Is Google Voice HIPAA Compliant? Calls, Texts and Voicemail

Is Google Voice HIPAA compliant? One version of it can be used in a HIPAA-compliant way: Google Voice for Google Workspace, assigned to a licensed user in a Workspace account whose administrator has accepted Google's Business Associate Agreement (BAA). Google's list of services covered by that agreement names "Google Voice (managed users only)," and its HIPAA Implementation Guide says "Licensed users of Google Voice are covered under the Google Workspace BAA." Basic Google Voice, the no-charge version for personal use, isn't covered. Neither, going by Google's own documents, are the newer Voice Starter and Voice Standard plans you can buy on a personal @gmail.com account. And no version is compliant by itself: Google's HIPAA help page says customers who haven't signed a BAA "must not use PHI in Google Workspace or Cloud Identity services," and the BAA leaves the setup to you.

If you're a therapist who wants a separate business number for calls and texts, this guide covers what Google's own pages say (we read them on October 25, 2026), how to tell which kind of Voice account you have, the setup steps, the settings that matter for client calls, voicemail and recordings, what HHS has said about texting and emailing clients, a checklist, and wording you can copy for your voicemail greeting, texting consent and appointment texts. Gmail, Drive and Meet run under the same Workspace BAA; our guides to Gmail, Google Drive and Google Meet cover the BAA acceptance steps and those services in detail, so this article only summarizes them.

Is Google Voice HIPAA compliant? The answer by version

Google sells Voice in several forms, and they don't all sit under the same terms. Google's page on Voice subscription types lists them.

Basic Google Voice: no.Google describes it as a "no-charge plan" that "is for personal, consumer use." It runs under the Google Voice Additional Terms of Service, not a Workspace agreement, and it has no Admin console. Google's BAA says "Customer must have an existing Services Agreement in place for this BAA to be valid and effective," so there is nothing to accept.
Voice Starter or Voice Standard bought on a personal Gmail account: no BAA path that Google documents.Google calls these standalone plans, and its standalone plan page says you buy them "as a Gmail user without a Google Workspace account." They aren't managed by a Workspace administrator, Google's Voice terms page puts them under the "Google Voice Personal Additional Terms of Service," and those terms (last modified June 9, 2026) bring a Data Processing Addendum but don't mention HIPAA or a BAA. If anyone at Google tells you otherwise, get it in writing.
An older Voice account tied to your work address that an administrator never took over: not yet.Google calls these unmanaged accounts. They run under the consumer terms until an administrator migrates them (the steps are below).
Google Voice for Google Workspace, licensed, with the BAA accepted: yes, with work on your side.This is the Voice Starter, Standard or Premier add-on to a paid Workspace plan, with a license your administrator assigns to you.
Google Voice for Google Workspace without the BAA: not yet.Buying the add-on doesn't accept the BAA. A super administrator does that in the Admin console.

The plan names overlap, which is why "is Google Voice Starter HIPAA compliant?" has two answers. Voice Starter as a Workspace add-on can be covered. Voice Starter bought as a standalone plan on a Gmail account isn't.

How to check which Google Voice account you have

Google's subscription types page gives a quick test. Open Google Voice on a computer, click Settings, and look under "Account":

"This account is managed by your Google Workspace administrator" means you have Voice for Google Workspace, billed to your organization. It's the only kind that Google's HIPAA list covers.
"Manage my account" means a Voice Starter or Voice Standard standalone plan that you pay for yourself.
Neither message means Basic Google Voice, or a work or school account your organization doesn't manage.

Take a screenshot of the managed message and file it with your BAA screenshot. If your browser is signed in to more than one Google account, check the account picture first; it's easy to open the personal one by mistake.

First, does HIPAA apply to you?

HIPAA covers health care providers who send health information electronically in connection with standard transactions, such as billing insurance. A therapist who sees only private-pay clients, with nobody billing insurance on their behalf, may not be a covered entity. Our guide to who HIPAA applies to walks through the test. State privacy law and your ethics code apply either way: the ACA Code of Ethics says counselors "take reasonable precautions to ensure the confidentiality of information transmitted through any electronic means" (standard H.2.d). Many therapists follow HIPAA anyway, and you may bill insurance later. If you're unsure where you stand, ask a healthcare attorney.

What Google's HIPAA documents say about Voice

Voice is a covered service, for managed users only

Google's Workspace BAA covers only the services it lists. Its Attachment 1 points to Google's HIPAA Included Functionality list, which now lives on Google's page on HIPAA compliance on Google Cloud and Google Workspace (page updated October 20, 2026). The Workspace part of that list includes Gmail, Google Calendar, Google Drive, Google Meet, Gemini in Google Workspace, Google Vault (if applicable) and "Google Voice (managed users only)."

The HIPAA Implementation Guide (September 2025) gives Voice two sentences: "Licensed users of Google Voice are covered under the Google Workspace BAA. Administrators should obtain Google Voice licenses for users that handle PHI." So the condition is a license on a managed account, not a particular tier: neither the list nor the guide limits Voice to Standard or Premier. The BAA also says Google "may only remove a Covered Service from those URLs with at least 12 months prior notice," so the list can't change under you overnight.

Which Voice features the BAA covers: texts, voicemail, transcripts and recordings

This is the question most therapists actually have, and Google's documents answer it by what they leave out. The list names Google Voice as one service with one condition. Neither the list, the BAA nor the Implementation Guide carves texting, voicemail, voicemail transcripts or call recordings out of it, and the guide's Voice section says only that licensed users are covered. Read plainly, a text, voicemail, transcript or recording held in a licensed, managed Voice account is part of the covered service. Two points sit next to that:

Some Voice features lean on other listed services.Google's "take notes for me" feature for Voice calls uses Gemini, which is on the list as Gemini in Google Workspace. Administrators retrieve call recordings through Google Vault, which is listed "if applicable"; Google's comparison of Voice subscriptions shows Vault for Voice only with Voice Premier.
Google's part ends at Google.Google says Voice data "is encrypted in transit from a Google Voice client to Google, and when stored at rest" (How Google Voice protects your privacy). A text to a client's ordinary mobile number then travels through phone carriers as a standard text message, and CISA's mobile communications guidance states that "SMS messages are not encrypted." The BAA covers what Google holds for you; it can't encrypt an ordinary text on the client's carrier or phone.

If you need a firm answer about one feature before you rely on it, ask Google in writing and keep the reply.

What the BAA doesn't cover

Google Contacts.The Implementation Guide lists Contacts among the "Core Services in which PHI is not permitted," and Google's Voice privacy page says Voice uses "your contacts stored on your device and in your Google Account" to identify calls and texts. Keep contact entries minimal: no "client" labels, no notes about why someone sees you, nothing clinical.
Third-party apps and add-ons."Third-party applications including add-ons are not included in the Included Functionality covered by the BAA," says Google's HIPAA help page. A call-tracking or transcription service connected to your number needs its own agreement with you.
Google's technical support.The guide says "Customers should not provide PHI to Google when accessing technical support services." Describe the problem, not the client.
Calendar details shown when Meet dials you.The guide notes that "Google Voice users will see Meet meeting names displayed on their devices" when someone in a Meet meeting dials out to them, and suggests setting calendar entries that contain PHI to "Private." A neutral event title, such as "Session," avoids the problem.

The configuration is yours

The BAA says the customer "is solely responsible for ensuring that its and its End Users' use of the Covered Services complies with HIPAA and HITECH." That isn't a weakness in Google's offer. It's how a BAA with a software vendor works: the vendor protects its service, and you decide how it's set up and used.

What HIPAA asks of a business phone line

HHS's guidance on audio-only telehealth (last reviewed June 23, 2026) is its clearest statement on phone service, and it explains why Google Voice needs a BAA when an ordinary phone line doesn't.

A traditional landline is outside the Security Rule.HHS says the Security Rule "does not apply to audio-only telehealth services provided by a covered entity that is using a standard telephone line," because the information isn't electronic.
Internet phone service is inside it."The HIPAA Security Rule applies when a covered entity uses such electronic communication technologies," meaning VoIP and mobile technology. HHS's examples include "VoIP technologies," "Technologies that electronically record or transcribe a telehealth session" and "Messaging services that electronically store audio messages." Google Voice is all three.
A phone company that only connects calls needs no BAA; a service that stores them does.HHS says no BAA is needed with a telecommunications provider "that has only transient access to the PHI it transmits," because it is "acting merely as a conduit." But "a covered entity must enter into a BAA with a vendor that is more than a mere conduit for PHI," such as one that stores recordings or transcripts. Google Voice keeps your voicemail, texts, call history and any recordings in your account, so it's more than a conduit. That's why the Workspace BAA matters.
Your risk analysis should look at the line itself.HHS lists whether a transmission "could be intercepted by an unauthorized third party," whether the technology "supports encrypted transmissions," whether stored recordings or transcripts could be accessed, whether "Authentication is required to access the device or app," and whether it "automatically terminates the session or locks after a period of inactivity."
The client's phone is the client's.HHS says "a covered entity is not responsible for the privacy or security of individuals' health information once it has been received by the individual's phone or other device."

How to make Google Voice HIPAA compliant: setup steps

1Start from Google Workspace on your practice domain

Voice for Workspace is an add-on. Google's setup page says "Your organization needs Google Workspace before you can buy a Voice add-on subscription." Use an account at your practice's domain, kept for practice work only. An administrator adds Voice in the Admin console under Billing, then Buy or upgrade, then Google Voice.

2Accept the BAA and keep proof

There's no separate BAA for Voice; the Workspace BAA is the one that covers it. A super administrator signs in to the Admin console, goes to Account, then Account settings, then Legal and compliance, opens the Google Workspace/Cloud Identity HIPAA Business Associate Amendment in the Security and Privacy Additional Terms section, clicks Review and Accept, and answers three questions confirming the account is a HIPAA covered entity (Google's steps). Google says a screenshot of the acceptance in Legal and compliance can serve as proof. Our Gmail guide has the details.

3Add a Voice location, then assign the license

Before numbers can be assigned, Google's locations page says Voice needs your organization's service address. Note this line if you work from home: "Your primary location must be a business location, and not a residential one. If your residence is a work location (for example, you work remote from home), you may be required to provide proof based on your region." Then assign yourself a license under Directory, then Users, then Assign licenses, then Google Voice; Google says it can take up to 24 hours.

4Bring over the number clients already have, if you need to

A Basic Google Voice number.Google's transfer page lets a personal Voice user send their number to a Workspace account, where the administrator accepts the transfer. "Only your Google Voice number transfers to the new account," and settings, voicemail, call history and text messages stay behind. Ask a healthcare attorney whether any of that history belongs in your records before you delete anything.
An unmanaged Voice account on your work address.An administrator migrates it under Apps, then Google Workspace, then Google Voice, then Users, then Migrate These Users. Google's migration page notes that "Existing Voice data from the unmanaged account will be under the control of your organization," and that a migrated account can't switch back.
A number from a mobile carrier.For a managed account, Google's porting page says to contact your administrator to port it.

5Confirm the account shows as managed

Run the Settings check above and look for "This account is managed by your Google Workspace administrator." Until you see it, keep client calls and texts off the number.

6Lock down the account and the phone

Turn on 2-Step Verification for every account that can open the practice line.
Use a screen lock and passcode on every phone, tablet and laptop with the Voice app or voice.google.com open.
Keep the practice account out of shared family devices and browser profiles.
Turn off lock-screen message previews in your phone's notification settings, so a client's text doesn't show to whoever picks up the phone.

7Write it down

HIPAA expects a risk analysis and written policies. Your phone policy can be one page: which number clients use, the BAA and managed-account screenshots, who can open the account, your recording decision, where voicemail and transcripts go, what you will and won't text, and what you do if a text goes to the wrong person.

Google Voice settings that matter for therapy calls and texts

These are the settings and habits most likely to put client information somewhere you didn't intend. None is a flaw in Voice; each is about how it's set up.

Call recording is on for users by default.Google's admin help says "By default, on-demand call recording is on." If you don't record client calls, turn it off in the Admin console under Apps, then Google Workspace, then Google Voice, then Settings, then Policies, then On-demand call recording. Automatic recording, available only with Voice Premier, is off by default. If you do record, get the client's written consent and check your state's law; Google says you "should adhere to local and federal call-recording requirements."
Deleting a recording may not delete it.Google's call recording page says a user deletes a recording by deleting its call log, but "The organization will continue to retain the call log and recording according to the retention rules set by them." Know your retention settings before you rely on deletion.
Gemini call notes.On Voice Standard and Premier, an administrator can turn on "take notes for me," which records, transcribes and summarizes a call; Google says it requires call recording to be on. Gemini in Google Workspace is on the covered list, but whether to use it on client calls is a consent, clinical and state law decision, and a generated summary isn't the progress note you write and sign.
Voicemail transcripts.Each user turns them on or off under Settings, then Voicemail. Google warns that "Voicemail transcripts may be incorrect or missing," so treat a transcript as a pointer and listen to the message itself.
Voicemail by email.The "Get voicemail via email" setting sends transcripts to your email app (Google). That's fine when the inbox is your practice's Workspace Gmail under the same BAA. Never forward voicemail, texts or missed-call alerts to a personal address.
Forwarding to your personal mobile.Voice can ring linked numbers, such as your own cell phone. A forwarded call rings that phone like any other call, so the same screen lock and shared-device cautions apply.
Texting limits.Google says Voice messaging "is intended only for interactive conversations" and may block "Sending the same text message to multiple recipients" and "Sending URL links" (Send and get text messages). Don't plan on Voice for reminder blasts or for texting session links. Google also says texting on paid Voice plans "is available only in the US."
Emergency calls.Google's emergency calling page says emergency calling works only on Workspace add-on and standalone accounts, and that during "a power outage, loss of your internet connection, or a Google Voice service outage, emergency calling will not be available on Google Voice." Keep your mobile carrier line in your crisis plan, and confirm each telehealth client's location and local emergency options at the start of a session, as our telehealth consent form guide explains.

Texting clients under HIPAA: what HHS has said

HHS's guidance on talking with patients electronically is written about email; we didn't find an HHS FAQ on texting patients. Many practices apply the same reasoning to text messages, but because HHS hasn't said so in published guidance that we could find, confirm your approach with a healthcare attorney. Here is what HHS has said:

Electronic communication is allowed with safeguards. HHS's FAQ on email with patients (created in 2008 and still on its site) says "The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so."
Unencrypted communication isn't banned, but keep it light. The same FAQ says the Privacy Rule "does not prohibit the use of unencrypted e-mail for treatment-related communications," and asks for other safeguards, "such as limiting the amount or type of information disclosed."
Clients can ask for a different method, and you must accommodate reasonable requests. Covered providers "must accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or at alternative locations" (45 CFR 164.522(b)). You may ask for the request in writing, but you "may not require an explanation." If unencrypted messages are unacceptable to a client, HHS says to offer another way, such as "more secure electronic methods, or by mail or telephone."
When the client starts the conversation, HHS says for email that you "can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable," and that if you think the client may not know the risks, you can alert them "and let the patient decide."
When a client asks for records by an unsecure method. HHS's right of access FAQ says that for unencrypted email "the covered entity must provide a brief warning to the individual that there is some level of risk," confirm the client still wants it, and then comply. For other unsecure methods, the answer depends on what your systems can do and your risk analysis. Either way, "a covered entity is not permitted to require an individual to accept unsecure methods of transmission." After a warning the client accepted, HHS's companion FAQ says you aren't responsible for a disclosure in transit.

What to text, and what to keep out of texts

Texts land on lock screens, smartwatches, shared tablets and family phone plans, often before anyone unlocks anything. Treat every text as something another person may read.

Usually fine, with the client's consent:

Scheduling: confirming, moving or canceling a time
Practical notes: "Running five minutes late," "The office door code changed"
Pointers: "Your forms are ready," "Please call me when you have a moment"

Keep out of texts:

Diagnoses, symptoms, medications, measure results
Anything said in session, or questions about it
Risk or safety assessments
Other people's names or details (partners, children, family)
Records, notes and treatment plans
The word "therapy" or "counseling" next to the client's name, unless the client agreed

When a client texts about something clinical, or in crisis

Answer briefly, without engaging with the content, and move it to a session or a call. Say plainly that texts aren't monitored for emergencies and give 988 and 911. Your consent form should say the same thing, so the reply is a reminder rather than a surprise.

What your ethics code adds

Professional codes ask you to talk about this up front. The ACA Code says counselors "inform clients about the inherent limits of confidentiality when using technology" (H.2.c). The telehealth consent form template has a line for how you message clients between sessions, and the texting consent below fits beside it or inside your informed consent document.

Wording you can copy

Fill in the brackets, keep it short, and have a healthcare attorney check it against your state's rules before you use it.

A voicemail greeting

Keep it neutral: no diagnosis words, and nothing that invites callers to leave clinical detail. Pointing new callers to the booking page on your practice website saves a round of phone tag.

Wording to copy8 lines · 3 parts to fill in

You've reached [practice name].I can't take your call right now.If this is an emergency, hang up and call 911.You can also call or text 988 at any time.To book a first appointment, visit [website].Otherwise, leave your first name and number.Please don't share details about your health here.I return calls within [one business day].

Consent to text messages

Consent to text messagesTemplate · 5 parts to fill in

CONSENT TO TEXT MESSAGES

Client name: [name]Mobile number to use: [number]

I text from my practice number for scheduling and shortpractical messages only.Texts are not for emergencies. In an emergency, call 911or call or text 988.I don't discuss therapy content by text.

Regular text messages are not encrypted.Others may see them on your phone, watch or tablet.Your phone company or anyone with your phone may read them.Messages about your care may become part of your record.

You can change this choice, or choose another way, at any time.

Please choose one:Yes, you may text me about the topics I tick belowNo, please contact me by: [phone / email / mail]

Topics, if yes:Scheduling and changesReminders that forms are readyRunning late or office notices

Client signature: [signature]Date: [MM/DD/YYYY]

Appointment texts that say nothing clinical

Wording to copy4 lines · 9 parts to fill in

Hi [first name], confirming [day] at [time]. Reply C to confirm.

Hi [first name], I need to move [day]. Could [new day, time] work?

Hi [first name], I'm running 5 minutes late. See you shortly.

Hi [first name], your forms for [day] are ready. Thank you.

A reply when a client texts about something clinical

Wording to copy4 lines · 2 parts to fill in

Thanks for letting me know. I'd like to talk about thistogether rather than by text. Can we start there on [day]?If you need help sooner, call me at [number].If you're in crisis, call or text 988, or call 911.

What to look for in any HIPAA-compliant phone service for therapists

Whether you choose Google Voice or another phone service, the same questions apply. They mirror the ones in our guide to HIPAA compliant telehealth platforms, with a few that only a phone line raises:

Does the vendor sign a BAA, and does it cover the account you'll actually use?For Google Voice, that means a managed Workspace account with the BAA accepted.
Does the BAA cover calls, texts, voicemail, transcripts and recordings?Ask about any feature the vendor lists separately.
Can an administrator control recording, transcription and note-taking features?You want to choose, not inherit a default.
Where do voicemails, transcripts and recordings go, and who can open them?Email copies, exports and other users all count.
Does it run as its own app with a sign-in, separate from your personal texts?A screen lock and a separate app keep client messages out of your personal inbox.
Does it support emergency calls, and what happens in an outage?
Can you keep your number if you leave?Porting matters once clients know the number.
Can you export or delete your data, and how long is it kept?

A Google Voice HIPAA checklist for therapists

Checklist20 checks in 5 groups

How this works in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and client forms in one place. It doesn't give you a phone number or a way to text clients, so if you want a business line, the Google Voice steps above still apply. What TranqBay changes is how much has to go through that line.

Clients book online.Your practice website comes with online booking, so a new client can pick a time without a run of calls and texts. Your voicemail greeting and your texts can point people to it.
Forms are filled in online, not sent by text or email.You send forms from a library of ready-made templates, including intake forms, consent to treat, telehealth consent, release of information, PHQ-9 and GAD-7, to a client for a session. The client fills them in online, and the answers wait with the session. TranqBay doesn't score forms automatically.
Video sessions are end-to-end encrypted and HIPAA-ready.Sessions run inside TranqBay rather than over your phone line.
Notes stay with the session.You can write a BIRP, DAP, SOAP or GIRP note, or a blank note. Structured formats are part of the advanced note templates, which some plans include.
TranqBay signs a BAA.It applies when a therapist who is a covered entity accepts the Terms of Service; there's no separate document to sign. You can read TranqBay's Business Associate Agreement before you decide anything.

TranqBay's BAA covers TranqBay, not your phone line. If clients call or text a Google Voice number, keep Google's BAA and the settings above in place too. To see the booking page your voicemail greeting would send people to, look at a practice website and its booking page on practice.tranqbay.health.

Frequently asked questions about Google Voice and HIPAA

Is Google Voice HIPAA compliant for therapists?

It can be, in one form: Google Voice for Google Workspace, licensed to a managed user, in a Workspace account whose administrator has accepted Google's BAA. Google's list of covered services says "Google Voice (managed users only)." You still have to set it up and use it with care, from recording settings to what you text.

Is the free version of Google Voice HIPAA compliant?

No. Google calls it Basic Google Voice, a "no-charge plan" that "is for personal, consumer use." It runs under consumer terms, has no Admin console, and has no BAA to accept. Google also says emergency calling isn't available on it.

Does Google sign a BAA for Google Voice?

Not a separate one. Voice is covered by the Google Workspace BAA, for managed users only. A super administrator accepts that BAA in the Admin console under Account settings, then Legal and compliance, and it then covers Gmail, Drive, Meet, Voice and the other listed services.

Is Google Voice Starter HIPAA compliant?

It depends on how you bought it. Voice Starter as an add-on to a paid Google Workspace plan, licensed to a managed user with the BAA accepted, is covered. Voice Starter bought as a standalone plan on a personal Gmail account runs under Google's personal Voice terms, which don't mention HIPAA, so Google's documents give it no BAA.

Is texting clients through Google Voice HIPAA compliant?

Texts held in a managed, licensed Voice account are inside Google's covered service. Once a text reaches a client's ordinary phone number, it travels as a standard text message, which isn't encrypted. HHS's guidance on unencrypted email (reasonable safeguards, limited content, honoring a client's preferred method) is the closest it has published; get the client's consent and keep texts practical.

Does Google's BAA cover voicemail transcription and call recording?

Google's list names Voice as a whole for managed users and doesn't carve out voicemail, transcripts or recordings. Recordings are retained under your organization's rules even after a user deletes them, and on-demand recording is on by default, so decide on both before clients call.

Can I keep the Google Voice number my clients already have?

Usually. Google lets a personal Voice user transfer the number to a Workspace account, where the administrator accepts it. Only the number moves; voicemail, call history and texts stay in the old account. Ask a healthcare attorney what to do with that history.

Is my regular cell phone number HIPAA compliant?

HHS says a phone company that only connects calls is a conduit, so no BAA is needed with it. The texts and voicemails on your phone are yours to protect, though, along with any cloud backup of them. If your texts go out as iMessages or your calls as FaceTime Audio, Apple's terms apply instead; our FaceTime guide explains them. A separate business line keeps client contact apart from your personal life and makes these choices easier.

I only see private-pay clients. Does any of this apply?

HIPAA applies to providers who send health information electronically in connection with standard transactions, such as insurance billing. You may not be a covered entity, but your ethics code and state law still ask you to protect client information and explain the limits of texting and calls. Check with a healthcare attorney.

Before you give clients your new number

Open Voice Settings and confirm the account is managed by your Workspace administrator, confirm the BAA shows as accepted and save both screenshots, decide on recording before the first client call, record a neutral voicemail greeting, and add texting consent to your intake packet.

When your greeting and texts send people to your practice website to book, the site has to work for them. See a practice website and booking page on practice.tranqbay.health to see what a client would see. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources

31 sources

Google 24HHS 4Regulations 1States 1Associations 1

Google24

U.S. Department of Health and Human Services4

Updated October 25, 2026. Found it useful? Send it to a colleague.