Is Google Workspace HIPAA compliant?

Yes, for the Google Workspace and Cloud Identity services on Google's HIPAA Included Functionality list, once an administrator accepts Google's Business Associate Amendment (BAA) in the Admin console. Third-party add-ons and Additional Google Services are outside the BAA.

How does a Google Workspace customer enter the BAA?

A Google Workspace customer enters the BAA by accepting it electronically in the Admin console. Customers subject to HIPAA must enter the BAA before they use the services on the HIPAA Included Functionality list, and the BAA takes effect on the date the customer accepts it.

Which Google Workspace services does the BAA cover?

The BAA covers the Covered Services, which are the Google products and services listed at the URLs in its Attachment 1. The table below sets out each group of Google services, whether the BAA covers it and how the BAA is accepted.

Can Google remove a service from the Google Workspace BAA?

Yes, Google may change the covered list, but Google may remove a Covered Service only with at least 12 months' prior notice. The BAA text was last modified August 25, 2021.

What does the Google Workspace BAA leave out?

The Google Workspace BAA leaves out PHI that a customer creates, receives, maintains or transmits outside the Covered Services, including PHI in offline storage and in third-party applications. Third-party applications, including add-ons, are not included in the functionality the BAA covers.

Are Additional Google Services covered by the BAA?

Additional Google Services sit outside the BAA, because neither the Cloud Data Processing Addendum (CDPA) nor the Google Workspace BAA terms extend to them. A practice that uses one of those services has no BAA for the PHI handled there.

Who must accept the BAA before a practice uses patient information in Google Workspace?

Google Workspace administrators must review and accept the BAA before PHI is used in Google services. A customer that has not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services.

Can a free or personal Google account use the BAA?

A free or personal Google account does not meet the BAA's conditions. The BAA is valid only where the customer has an existing Services Agreement with Google, and an administrator must accept it in the Admin console. Without both, the customer must not use PHI in Google Workspace or Cloud Identity services.

Which setup steps does Google's BAA require?

Google's BAA requires a practice to hold an existing Services Agreement with Google, have an administrator accept the BAA in the Admin console, and keep PHI inside the Covered Services. The four steps below come from Google's BAA terms and help pages.

1. Confirm the practice has an existing Services Agreement with Google, which the BAA requires.
2. Have an administrator review the BAA and accept it electronically in the Admin console before any PHI is used.
3. Use only services on the HIPAA Included Functionality list, since other Google products and features fall outside the BAA.
4. Keep PHI out of third-party applications and add-ons, and out of offline storage, because the BAA excludes both.

Where does fax fit when a practice sends patient documents?

A practice that must send patient records to an outside fax number needs a fax service that signs a BAA. Whether a fax service needs a BAA explains that step. A fax add-on installed in Google Workspace is a third-party add-on, which the BAA does not cover. A practice that sends faxes from a Gmail or Outlook inbox can read how to send a HIPAA fax from Gmail or Outlook.

Every Fax Pigeon plan includes the business associate agreement Fax Pigeon signs at signup, along with your own number.

* Google's HIPAA and BAA terms were read on its own site on October 13, 2026. Fax Pigeon is not affiliated with Google.