Conditional A BAA is available on paid Google Workspace editions and Cloud Identity, and Google Calendar is a covered service under it. The main exclusions are the legacy free edition, personal Google accounts and third-party add-ons. Verdict date: 2026-10-28.
Short answer
Google offers a BAA through the Google Workspace HIPAA Business Associate Amendment, which a super administrator accepts in the Admin console. Google Calendar is on the covered-services list. Customers without a signed BAA must not use PHI in Workspace services, Calendar included.
Calendar reminders and event details created in a covered, BAA-signed account fall under the same terms as the rest of Calendar. Reminders in personal accounts do not.
For other tools evaluated the same way, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
The BAA is tied to the account type, not to Calendar as a product. The Workspace-wide answer is on Is Google Workspace HIPAA compliant?.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Google Workspace paid editions | Available | A super administrator confirms covered-entity status and accepts the amendment in Admin console > Account settings > Legal and compliance > Security and Privacy Additional Terms. | Not published by the vendor |
| Cloud Identity | Available | Same acceptance flow in the Admin console | Not published by the vendor |
| Legacy free edition | Not available | None | Not applicable |
| Consumer Google accounts (personal Gmail) | Not available | None | Not applicable |
Business Starter lists from €6.80 per user per month as a regional price; the US list price differs.
What the BAA covers and what it excludes
Covered services under the BAA:
- Google Calendar
- Gmail (see Is Gmail HIPAA compliant?)
- Google Chat
- Cloud Search
- Drive, including Docs, Forms, Photos, Sheets, Slides and Vids
- Meet (see Is Google Meet HIPAA compliant?)
- Keep
- Vault, if applicable
- Voice, for managed users only
- The Gemini app, excluding Gemini in Chrome
Not covered:
- Third-party apps and add-ons from the Workspace Marketplace
- Additional Google Services not on the Included Functionality list
- Gemini in Google Chrome
- The legacy free edition and personal accounts
The BAA defines Covered Services by the URLs in its Attachment 1. It puts responsibility for how end users use the services on the customer. A Calendar-linked scheduling add-on or a booking-page plugin from the Marketplace sits outside the amendment unless that vendor signs its own BAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Absence on the pages checked is not a statement that a control does not exist. Ask Google for current reports and documentation before relying on any of them.
How to use Google Calendar with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the product alone. A practical checklist for a clinic:
- Confirm your organization is a covered entity or business associate before accepting the amendment.
- Have a super administrator accept the BAA before any PHI enters Calendar. Customers without a signed BAA must not use PHI.
- Use only paid, managed Workspace or Cloud Identity accounts. Front-desk staff should not use personal or legacy free accounts for patient appointments.
- Block or review Marketplace add-ons and any Google service not on the covered list.
- Apply minimum necessary to event titles, descriptions and attendees. "Follow-up, J.D." exposes less than a diagnosis in the title, and invitations sent to outside addresses carry whatever the event contains.
- Manage access and offboarding: remove departed staff, and review who has access to shared calendars.
- Train staff on what may go into events and reminders.
For BAA and PHI terms, see the HIPAA glossary. For implementation help, see the HIPAA guides.
Alternatives with a BAA
Verdicts reflect each vendor's published terms. The order is not a ranking, and no payment influences it. Category overview: HIPAA-compliant software by category.
- Acuity Scheduling: conditional, BAA from the Premium plan.
- Jane App: yes, from the Balance plan.
- SimplePractice: yes, from the Starter plan.
- Square: conditional, from Square Free.
- Vagaro: conditional, for medical spa and wellness customers; plan not specified.
Sources
- Privacy compliance and records for Google Workspace and Cloud Identity — Help article, checked 2026-10-28. "You must be signed in as a super administrator for this task. […] Non-administrator Google Workspace or Cloud Identity users [and] users of the legacy free edition of Google Workspace […] cannot review and accept a BAA from Google at this time."
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-28. "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services. […] Third-party applications including add-ons are not included in the Included Functionality covered by the BAA."
- HIPAA compliance on Google Cloud and Google Workspace — BAA page, checked 2026-10-28. "The following Google Workspace services are included in the Google Cloud BAA: […] Google Calendar, Google Chat, Google Cloud Search, Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides, and Google Vids)"
- Google Workspace HIPAA Business Associate Addendum — Terms, checked 2026-10-28. ""Covered Services" means the Google products and/or services specifically listed in the URLs on Attachment 1 […] Customer is solely responsible for ensuring that its and its End Users' use of the Covered Services"
- Google Workspace pricing — Pricing page, checked 2026-10-28. "€3.40€6.80** / user per month […] Price is per user/month and does not include tax"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Is Google Calendar HIPAA compliant on a free personal Google account?
No BAA is available for personal Google accounts or the legacy free edition of Google Workspace. Do not put PHI in Calendar on those accounts.
Can I put patient information in Google Calendar events and reminders?
Only in a paid, managed Workspace or Cloud Identity account where a super administrator has accepted Google's BAA, and Calendar is on the covered-services list. Without a signed BAA, PHI must not go into Workspace services. Even with one, keep event titles, descriptions and attendee lists to the minimum necessary.
Who can accept Google's HIPAA BAA and where?
A super administrator, in the Admin console under Account settings > Legal and compliance > Security and Privacy Additional Terms, after confirming covered-entity status.
Are third-party calendar add-ons covered by Google's BAA?
No. Apps and add-ons from the Workspace Marketplace are excluded, as are Google services not on the Included Functionality list. An add-on that touches PHI needs its own BAA with its vendor.