Menu

Is Google Workspace HIPAA Compliant? BAA, Apps and Settings

Google Workspace can hold client information once an admin accepts Google's BAA. Covered and uncovered apps, editions, Gemini and the settings to check.

Updated 8 min read
In this guideChecklistTemplate to copy9 questions answered

Is Google Workspace HIPAA compliant? It can be used in a HIPAA-compliant way, but not out of the box. Three things have to be true: your practice uses a Google Workspace account, not a personal Google account; an administrator has accepted Google's Business Associate Agreement (BAA) in the Admin console; and you keep client information inside the services the BAA covers, set up the way Google's HIPAA Implementation Guide describes. Google's HIPAA help page puts the rule in one line: "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services." And no software is HIPAA compliant by itself. Google's HIPAA compliance page notes that HHS "doesn't offer a certification program for HIPAA compliance" and that "Complying with HIPAA is a shared responsibility between you and Google."

This guide is the starting point for our Google series. It covers what Google's own pages say today (we read them on October 25, 2026): how to accept the BAA, which plans can, exactly which apps are covered and which aren't (Forms, Calendar, Gemini, NotebookLM and Contacts included), the main settings from the Implementation Guide, and what remains your job. For the details of each app, see our guides to Gmail, Google Drive, Docs and Forms, Google Meet and Google Voice.

Is Google Workspace HIPAA compliant? The answer by account type

  • Personal Google account (an @gmail.com address): no.It runs under Google's consumer terms and has no Admin console. Google's BAA says "Customer must have an existing Services Agreement in place for this BAA to be valid and effective," so there is nothing to accept.
  • Google Workspace with the BAA accepted: yes, with work on your side.Client information can go into the covered services once the BAA is accepted and the account is configured and used with care.
  • Google Workspace without the BAA: not yet.Buying Workspace doesn't accept the BAA. Google's help page says "Administrators must review and accept a BAA before using PHI in Google services."
  • A Business edition you signed up for with a Gmail address: verify your domain first.Google lets you sign up for a Business edition with an existing Gmail address. Its admin help says these accounts can't use the controls that turn additional Google services such as YouTube on or off until you verify your domain. The Implementation Guide asks you to turn those services off for anyone who handles client information, so verify the domain, then check that the BAA appears in Legal and compliance.
  • Workspace Individual: unclear.Google's HIPAA pages don't mention it, and the documented way to accept the BAA runs through an Admin console. Get Google's answer in writing before you put client information in it.
  • The legacy edition sometimes called Google Apps Standard Edition: no.Google says its users, like non-administrators, "cannot review and accept a BAA from Google at this time" (Google).

First, does HIPAA apply to you?

HIPAA covers health care providers who send health information electronically in connection with a standard transaction, such as an insurance claim. A therapist who sees only private-pay clients, with nobody billing insurance for them, may not be a covered entity. Our guide to who HIPAA applies to walks through the test. Google leaves that call to you: its HIPAA compliance page says you must determine "Whether you are a Covered Entity or a Business Associate of a Covered Entity" and "Whether you require a Business Associate Agreement with Google." State privacy law and your ethics code apply either way, and many therapists follow HIPAA even when they aren't sure they must.

How to accept the Google Workspace BAA in the Admin console

Google's page on privacy compliance and records gives the steps. You need a super administrator account.

  1. Sign in to the Google Admin console as a super administrator.
  2. Go to Menu, then Account, then Account settings, then Legal and compliance.
  3. Open the Security and Privacy Additional Terms section.
  4. Click Google Workspace/Cloud Identity HIPAA Business Associate Amendment to review it.
  5. Click Review and Accept, and answer all three questions confirming that you are a HIPAA covered entity.
  6. Click OK to accept.
  7. Take a dated screenshot of the acceptance and file it with your practice records.

Google says this electronic agreement "is as binding as a paper-based agreement," and that "a screenshot of their Admin Console/HIPAA acceptance" can serve as proof. Google uses two names for one agreement: the Admin console calls it the Business Associate Amendment, and the text itself, last modified September 12, 2025, calls itself the Google Workspace HIPAA Business Associate Addendum.

Five lines in the BAA are worth knowing before you rely on it:

  • It covers a list, not all of Google.Covered Services are the ones on Google's list, and Google "may only remove a Covered Service from those URLs with at least 12 months prior notice."
  • It stops at the edge of those services.The BAA "does not apply to (a) any other Google product, service, or feature that is not a Covered Service; or (b) any PHI that Customer creates, receives, maintains, or transmits outside of the Covered Services (including Customer's use of its offline or on-premise storage tools or third-party applications)."
  • The setup is yours.You agree to "use controls available within the Services, including those detailed in the HIPAA Implementation Guide," and you are "solely responsible for ensuring that its and its End Users' use of the Covered Services complies with HIPAA and HITECH."
  • Google tells you about breaches.Google will notify you of a breach it discovers "in no case later than 60 calendar days after discovery." Telling clients, and HHS, is still your job as the covered entity.
  • Leaving has a rule.On termination of the service agreements, "Google will return or destroy all PHI." Export your records before you cancel.

Why Google needs a BAA at all, if nobody at Google reads your files: HHS's cloud computing guidance says an entity that maintains ePHI for a covered entity "is a business associate, even if the entity cannot actually view the ePHI." Our guide to the HIPAA Omnibus Rule explains how vendors like Google became directly liable under HIPAA in 2013.

Which Google Workspace plans can sign the BAA?

Google's HIPAA pages don't publish a list of qualifying editions. The condition they state is an administrator account on a Google Workspace or Cloud Identity account, with two exclusions: non-administrators and the legacy edition above. So the honest answer to "which Google Workspace plan is HIPAA compliant" is that Google's pages describe the BAA in terms of the account and its administrator, not a pricing tier, and that you should open Legal and compliance in your own Admin console and confirm the amendment is offered there before you buy or move anything.

Editions still matter, for two reasons:

  • Features differ.Google Vault is on the covered list "if applicable," because only some editions include it. Meet recording, client-side encryption and hosted S/MIME also depend on your edition. The Gmail, Drive and Meet guides list which editions have what.
  • Gemini differs.Google's admin page on the Gemini app marks HIPAA support only for editions where the Gemini app is a Workspace core service, such as Business Starter, Standard and Plus, Enterprise Standard and Plus, and the Frontline editions. It lists Workspace Individual, Essentials Starter, Cloud Identity, Chrome Enterprise, Android Enterprise and the legacy G Suite among editions where the Gemini app is only an additional service, without HIPAA support.

Which Google Workspace apps are covered by the BAA?

Google's BAA points to its HIPAA Included Functionality list, which now lives on Google's HIPAA compliance page (page updated October 20, 2026; the Workspace list is dated August 31, 2025). Today it names:

  • AppSheet
  • Cloud Identity Management
  • Gemini App (excluding Gemini in Google Chrome)
  • Gemini in Google Workspace
  • Gemini Mac App
  • Gmail
  • Google Apps Script
  • Google Calendar
  • Google Chat
  • Google Cloud Search
  • Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides, and Google Vids)
  • Google Groups
  • Google Keep
  • Google Meet
  • Google Sites
  • Google Tasks
  • Google Vault (if applicable)
  • Google Voice (managed users only)

Two answers people search for follow directly. Google Forms is covered, as part of Drive, in a Workspace account with the BAA accepted. Google Calendar is covered too. Neither is covered in a personal account.

What the BAA doesn't cover

Google's HIPAA Implementation Guide (September 2025) sorts everything else into places where client information is not permitted:

  • Google Contacts.The guide's table of "Core Services in which PHI is not permitted" names one service: Google Contacts. Gmail can save everyone you email to Contacts automatically, so this one catches people out; the Gmail guide shows the setting.
  • Any core service that isn't on the list."Any Core Service not listed in section 1 may not be used in connection with PHI." That includes NotebookLM, which Google is renaming Gemini Notebook. Google made it a Workspace core service for Business and Enterprise customers in February 2025, but it isn't on the HIPAA list, and its admin page lists its compliance certifications, SOC and ISO among them, without HIPAA. (Google Cloud's separate BAA lists a product called Gemini Notebook Enterprise, bought through Google Cloud under a different agreement.)
  • Gemini in Chrome, and the Gemini app outside your Workspace terms."Access to the Gemini app via Gemini in Chrome is not HIPAA compliant," and "Access to Gemini app as an Additional Product is not HIPAA compliant." For users without a qualifying edition, Google says chats "may be reviewed by human reviewers."
  • Additional Google services.YouTube, Blogger and similar services "must be disabled for Google Workspace users who manage PHI" unless a separate BAA covers them, and Google's help page adds that the BAA terms don't "extend to Additional Google Services." The guide names Google Photos here too, while the covered list includes Photos inside its Drive entry. Our Drive guide suggests keeping client images out of Photos until Google confirms which applies to your account.
  • Third-party apps and add-ons."Third-party applications including add-ons are not included in the Included Functionality covered by the BAA." That covers Marketplace apps, Docs and Gmail add-ons, third-party Chat apps, Chrome extensions and note-taking bots that join meetings. Each needs its own agreement with you.
  • Google's technical support."Customers should not provide PHI to Google when accessing technical support services."
  • Preview features.Don't use pre-GA offerings with client information "unless expressly noted otherwise."

Is Gemini HIPAA compliant?

Some of it is, under the right account. Gemini in Google Workspace (the side panel and features such as "help me write" in Gmail) is on the covered list, and the guide says "the same recommendations provided in this guide will apply" when it's used with PHI. The Gemini app at gemini.google.com and on mobile is covered only as a Workspace core service, signed in with your practice account, on an edition that offers it that way. Gemini in Chrome isn't covered, and neither is a personal Gemini account. Gemini Notebook (formerly NotebookLM) is a separate product and isn't on the list. Being covered answers the BAA question only. Whether to put client information into Gemini at all is a separate decision about consent, clinical judgment and your state's law.

Each Google service at a glance

One line per service: whether it's covered, the one setting that matters most, and where to read more.

  • Gmail:covered. Turn off automatic forwarding to outside addresses, and require TLS for professionals you email often. Gmail guide.
  • Google Calendar:covered. In Calendar sharing settings, limit external sharing to showing busy times with event details hidden, use neutral event titles, and mark entries with client details Private (Google).
  • Calendar appointment schedules:part of Calendar. The booking page title "is visible to anyone who has the link," so keep it and any extra booking questions non-clinical. A Stripe account connected for payments is a separate company outside Google's BAA (Google).
  • Google Drive, Docs, Sheets, Slides and Vids:covered. Set Access Checker to "Recipients only" so no client file goes to "Anyone with the link." Drive guide.
  • Google Forms:covered, as part of Drive. Turn off "View results summary" on any form clients fill in. Drive guide, Forms section.
  • Google Meet:covered. Set meetings to Restricted with the host joining first, and decide whether recording is allowed at all. Meet guide.
  • Google Voice:covered for managed users only. Confirm Settings shows "This account is managed by your Google Workspace administrator." Voice guide.
  • Google Chat:covered. Turn off "Allow users to install Chat apps," and keep client names out of space names; the guide warns that new members "will be able to see previous chat history."
  • Google Keep:covered. Notes are private by default; anyone you add as a collaborator can view and edit everything in the note.
  • Google Sites:covered. Don't publish a site holding client information outside your domain, and keep AdSense off it. A public practice website shouldn't hold client information at all.
  • Google Groups:covered. Set group access to Private, and use Bcc when you email a group.
  • Google Tasks:covered. Tasks are always private to the person who made them.
  • Google Vault:covered where your edition includes it. Retention rules can delete data on a schedule, so set them with care.
  • Gemini in Google Workspace and the Gemini app:covered as described above. Turn off Gemini in Chrome.
  • AppSheet, Apps Script and Cloud Search:covered. If you build anything that touches client information, limit access to people allowed to see it.
  • Google Contacts:not covered. Keep client details out, and stop Gmail from saving everyone you email.
  • NotebookLM, now Gemini Notebook:not on the list. Don't upload client information, and set its Service status to Off for client work in the Admin console.
  • YouTube, Blogger and other additional services:not covered. Turn them off for anyone who handles client information.
  • Add-ons, Marketplace apps and browser extensions:not covered. Allow only those whose maker signs a BAA with you.
  • Anything in a personal Google account:not covered.

The main settings in Google's HIPAA Implementation Guide

The guide is eight pages long, and most of it fits a solo or small group practice. These are its main recommendations, in the order a practice would work through them.

  1. Separate the people who handle client information. "In a small Google Workspace account, for instance, there are typically two or three organizational units." Put everyone who works with clients in one unit, so you can switch services off for them without affecting anyone else (how organizational units work).
  2. Turn off services outside the BAA for that unit. In the Admin console, go to Apps, then Additional Google services, and switch off YouTube, Blogger, Photos and anything else you don't need for client work. Turn off core services that aren't on the list too, such as Gemini Notebook, which has its own Service status setting.
  3. Control apps and add-ons. Under Apps, Google Workspace Marketplace apps, Apps list, User Install Settings, you can let users install "any apps, only allowlisted apps, or no apps" (Google). Pick allowlisted or none, and switch off Chat apps and Drive add-ons that lack their own BAA.
  4. Set sharing defaults. For Drive, restrict sharing outside the domain and set the default visibility to private. For Calendar, show outsiders busy times only and keep internal sharing minimal for anyone who handles client information.
  5. Keep client details out of names. The guide recommends that users "avoid putting PHI in titles" of files, folders and shared drives, and the same habit applies to Chat spaces, Groups and calendar events. Our list of the 18 HIPAA identifiers shows what counts.
  6. Watch the account. Set alerts for "suspicious login attempts," new administrators and password changes, and, where your edition has them, run file exposure reports to catch files shared outside the practice.
  7. Turn off search history where others could see it. The guide recommends turning it off "for services where the search history may be accessed beyond the individual account."
  8. Set the Gemini options. Offer the Gemini app only as a Workspace core service, and turn off Gemini in Chrome.
  9. License Voice users. "Administrators should obtain Google Voice licenses for users that handle PHI."

Two settings the guide doesn't dwell on belong on the same list. Require 2-Step Verification for every account; Google calls security keys "the most secure form of 2SV" because they "protect against phishing threats" (Google). And give each person who helps you, such as a biller or an assistant, their own account. No shared logins.

What stays your job, even with the BAA

The BAA makes Google's services eligible for client information. It doesn't make your practice compliant, and HHS's cloud guidance says so from the other direction: "A CSP is not responsible for the compliance failures that are attributable solely to the actions or inactions of the customer." Google's guide adds that "Customers are responsible for fulfilling an individual's right of access, amendment, and accounting." In practice, these stay with you:

  • A risk analysis.It is a required implementation specification: "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities" to the ePHI you hold (45 CFR 164.308). HHS calls it "the first step in an organization's Security Rule compliance efforts" (Guidance on Risk Analysis), and HHS and ONC publish a Security Risk Assessment Tool for small practices.
  • Written policies, kept for six years.Your policies and risk analysis must be kept "for 6 years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.316). The BAA screenshot belongs in the same file.
  • The settings above, and keeping them that way.A new add-on, a new staff member or a new Google feature can undo a careful setup.
  • Agreements with everyone else.Google's guide says customers are "solely responsible for determining if they require a BAA or any other data protection terms in place with a third party."
  • What you share and with whom.The BAA doesn't decide whether a disclosure is allowed. Our guide to what therapists can share under HIPAA covers minimum necessary, family members and releases.
  • Clients' records requests and breaches.Google won't gather a client's records for you or notify clients for you.
  • Devices.Files on a laptop, a downloaded spreadsheet or a printed form are outside the BAA, which excludes "offline or on-premise storage tools." Screen locks, disk encryption and no practice account on a shared family computer are yours to arrange.

HHS has also proposed an update to the Security Rule, published on January 6, 2025. As of this writing no final rule has been published, so the current rule applies.

Where client information slips outside the BAA

These are the everyday ways a covered account ends up holding client information somewhere it shouldn't. None is a flaw in Workspace; each is about how it's used.

  • Two accounts in one browser.A meeting created, a file saved or a Gemini chat started from the personal account instead of the practice one. Check the account picture, or keep a separate browser profile for practice work.
  • Gemini in Chrome or a personal Gemini account.Pasting a session summary into either is outside the BAA.
  • NotebookLM (Gemini Notebook).Uploading notes or intake answers to organize them puts client information in a service Google hasn't listed.
  • Contacts saved automatically.Every client you email can end up in "Other contacts," with no BAA coverage.
  • An add-on or extension.E-signature tools, scheduling add-ons, grammar checkers and meeting bots often read the content they work on.
  • A support ticket.A screenshot sent to Google support with a client's name in it.
  • Copies on your devices.Downloaded form responses, files mirrored by Drive for desktop, and email attachments saved to a desktop folder.

A Google Workspace HIPAA checklist for therapists

Checklist20 checks in 4 groups

Account and agreement

Services

Sharing and names

Your records

A setup record you can copy

Paste this into your compliance file and fill it in. One field per line, so it reads on a phone.

Wording to copy26 lines
Google Workspace HIPAA setup recordPractice name:Workspace edition:Domain verified (yes/no):Super administrator:BAA accepted on (date):Where the BAA screenshot is saved:Organizational unit for client work:Covered services in use:Additional services turned off:Gemini Notebook off for client work (yes/no):Gemini in Chrome off (yes/no):Gemini app as a core service only (yes/no):Marketplace app setting (any/allowlist/none):Add-ons in use, each with its own BAA:2-Step Verification required (yes/no):Security keys for admins (yes/no):Drive external sharing setting:Calendar external sharing setting:Meet recording allowed (yes/no):Voice licenses assigned to:Login alerts sent to:Devices that hold copies of client files:Risk analysis completed (date):Next review (date):Completed by:

How this works in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and client forms in one place. You can keep Google Workspace for email and documents and run the client side of the practice in TranqBay:

  • Booking from your own practice website.Clients book individual or couples services, each with its own length and fee, or a package of sessions. You confirm each booking or let clients book straight away, and returning clients book their next session themselves.
  • Video sessions that come with a BAA.Sessions are end-to-end encrypted and HIPAA-ready. TranqBay's Business Associate Agreement applies when a therapist who is a covered entity accepts the Terms; there's no separate document to sign. You can read TranqBay's Business Associate Agreement before you decide anything.
  • Forms filled in online.Instead of building intake forms in Google Forms and managing a response sheet, you send forms from a library of ready-made templates, including intake forms, consent to treat, telehealth consent, release of information, PHQ-9 and GAD-7. The client fills them in online, and the answers wait with the session. TranqBay doesn't score forms automatically.
  • Notes written on the session.You choose BIRP, DAP, SOAP, GIRP or a blank note instead of keeping a Doc per client in Drive. Structured formats are part of the advanced note templates, which some plans include.

TranqBay's BAA covers TranqBay, not your Google account. If you keep anything about clients in Gmail, Drive or Calendar, keep Google's BAA and the settings above in place too. To see what your clients would see, look at a template practice website and its booking page on practice.tranqbay.health.

Questions to take to a healthcare attorney

  • Whether you're a covered entity, if you see only private-pay clients
  • Whether your edition can accept Google's BAA, if it's Workspace Individual, Essentials Starter or a Business edition on a Gmail address
  • Whether putting client information into Gemini features fits your consent forms, your state's law and your professional code
  • What agreement, if any, you need for a payment service connected to Calendar
  • What to do about client information already kept in a personal Google account

Frequently asked questions about Google Workspace and HIPAA

Is Google Workspace HIPAA compliant for therapists?

It can be used in a HIPAA-compliant way. A therapist needs a Google Workspace account, the BAA accepted by a super administrator, client information kept to the covered services, and the account set up as Google's Implementation Guide describes. A personal Google account can't be covered.

Is Google Workspace HIPAA compliant by default?

No. Buying Workspace doesn't accept the BAA, and Google says customers without one "must not use PHI." Even after you accept it, the settings, the people with access and the apps you add are your responsibility.

How do I sign a BAA with Google Workspace?

A super administrator goes to Account settings, then Legal and compliance in the Admin console, opens the Google Workspace/Cloud Identity HIPAA Business Associate Amendment, clicks Review and Accept, answers three questions and clicks OK. Save a screenshot as proof.

Which Google Workspace plan is HIPAA compliant?

Google doesn't publish a list of editions. Its pages describe the BAA in terms of an administrator on a Workspace or Cloud Identity account, and excludes the legacy edition sometimes called Google Apps Standard Edition. Confirm the amendment appears in your own Legal and compliance page. Features such as Vault differ by edition.

Is Google Forms HIPAA compliant?

Google Forms is covered by the BAA as part of Google Drive, in a Workspace account with the BAA accepted. A form made in a personal account isn't. Turn off "View results summary" and check who can open the response sheet; our Drive guide has the full list.

Is Google Calendar HIPAA compliant?

Google Calendar is on the covered list. Limit external sharing to busy times, use neutral event titles, and mark entries with client details Private. Remember that invites travel to your client's inbox, so keep reasons for visit out of them.

Is Gemini HIPAA compliant?

Gemini in Google Workspace is covered, and the Gemini app is covered when it's a Workspace core service on your practice account. Gemini in Chrome isn't, and neither is a personal Gemini account. Google's list doesn't include NotebookLM, which Google is renaming Gemini Notebook.

Does Google's BAA cover add-ons and Chrome extensions?

No. Google says "Third-party applications including add-ons are not included." Any add-on, Marketplace app, extension or meeting bot that touches client information needs its own agreement with you.

I only see private-pay clients. Do I need any of this?

Possibly not under HIPAA, if you never send standard electronic transactions and nobody does it for you. Your state's law and your ethics code still ask you to protect client information, and you may bill insurance later. Ask a healthcare attorney before you decide you're outside HIPAA.

Before you put client information in Google Workspace

Open Legal and compliance and confirm the BAA shows as accepted, save the screenshot, put client work in its own organizational unit with additional services off, limit apps to an allowlist, turn off Gemini in Chrome, and fill in the setup record above. Then open the guide for each app you use: Gmail, Drive and Forms, Meet and Voice.

If you'd rather run booking, sessions, notes and intake forms in one place with its own BAA, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works. For a wider look at video tools, see our guide to HIPAA compliant telehealth platforms.

Sources

21 sources

Google 14workspaceupdates.googleblog.com 1HHS 2Federal 1Regulations 3

Updated October 25, 2026. Found it useful? Send it to a colleague.

Run your practice in one place.

Your own website, online booking and video sessions.

  • Your own website
  • Online booking
  • Video sessions
See how it workspractice.tranqbay.health

More guides for therapists

All guides
Running a practice13 min

Clinical Supervision Topics: 57 Questions and 10 Activities

57 questions
Running a practice7 min

Therapist Email Signature: 10 Examples and What to Include

Examples
Running a practice8 min

Therapist Newsletter: 30 Ideas, a Template and the Rules

Template to copy

In crisis? Don't use this site. Get immediate help or call emergency services.