Is Google Workspace HIPAA Compliant?Gmail, Drive, Docs and Meet

Yes, Google Workspace can be HIPAA compliant, but only if your administrator accepts Google's Business Associate Amendment (BAA) and you configure the account. A free @gmail.com account does not qualify. This guide lists the covered services, the gaps, and the settings to change. We checked Google's pages on October 9, 2026.

Google Workspace and HIPAA at a glance

• Verdict: yes, with a BAA and the right settings.
• Free Gmail: no. Google offers the BAA through the Workspace Admin console, and a free account has no Admin console.
• Who accepts the BAA: a super administrator, under Account settings, then Legal and compliance.
• Covered: Gmail, Drive, Docs, Sheets, Slides, Forms, Calendar, Meet, Chat, Keep, Sites, Tasks, and Gemini in Workspace.
• Google Voice: covered for managed users only.
• Not covered: third-party apps and add-ons, and Gemini in Chrome. Google Contacts may not hold PHI.
• Google's own guide: the Google Workspace and Cloud Identity HIPAA Implementation Guide, dated September 2025.

Is Gmail HIPAA compliant?

Gmail is HIPAA compliant only inside a Google Workspace account with an accepted BAA. Google states that customers without a BAA "must not use PHI in Google Workspace or Cloud Identity services." PHI means protected health information.

A personal @gmail.com address is a different product. It has no Admin console, so there is no BAA to accept. A practice that emails patient details from a free Gmail account has no agreement with Google covering that data.

The agreement matters under federal rules. HHS guidance on cloud computing says a cloud provider that stores electronic PHI is a business associate, even when the data is encrypted. A practice that uses one without a BAA "is in violation of the HIPAA Rules."

Which Google services does the BAA cover?

The BAA covers the services on Google's HIPAA Included Functionality list. Google's implementation guide of September 2025 lists them and gives settings for each.

Google says it may add products to the list over time. Check Google's current list before you rely on this table.

Are Google Drive and Google Meet HIPAA compliant?

Yes, both are covered by the BAA. Each has one setting that practices often miss.

• Drive titles. Google's guide recommends that users "avoid putting PHI in titles of such files, folders, or Shared Drives." A file named with a patient's name and diagnosis breaks that advice.
• Drive sharing. Google advises sharing with specific people instead of anyone with the link. Admins can set new files to private by default.
• Meet recordings. A recording saves to the meeting owner's Drive and is shared automatically with the calendar guests. Check the guest list before you record a session.

How do you set up Google Workspace for HIPAA?

Follow these six steps in order. The first two decide whether you are covered at all.

1. 1

   Confirm the account type

   You need a Google Workspace account with an Admin console. Move staff off personal @gmail.com addresses for anything involving patients.

2. 2

   Accept the BAA

   Sign in as a super administrator. Open the Admin console, then Account settings, then Legal and compliance. Review and accept the BAA. Keep a screenshot of the acceptance for your records.

3. 3

   Lock down sharing

   Set new Drive files to private by default. Restrict sharing outside your domain. Set calendars to share free/busy only.

4. 4

   Clean up titles

   Remove patient details from file names, folder names, calendar entries, and Chat space names.

5. 5

   Review apps and add-ons

   List every third-party app connected to the account. Turn off any that touch patient data and have no BAA of their own.

6. 6

   Turn on alerts

   Set Admin console alerts for suspicious sign-ins and admin changes. Review the reports on a set schedule.

What does the Google BAA not cover?

The BAA does not cover anything outside the Included Functionality list. Five gaps matter most for a practice.

• Third-party apps. Google states that third-party applications, including add-ons, are not covered.
• Other Google services. Google says the BAA terms do not extend to its Additional Google Services.
• Gemini in Chrome. Google's guide says customers should not upload PHI into it.
• Support tickets. Google's guide says customers should not provide PHI to Google when they contact technical support.
• Pre-release features. The guide says not to use them with PHI unless a notice says otherwise.

Google Analytics is a separate case. Google does not offer a BAA for it. Read our guide on whether your website's tracking is HIPAA compliant.

How Webpatch helps

Webpatch is a technology company that works with healthcare practices. We build websites and manage their security, HIPAA compliance, SEO, and AEO. We check how a practice's website, forms, and email connect, so patient information stays inside tools that have a BAA. Contact us to review your setup.

We are not a law firm. We handle the technical side and work alongside your privacy officer or attorney.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.