Is Google Drive HIPAA Compliant? Docs, Forms and Sharing

Is Google Drive HIPAA compliant? It can be used in a HIPAA-compliant way, and so can Google Docs, Sheets, Slides and Forms, which Google treats as part of Drive. Three things have to be true: the files live in a Google Workspace account, not a personal Google account; an administrator has accepted Google's Business Associate Agreement (BAA); and the account is set up and used with care, above all its sharing settings. Google's HIPAA help page states the rule plainly: "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services." Google's list of covered services names "Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides, and Google Vids)," and the same page says compliance "is a shared responsibility between you and Google."

Below you'll find what Google's own pages say about Drive, Docs and Forms (we read them on October 25, 2026), the sharing settings behind most Drive mistakes, how to use Google Forms for intake without exposing anyone's answers, how long to keep files and how Drive deletes them, a checklist, and a sharing policy you can copy. The Workspace BAA itself, including how to accept it and what to do about a personal account, is covered step by step in our Gmail HIPAA guide and Google Meet HIPAA guide, so this article only summarizes it.

Is Google Drive HIPAA compliant? The answer by account type

Why does a storage service need a BAA at all, if Google isn't reading your files? Because HIPAA looks at who holds the data, not who reads it. HHS's guidance on cloud computing says an entity that maintains ePHI for a covered entity "is a business associate, even if the entity cannot actually view the ePHI." Keeping client files in Drive is that arrangement, so the BAA is what makes it allowed.

One question comes first: whether HIPAA applies to you. It covers providers who send health information electronically in connection with standard transactions, such as billing insurance; our guide on who HIPAA applies to walks through it. A therapist who sees only private-pay clients may not be a covered entity, but state law and ethics codes still ask for the same care. The ACA Code says counselors "ensure that records and documentation kept in any medium are secure and that only authorized persons have access to them" (B.6.b). If you're unsure where you stand, ask a healthcare attorney.

What Google's HIPAA pages say about Drive, Docs and Forms

Drive, Docs, Sheets, Slides and Forms are covered services

Google's HIPAA Implementation Guide (September 2025) lists Google Drive, "including Google Docs, Google Forms, Google Sheets, Google Slides, and Google Vids," among the services users can use with PHI "as long as the health care organization configures those services to be HIPAA compliant." So the answers to "is Google Docs HIPAA compliant," "is Google Sheets HIPAA compliant" and "is Google Forms HIPAA compliant" are the same as for Drive: each is inside the BAA, and the setup is yours.

Gemini in Google Workspace is on the same list, and the guide says that when it's used with PHI, "the same recommendations provided in this guide will apply."

To be fair to Google, the parts it controls are well documented. Drive's privacy and security page says "Data is encrypted in-transit and at-rest," and the Implementation Guide says the Workspace core services are audited against ISO/IEC 27001, 27017 and 27018 and SOC 1, 2 and 3. What remains is the part only you can control: who gets access to each file.

What the BAA doesn't cover

Google's own advice for Drive

The Drive section of the Implementation Guide is short, and every line of it applies to a private practice:

Records are yours to manage

Google's BAA says the customer "is solely responsible for the form and content of PHI maintained by Customer within the Covered Services, including whether Customer maintains such PHI in a Designated Record Set," and the Implementation Guide says customers "are responsible for fulfilling an individual's right of access, amendment, and accounting." In practice: if a client asks for their records, Google won't gather them. You need to know which Docs, Sheets, uploads and form responses make up each client's record. That isn't a weakness in Google's offer; storage vendors generally work this way.

The sharing settings behind most Drive mistakes

Drive's defaults are sensible. Google's admin help says that "By default, general access is set to Restricted," and Drive shows an External indicator on files shared outside your organization unless an administrator turns it off. Problems usually start with one click that made a file easier to open.

"Anyone with the link"

Google's sharing help is precise: with this option, "Anyone on the internet who has the link can open the file without signing in to a Google Account." Links get forwarded, pasted into the wrong chat, saved in a browser's history or sent to a client's old address, and people who open a file while signed out show up as "anonymous animals," so you may never know who looked.

Google's HIPAA help page points to "sharing with specific recipients as opposed to anybody with the link." On a practice account an administrator can take the option away: in the Admin console (Apps, Google Workspace, Drive and Docs, Sharing settings), set Access Checker to "Recipients only," which lets users "give access only to specific recipients" (Google). Google adds that "If the file is shared with other people, those people still have access," so check files you shared before the change.

If a file with client information was open to anyone with the link, treat it as a possible breach. HIPAA presumes an impermissible use or disclosure is a breach unless you can show "a low probability that the protected health information has been compromised" through a four-factor risk assessment (45 CFR 164.402). Write down what happened and talk to an attorney.

Shared folders

"When you share a folder, all files and subfolders inside it inherit those same sharing permissions," and "You cannot give someone less access to a specific file than they have to its parent folder" (Google). Picture a Clients folder shared with a biller so they can see invoices: they can also open every intake packet inside it. Keep clinical, billing and admin files in separate folders, and share only the narrowest one each person needs.

Editors, comments and prompts

Sharing outside your practice

Turning external sharing on or off is an admin setting. Google's admin help says it "carries risk of data leaks" and offers ways to limit it, "such as warning users before they share or blocking link sharing." Two things to know before you change it: when you turn external sharing off, "External users also lose access to any items previously shared with them," and changes can take up to 24 hours. Google also describes a middle path: external sharing off for everyone, and on only for one shared drive used for files that leave the practice.

Clients who don't have a Google account

For a document a client needs to read or fill in, visitor sharing is a narrower option than a public link. With it, "Visitors get an email invitation to collaborate and a PIN to verify their identity," and they can use the file "for 7 days after they verify their identity" (Google). An administrator turns it on, Google supports it on all Workspace editions, and visitors can't open files in Drive for desktop or on mobile.

Shared drives

"Shared drive files belong to the team instead of an individual," and "By default, all members of a shared drive see all of the files" (Google). If your organization allows it, people outside it can be members "as long as they have an email address associated with a Google Account." Review the member list whenever someone's role changes, and use limited-access folders for anything only some members should open. One edition detail: on Business Starter, administrators can't set default sharing rules for new shared drives, and Google says "All shared drive sharing settings are set to allow" (Google).

Publish to the web

Publishing is not the same as sharing. Google warns that "when you publish a file, you can make it visible to everyone on the web, everyone in your organization, or a group of people in your organization," that "When you publish a chart to the web, people can see the data used to create it," and that "To remove a file from the web, you must stop publishing it" (Google). Never publish a client file. Administrators can limit who can publish.

Copies on your devices

Drive for desktop can stream files or mirror them, and "mirroring downloads a full copy directly to your computer" (Google). Offline access stores files on the device too, and every CSV of form responses you download is another copy. HHS allows mobile access to ePHI in the cloud "as long as appropriate physical, administrative, and technical safeguards are in place," per its cloud computing guidance. For a practice, that means a screen lock and disk encryption on every device, no practice account on a shared family computer, and knowing which devices hold copies.

Google Forms for intake: what the BAA covers and where answers go

Is Google Forms HIPAA compliant? It's covered by Google's BAA as part of Drive, in a Workspace account where the BAA is accepted. A form made in a personal account isn't. Being covered doesn't settle how the form is set up, though, and Forms has more places for client answers to end up than most people expect.

Where the answers go

One intake form can put client answers in four places. Know where each one is, and who can open it.

Responders and editors are different

A responder fills in the form; an editor (Google calls them collaborators) can see every response. A responder link opens a blank form, not anyone's answers, so sharing it with clients is how Forms is meant to work. Adding someone as an editor is a different decision: it gives them every client's answers. Keep the editor list to the people who need it, and never add a client.

A related habit: if one intake form serves every client, its linked Sheet holds every client's answers, one row each. Anyone who can open that Sheet can read all of them.

Settings to check before you send a form to a client

What Google Forms doesn't do for a practice

Forms is a general survey tool, and a good one. It wasn't built around therapy paperwork, so plan for these gaps:

For what to ask on an intake form, see our therapy intake form guide; for consent wording, the informed consent template.

Retention and deletion: how long to keep files and how Drive deletes them

HIPAA doesn't set a records retention period

HHS answers this directly in its FAQ on medical records retention: "No, the HIPAA Privacy Rule does not include medical record retention requirements. Rather, State laws generally govern how long medical records are to be retained." HIPAA does require you to protect records "for whatever period such information is maintained," including through disposal.

HIPAA's six-year rule is about your compliance paperwork, not clinical records. Policies, your risk analysis and similar documentation must be kept "for 6 years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.316(b)(2); the Privacy Rule has the same rule at 164.530(j)). Your BAA screenshot and the sharing policy below belong in that file.

For the clinical record, follow your state's law and your board. The professional guidance:

HIPAA also asks for a data backup plan: "procedures to create and maintain retrievable exact copies of electronic protected health information" (45 CFR 164.308(a)(7)). Decide how you'd get your records back if your account were deleted or locked, and write it down.

What Drive does with files by default

Do you need Google Vault?

Vault retention rules keep data "even if users delete messages and files or empty their trash," and can delete data on a schedule. Google is blunt about the risk: "An improperly set up retention rule might allow Google services to immediately and irreversibly purge data." Google lists Vault as included in Business Plus, Enterprise Standard, Enterprise Plus, Frontline Standard, Frontline Plus and all Education editions, among others (Google); Business Starter and Business Standard aren't on that list. A solo practice doesn't need Vault to keep records. It needs a rule against deleting them early, a backup, and a plan for disposal.

Deleting safely when the time comes

HHS's FAQ on disposal says the rules "do not require a particular disposal method," but you must have policies for "the final disposition of electronic protected health information" (45 CFR 164.310(d)(2)). In Drive, deleting a record means finding every copy: the file itself (then emptying the trash), the linked Sheet, form responses and uploads, copies mirrored by Drive for desktop or kept offline, downloaded CSVs and email attachments. Before you sell or recycle a laptop, wipe it properly; the APA's guidelines warn that deleted records "may nevertheless remain accessible by those with specialized expertise."

If you leave Google, or can't work

A Google Drive HIPAA checklist for therapists

A Drive sharing policy you can copy

Paste this into your compliance file and fill in the brackets. One rule per line, so it reads on a phone. Have a healthcare attorney check it against your state's rules.

How this works in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and client forms in one place. You may still keep plenty in Drive, but TranqBay changes where the most sensitive paperwork lives.

TranqBay's BAA covers TranqBay, not your Google account. If you keep client files in Drive, keep Google's BAA and the settings above in place too. To see what your clients would see first, look at a template practice website and its booking page on practice.tranqbay.health.

Frequently asked questions about Google Drive and HIPAA

Before you share your next file

Open your Admin console and confirm the BAA shows as accepted, save the screenshot, and set Access Checker to "Recipients only." Then open your client folders and read the General access line on each one, check who your form editors are, and turn off "View results summary" on every intake form.

If you'd rather keep intake forms, consent and notes out of Drive, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources