Is Google Meet HIPAA Compliant? A Therapist's Checklist

Is Google Meet HIPAA compliant? It can be used in a HIPAA-compliant way. Google lists Google Meet among the Google Workspace services covered by its HIPAA Business Associate Agreement (BAA), so a therapist can run telehealth sessions on Meet when three things are true: the practice uses a Google Workspace account, not a personal Gmail account; an administrator has accepted Google's BAA in the Admin console; and Meet, Calendar, Drive and Gmail are set up and used with care. Google's HIPAA help page is clear about the alternative: "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services." And no tool is compliant on its own. Google's HIPAA documentation notes that HHS "doesn't offer a certification program for HIPAA compliance" and calls compliance "a shared responsibility between you and Google."

Below you'll find what Google's own pages say (we read them on October 25, 2026), why a personal Gmail account is different, what HIPAA asks of a therapist using any video tool, the settings that most often catch therapists out, and a checklist with a setup record you can copy into your compliance file.

What Google's documentation says about Google Meet and HIPAA

Meet is on the list of covered services

Google's BAA applies only to the services it names. Google's page on HIPAA compliance on Google Cloud and Google Workspace lists the Workspace services included in the BAA. Among them:

Google's HIPAA Implementation Guide (September 2025) says it plainly: "Google Meet, the video meeting experience by Google, supports HIPAA compliance." The BAA itself adds that Google "may only remove a Covered Service from those URLs with at least 12 months prior notice," so the list doesn't change under you overnight.

You accept the BAA yourself, in the Admin console

The BAA isn't switched on by buying Workspace. Google's page on privacy compliance and records gives the steps:

Google says this electronic agreement "has the same legal effect" as a paper one, and that a screenshot of the acceptance in Legal and compliance can serve as proof. Take that screenshot and keep it with your practice records. The same page says users who aren't administrators, and users of the legacy edition sometimes called Google Apps Standard Edition, can't accept a BAA.

What the BAA doesn't cover

Google's documents name the gaps. These matter for a therapist because they are easy to wander into:

The configuration is your job

The BAA puts responsibility on the customer. It says the customer "will use controls available within the Services, including those detailed in the HIPAA Implementation Guide, to ensure its use of PHI is limited to the Covered Services," and that the customer "is solely responsible for ensuring that its and its End Users' use of the Covered Services complies with HIPAA and HITECH." Google provides the controls; you decide how they're set.

Editions: same BAA, different features

Google's HIPAA pages don't limit the BAA to particular paid editions; the requirement they state is an administrator account on a Google Workspace or Cloud Identity account. Features do differ by edition. Google's help pages list which editions can record meetings and use transcripts, and client-side encryption, where your organization controls the encryption keys, is available only in Enterprise Plus, Education Standard and Education Plus. Before you rely on an edition, open Legal and compliance in your own Admin console and confirm the BAA is offered there.

Why a personal Gmail account is different

A personal Google account (an @gmail.com address) is a consumer account. It is used under Google's Terms of Service, not a Workspace agreement, and it has no Admin console. Google's BAA says "Customer must have an existing Services Agreement in place for this BAA to be valid and effective," and the acceptance steps above need an administrator. A personal account has neither, so there is no BAA to accept.

That is why the usual advice is simple: if you're a covered entity, don't run client sessions on Meet from a personal account, and don't schedule them on its calendar or send client details from its Gmail.

Two related cases:

What HIPAA asks of a therapist using any video tool

First, are you a covered entity?

HIPAA applies to health care providers "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard," such as billing health insurance electronically (HHS, Covered Entities and Business Associates). A therapist who sees only private-pay clients, and has no one billing insurance on their behalf, may not be a covered entity. That doesn't make privacy optional. State health privacy laws and licensing boards still apply, and professional codes ask for the same care: the ACA Code of Ethics, for example, says counselors "use current encryption standards within their websites and/or technology-based communications that meet applicable legal requirements" (standard H.2.d). Many therapists follow HIPAA either way. If you're not sure where you stand, this is a question for a healthcare attorney.

A BAA with the video vendor

HHS's telehealth site is direct: "Covered health care providers and health plans must use technology vendors that comply with the HIPAA Rules and will enter into HIPAA business associate agreements in connection with the provision of their video communication products or other remote communication technologies for telehealth" (telehealth.hhs.gov).

You may read about a "conduit" exception. HHS's audio-only telehealth guidance says no BAA is needed with a vendor that is "acting merely as a conduit" for PHI, but a vendor that also stores PHI, such as recordings or transcripts, is a business associate. HHS's cloud computing guidance adds that a cloud service storing ePHI for you is a business associate "even if the entity cannot actually view the ePHI." Meet sits inside Calendar invites, chat, Drive recordings and transcripts, and Google offers a BAA, so accept it rather than lean on the conduit exception.

Security Rule safeguards

The Security Rule asks for "reasonable and appropriate administrative, physical, and technical safeguards" (HHS, Summary of the HIPAA Security Rule). It is "flexible, scalable, and technology neutral," so a solo practice doesn't need a hospital's setup, but it does need:

The COVID-era flexibility is over

In 2020, HHS's Office for Civil Rights said it would not penalize providers for good-faith telehealth through "non-public facing" apps such as Apple FaceTime, Zoom, Skype and Google Hangouts video, even without a BAA (Notification of Enforcement Discretion for Telehealth). That notice also listed "Google G Suite Hangouts Meet" among vendors that said they would sign a BAA, while noting OCR had not reviewed those agreements.

That notice expired at 11:59 pm on May 11, 2023, with the end of the COVID-19 public health emergency. OCR gave a 90-day transition period that ended at 11:59 p.m. on August 9, 2023 (HHS, HIPAA and Telehealth). Since then, telehealth falls under the ordinary HIPAA Rules: BAA, safeguards and all. Medicare's telehealth payment rules are a separate topic and don't change this.

HHS also published a proposed update to the Security Rule on January 6, 2025. As of this writing it hasn't been finalized, so the current rule applies. Check HHS for news before you rely on either version.

Google Meet settings that catch therapists out

These are easy mistakes to make in a small practice. Each one is about how Meet is set up and used, not a flaw in Meet.

A Google Meet checklist for therapists

Work through this once when you set up, then again whenever you change editions or add a tool.

A setup record you can copy

Paste this into your compliance file and fill it in. One field per line, so it reads on a phone.

How video sessions work in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and client forms in one place. If you'd rather not maintain a Workspace setup for sessions, here is how the same jobs are handled.

The sessions section of practice.tranqbay.health shows a session from the booking to the video call to the note, if you want to see how the pieces fit before you set anything up. One more point: TranqBay's BAA covers TranqBay. If you keep using Gmail or Google Calendar for anything about clients, keep Google's BAA in place for those too.

Frequently asked questions about Google Meet and HIPAA

Before your next session

Open your Admin console and confirm the BAA shows as accepted, save the screenshot, set new meetings to Restricted with the host joining first, and fill in the setup record above. Most of the risk with Meet sits in those few settings and in the calendar invite, not in the video call itself.

If you'd like booking, video sessions and notes connected without a meeting link to manage, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources