition lacks features you need, such as audit logs or Vault.

G Suite and older answers. G Suite was renamed Google Workspace. Searches for "is G Suite HIPAA compliant" refer to the same product family. Year-stamped answers from 2016, 2021 or 2022 may describe editions, features or covered services that have since changed. Use Google's current documents, not old forum threads.

If your practice is weighing suites, the same test applies to Microsoft 365 and HIPAA.

Is Gmail HIPAA compliant?

Gmail on an eligible Workspace edition with an accepted BAA can be used for email that contains PHI, provided Gmail is on Google's current covered-services list. A consumer @gmail.com account cannot, even if a solo practitioner uses it only for work.

Encryption in transit. Gmail uses TLS by default when the receiving mail server supports it. If the other side does not support TLS, the message may be delivered without that encryption. In practice:

• Internal staff email stays within your Workspace domain and is the lowest-risk use.
• Email to partner offices, such as a referral coordinator writing to a specialist's office or a billing team writing to a clearinghouse, depends on the other domain. Admins can often require secure transport for specific domains, depending on edition.
• Email to patients goes to whatever provider the patient uses. Additional options such as S/MIME or client-side encryption depend on your edition.

Confidential mode. Confidential mode lets the sender set an expiration date, revoke access, and block forwarding, copying, printing and downloading. It is not encryption and it does not satisfy HIPAA on its own. Recipients can still take screenshots or photos of the screen, and the setting does nothing about who can access the sending account. Treat it as a convenience, not as a safeguard you can document in your risk analysis.

Sending PHI from Gmail. A workable approach for a clinic looks like this:

• Include the minimum necessary information. Use "Your lab results are ready in the portal" rather than the results themselves.
• Verify the recipient address before sending, especially with autocomplete. Most misdirected emails come from picking the wrong contact.
• Enforce settings at the admin level rather than relying on each staff member's habits.
• Write a patient-communication policy covering when email is allowed, what patients are told about the risks, and how their preference is recorded.

Common Gmail risks in practices:

• Staff set up auto-forwarding from work mail to a personal account so they can read it at home.
• The front desk shares one login, which breaks access tracking and offboarding.
• Staff read work mail on personal phones that are not managed, with no screen lock and no way to wipe the account if the phone is lost.

Google Drive, Docs and Sheets with PHI

Drive, Docs and Sheets are generally treated as covered services on eligible editions under the BAA; confirm each on Google's current list. The risk is rarely the service itself. It is how files get shared.

Sharing settings to control:

• "Anyone with the link." A link-shared intake spreadsheet pasted into an email or a text can be opened by anyone who receives it. Admins can restrict or disable this option for the organization or for specific groups.
• External sharing. Decide whether staff may share outside your domain at all, and if so, whether only with allowlisted domains such as your billing company.
• Files owned by departed staff. When a medical assistant who owned the "Prior auth follow-ups" folder leaves, transfer ownership before deleting the account. Better still, keep shared working files in shared drives owned by the organization, if your edition includes them.

Spreadsheets as patient trackers. Many practices run referral queues, recall lists or outstanding-claims trackers in Sheets. That can work under the BAA if you:

• limit edit and view access to the people who need it,
• use version history to see and reverse changes, and
• review Drive audit logs for unusual access or downloads, where your edition provides them.

A tracker shared with "everyone at the practice" because it was easier is a common finding in a risk analysis.

Add-ons and connected apps. Third-party Docs or Sheets add-ons, form tools and apps connected through Google sign-in are not covered by Google's BAA. Each vendor would need to sign its own BAA with you. Admins can restrict which third-party apps can access Workspace data.

If you are evaluating storage outside Google, see Dropbox, iCloud and other cloud storage.

Google Meet and Calendar: telehealth, therapy sessions and appointments

Meet coverage. Meet can be covered under Google's BAA on eligible editions. Check whether specific features, such as recordings, transcripts and live captions, are included or excluded. If recordings are allowed, know where they are saved and who can open them.

Telehealth and therapy. Whether Meet is appropriate for a telehealth visit or a therapy session depends on the BAA being in place and on configuration. It does not depend on the product alone. Clinicians should also check state telehealth rules, licensing board expectations and their own practice policies. For behavioral health in particular, review consent and recording policies before the first session.

Meet settings to review:

• Host controls, including who can share their screen, chat or mute others.
• Admission rules for external participants, so patients wait to be let in rather than joining directly.
• Recording permissions and storage location, or recording turned off entirely.

Calendar. An event titled "Mrs. J — colonoscopy prep call" exposes PHI to everyone who can see that calendar. That includes delegated assistants, shared front-desk calendars and anyone with whom the calendar was shared years ago. A practical rule is to use initials or an appointment ID in titles, keep diagnoses out of descriptions, and leave clinical details in the clinical system.

For other video tools, see the Zoom and FaceTime HIPAA check.

Google Analytics, Translate and other Google services outside the BAA

Google Analytics and GA4. Check Google's current position on whether Analytics can be covered by a BAA. The bigger issue is what the tag collects. Analytics or ad tracking on an appointment request form, a symptom checker or a patient portal login page can send identifiers, such as an IP address or device ID, together with information that suggests a health condition or a visit. Regulators have treated that combination as a possible PHI disclosure. HHS guidance on online tracking technologies was the subject of a 2024 court ruling, so check its current status with counsel.

Practices commonly respond in one of these ways:

• Remove analytics from authenticated and sensitive pages, such as portals, forms and condition-specific booking pages.
• Limit tracking to general marketing pages.
• Use an analytics vendor that will sign a BAA.

The same question comes up with site platforms. See website builders and HIPAA.

Google Translate. Check whether Google Translate is covered by any Google BAA. Typing or pasting discharge instructions, intake answers or a patient message into a consumer translation tool sends that text outside your covered environment. Patients with limited English proficiency may also be entitled to qualified interpreter or translation services, which machine translation may not satisfy.

Other services commonly outside the BAA. Check each against Google's list before staff use it with PHI:

• Consumer Google apps signed into with personal accounts
• Gemini features in Workspace and the standalone Gemini app, whose coverage differs and should be confirmed
• YouTube
• Consumer Google Voice

Rule of thumb: if a service is not on Google's covered list, keep PHI out of it.

How to make Google Workspace HIPAA compliant: setup checklist

Use this as a working list for your IT manager or MSP. Each setting name and its edition availability needs checking against Google's current documentation.

1. Confirm the edition is eligible for the BAA.
2. Review and accept the BAA. An authorized person reviews it, and a super admin accepts it in the Admin console. Keep a record.
3. Turn off or restrict non-covered services for users who handle PHI, using organizational units where possible.
4. Enforce 2-step verification for all users, and require it for admins first.
5. Restrict Drive sharing. Limit or disable "anyone with the link" and external sharing, or allowlist trusted domains.
6. Block automatic forwarding to external addresses.
7. Manage mobile devices. Require a screen lock, and make sure you can wipe the work account from a lost or personal phone, using the device management features your edition includes.
8. Set retention rules and review audit logs on a schedule, for example monthly, using Vault and audit logs if your edition includes them.
9. Control third-party apps. Allow only connected apps whose vendors have signed BAAs where PHI is involved.
10. Check automation tools. Any automation platform connected to Workspace needs its own BAA before it moves PHI between systems.
11. Cover the practice's own responsibilities: written policies, staff training, a documented risk analysis, a clear offboarding process (suspend the account, transfer files, revoke devices), and an incident response plan. Google's BAA does not cover any of this. Under the shared-responsibility model, it remains the practice's job.

Where staff chat fits alongside Google Workspace

Many practices run email, files and calendars on Workspace and still find that day-to-day coordination drifts elsewhere. "Can someone cover the front desk at 2?" or "Room 3 printer is down" or "Who's calling back the insurance rep?" end up in personal texts and WhatsApp groups. Those threads usually sit outside any BAA, outside admin control, and on phones the practice cannot wipe.

If you plan to move that traffic into Google Chat, confirm its status under Google's BAA first. See how the main options compare in team chat tools compared on HIPAA.

Chanty is another option for this layer. It is internal team chat for staff, with calls, announcements, files and assigned tasks, and it is used alongside clinical systems rather than in place of them. A shift-coverage request or a "call back the lab rep" message can become a task with an owner and a due date. HIPAA support with a signed BAA is available on the Business and Enterprise plans, not on the Free plan; see HIPAA-compliant chat for staff. Google Drive can be connected for file sharing, but third-party integrations, including Google Drive, sit outside Chanty's BAA scope. Plan and BAA specifics are on the Chanty security and BAA details page. Keep the use operational: front desk coordination, shift updates, supply issues and follow-up tasks. Patient communication and clinical handoffs stay in the systems built for them.

FAQ

Is free Gmail HIPAA compliant?

No. Free consumer @gmail.com accounts are not covered by Google's BAA and should not hold PHI. Neither settings nor confidential mode change that. A practice that needs Gmail for PHI should move to an eligible paid Workspace edition and accept the BAA.

Which Google Workspace plan is HIPAA compliant?

No plan is compliant by itself. Certain paid editions can accept Google's BAA, which allows PHI in covered services when configured correctly. Check the current list before you buy, downgrade or mix editions across locations.

Does Business Starter include Google's BAA?

Check Google's current list of eligible editions before relying on Business Starter for PHI. Even if it is eligible, compare its audit log, Vault and device management features against your checklist.

Is Gmail confidential mode HIPAA compliant?

Confidential mode is not encryption and does not satisfy HIPAA on its own. It controls expiration, forwarding, copying, printing and downloading, but recipients can still screenshot messages. Use it only on top of a BAA, enforced settings and a written email policy.

Do I have to pay extra for Google's BAA?

Check whether Google charges for the BAA on eligible editions. Your main cost is the per-user price of an eligible edition.

Is Google Meet HIPAA compliant for telehealth or therapy?

Meet can be used under Google's BAA on an eligible edition, subject to any excluded features such as recordings or transcripts. Whether it fits your telehealth or therapy practice also depends on configuration, consent and recording policies, and state rules.

Can I keep patient information in Google Sheets?

Yes, if Sheets is a covered service under your accepted BAA and the file is properly restricted. Limit access to named staff, block link sharing, store the file in a shared drive the practice owns, and review audit logs where your edition provides them.

Is Google Analytics 4 HIPAA compliant?

Check Google's current statement on whether Analytics can be covered by a BAA. Tracking on appointment forms, portals or condition-specific pages can disclose PHI. Many practices remove analytics from those pages or use a vendor that signs a BAA.

Is Google Translate safe to use with patient information?

Do not paste patient information into Google Translate unless Google confirms the service is covered under your BAA. Patients with limited English proficiency may also be entitled to qualified interpreters or translators.

Is G Suite the same as Google Workspace for HIPAA purposes?

G Suite was renamed Google Workspace. The same test applies: eligible edition, accepted BAA, covered services and proper configuration. Older G Suite answers may reference editions or service lists that are no longer current.

Does signing Google's BAA make my practice HIPAA compliant?

No. The BAA makes Google your business associate for covered services. Compliance still depends on your configuration, risk analysis, policies, training, access management and offboarding. Review your setup with your privacy officer or counsel.