Conditional Google offers a BAA on paid Google Workspace and Cloud Identity editions. Consumer Gmail and the legacy free edition cannot accept it. Last verified 2026-10-20; next check 2027-01-20.
Short answer
A BAA is available on paid editions for Gmail and the other listed services. A super administrator accepts it electronically in the Admin console. Not covered: the legacy free edition, non-administrator users, third-party applications and add-ons, and Additional Google Services.
A personal @gmail.com account has no Admin console, so there is nowhere to accept a BAA. A practice using one for patient email has no BAA with Google. For other tools, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
Gmail itself has no plan structure; the BAA comes with the paid Google Workspace or Cloud Identity edition the account sits on. For the suite-level check, see Is Google Workspace HIPAA compliant?
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Business Starter | Available | Super administrator accepts the Business Associate Amendment in Admin console > Account settings > Legal and compliance | None stated |
| Business Standard | Available | Same | None stated |
| Business Plus | Available | Same | None stated |
| Enterprise | Available | Same | None stated |
| Cloud Identity | Available | Same | None stated |
| Legacy free edition | Not available | None | n/a |
| Consumer Gmail | Not available | No Admin console to accept it | n/a |
Minimum seat count for the BAA: Not published by the vendor. Business Starter is listed from €6.80 per user/month on an annual commitment (pricing page served in EUR).
What the BAA covers and what it excludes
Covered services listed by Google:
- Gmail
- Google Calendar
- Google Drive (see Google Drive)
- Google Meet
- Google Chat
- Google Vault (if applicable)
Excluded:
- Third-party applications, including add-ons
- Additional Google Services
The BAA is accepted by the customer's super administrator. According to the sources below, it does not extend to non-administrator users or consumer accounts.
In practice, a clinic that installs a scheduling or CRM add-on in Gmail has moved PHI into a service outside this BAA. The same applies to a staff member who signs in to an Additional Google Service with their work account.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published" refers only to the pages listed under Sources. It does not mean the control is missing. Ask the vendor for its security documentation.
How to use Gmail with PHI
- Confirm the account is on a paid Workspace or Cloud Identity edition, not consumer Gmail or the legacy free edition.
- Have a super administrator accept the BAA in Admin console > Account settings > Legal and compliance before any PHI is sent or stored.
- Use only the covered services listed above.
- Keep add-ons and Additional Google Services off for users who handle PHI.
- Set access, retention and offboarding policies: who may read shared mailboxes, how long messages are kept, and how access is removed when staff leave.
- Train staff on what may go in email. For example, define whether patient names may appear in subject lines.
- Check Google's position on Gmail confidential mode before relying on it:.
Compliance depends on the signed BAA, configuration and policies, not on Gmail alone. For BAA and PHI definitions, see the HIPAA glossary.
Alternatives with a BAA
Each verdict is conditional and depends on plan and configuration.
- GoDaddy: Microsoft 365 email on plans GoDaddy represents as HIPAA-compliant. GoDaddy
- Google Workspace: the suite-level check linked above.
- Hushmail for Healthcare: from Healthcare Basic.
- Microsoft 365: from Business Basic. Microsoft 365
- Outlook / Exchange Online: Microsoft 365 Business. Outlook / Exchange Online
The email category table is part of HIPAA-compliant software by category.
Sources
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-20. "is made available to customers for electronic acceptance via their Admin console."
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-20. "Third-party applications including add-ons are not included in the Included Functionality covered by the BAA."
- Privacy, compliance, and records for Google Workspace and Cloud Identity — Help article, checked 2026-10-20. "cannot review and accept a BAA from Google at this time."
- HIPAA Compliance on Google Cloud — Trust center, checked 2026-10-20. "The following Google Workspace services are included in the Google Cloud BAA:"
- Google Workspace pricing — Pricing page, checked 2026-10-20. "Business Starter"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-20. Other updates are listed under recent changes.
FAQ
Is consumer Gmail HIPAA compliant?
No BAA path exists for it. A consumer account has no Admin console in which to review and accept a BAA. PHI in a personal @gmail.com account is not covered by any Google BAA.
How do I get a BAA for Gmail in Google Workspace?
You need a paid Google Workspace or Cloud Identity edition. A super administrator signs in to the Admin console and goes to Account settings > Legal and compliance. There they review and accept the Business Associate Amendment. No extra cost is stated, and the minimum seat count is not published by the vendor.
Are add-ons and third-party apps covered by Google's BAA?
No. Google's page excludes third-party applications, including add-ons, and Additional Google Services. If PHI passes through one, it needs its own BAA with that vendor, or it should be turned off for those users.
Which other Google services are covered with Gmail?
Google Calendar, Google Drive, Google Meet, Google Chat and Google Vault (if applicable).