Conditional Google offers a BAA to Google Workspace customers, and Google Chat is on the list of covered services once a super administrator accepts it in the Admin console. The main exclusion is third-party applications, including add-ons. Verdict date: 2026-10-20.
Short answer
Google makes a BAA available to Google Workspace and Cloud Identity customers. An administrator accepts it electronically, and Google Chat is listed as included functionality. See the glossary entries for BAA and PHI for the terms, and all vendor HIPAA checks for other tools.
Customers who have not accepted a BAA must not use PHI in Google Chat. Third-party apps and add-ons are not covered, so a clinic that installs a scheduling bot or a file-sync add-on in a Chat space has moved PHI outside the BAA.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Google Workspace (admin-managed) | Available | A super administrator accepts it in the Admin console under Account settings > Legal and compliance | Not published by the vendor; minimum seats not published |
No excluded plans or editions are listed in the sources checked, so none are named here. See Is Google Workspace HIPAA compliant? for the suite-level check.
Pricing context, which is not a BAA cost: Google's pricing source lists Business Starter from €6.80 per user per month on an annual commitment, with a €3.40 intro price for the first 3 months.
What the BAA covers and what it excludes
Covered services in the sources checked:
- Google Chat
- Gmail
- Calendar
- Drive (Docs, Sheets, Slides, Forms, Vids)
- Meet (see Is Google Meet HIPAA compliant?)
- Groups
- Keep
- Sites
- Tasks
- Vault (if applicable)
- Voice (managed users only)
- Gemini in Workspace
- Gemini App (excluding Chrome)
- AppSheet
- Apps Script
- Cloud Identity Management
- Cloud Search
Excluded:
- Third-party applications, including add-ons
- Gemini in Google Chrome
Google Chat is on the covered list. The sources checked name no Chat features excluded beyond third-party apps and add-ons.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published" means these values were not found in the Google pages checked for this entry. It is not evidence that a control is missing.
How to use Google Chat with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the product alone. A shared-responsibility checklist for a clinic or MSP:
- A super administrator accepts the BAA in the Admin console before anyone posts PHI. Staff using personal Gmail accounts are not under your organization's BAA.
- Restrict PHI to the covered services listed above.
- Do not install third-party apps or add-ons that can read Chat content unless that vendor has signed its own BAA with you.
- Keep Gemini in Chrome away from PHI. It is excluded.
- Manage user access and offboarding, so a departed front-desk employee loses access to spaces holding PHI.
- Write a staff policy on what may be shared in Chat, and train people on it.
More step-by-step material is in the HIPAA guides.
Alternatives with a BAA
All entries below are conditional on a signed BAA. They are listed alphabetically, with no ranking. Chanty, Inc. publishes this directory and is listed as one vendor among others. Browse HIPAA-compliant software by category for the team chat category.
- Chanty: conditional; BAA from the Business plan. The BAA covers messages, files, voice notes, tasks and Teambook. Chanty is internal staff communication, not patient messaging.
- Google Workspace: conditional; paid editions administered in the Admin console. See Is Google Workspace HIPAA compliant?.
- Microsoft Teams: conditional; BAA from Teams Essentials.
- Slack: conditional; Enterprise Grid / Enterprise+.
- Zoom: conditional; from Pro. See Is Zoom HIPAA compliant?.
Sources
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-20. "The HIPAA BAA is made available to customers for electronic acceptance via their Admin console."
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-20. "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services."
- HIPAA compliance on Google Cloud and Google Workspace — BAA page, checked 2026-10-20. "The following Google Workspace services are included in the Google Cloud BAA: AppSheet Cloud Identity Management Gemini App (excluding Gemini in Google Chrome) Gemini in Google Workspace Gemini Mac App Gmail Google Apps Script Google Calendar Google Chat Google Cloud Search Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides, and Google Vids)"
- Compare Flexible Pricing Plan Options | Google Workspace — Pricing page, checked 2026-10-20. "Business Starter"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does Google sign a BAA for Google Chat?
Google makes a BAA available to Google Workspace and Cloud Identity customers. A super administrator accepts it electronically in the Admin console, and Google Chat is on the covered services list.
Can we put PHI in Google Chat before the BAA is accepted?
No. Customers who have not accepted a BAA must not use PHI in Google services. Acceptance is not automatic, and having a Workspace account does not mean PHI is allowed.
Are third-party apps and add-ons in Google Chat covered by the BAA?
No. Third-party applications, including add-ons, are excluded. Each one that touches PHI needs its own BAA with its vendor.
Is Gemini covered by the Google Workspace BAA?
Partly. Gemini in Workspace and the Gemini App (excluding Chrome) are on the covered list. Gemini in Google Chrome is excluded.