Conditional A BAA is available on paid Google Workspace and Cloud Identity accounts, which covers Google Drive. Consumer Google accounts and the legacy free edition are the main exclusions (last verified 2026-10-20).
A clinic can put PHI in Drive only if a super administrator has accepted Google's BAA for a paid account first, and only in the services that BAA covers. A front-desk staffer's personal Gmail Drive is outside it.
Short answer
Google offers a BAA that covers Google Drive, Docs, Sheets, Slides, Forms and Vids as HIPAA Included Functionality. An administrator accepts it in the Admin console. Consumer accounts and the legacy free edition cannot accept it. Third-party apps and add-ons are not covered.
Google states that customers without a signed BAA must not use PHI in Google Workspace or Cloud Identity services. See the HIPAA glossary entries for BAA and PHI for the terms, or browse all vendor HIPAA checks.
Which plans include a BAA
Drive's BAA position follows the account type, not the Drive app. For the wider suite, see Is Google Workspace HIPAA compliant?
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Google Workspace (paid editions) | Available | A super administrator reviews and electronically accepts the BAA in the Admin console under Account settings > Legal and compliance, before any PHI is used | None. Minimum seats: Not published by the vendor |
| Cloud Identity | Available | Same acceptance steps in the Admin console | None. Minimum seats: Not published by the vendor |
| Consumer Google accounts (personal Drive) | Not available | Cannot accept the BAA | Not applicable |
| Legacy free edition of Google Workspace | Not available | Cannot accept the BAA | Not applicable |
Entry pricing on Google's pricing page:.
What the BAA covers and what it excludes
Covered services:
- Google Drive
- Google Docs
- Google Sheets
- Google Slides
- Google Forms
- Google Vids
For the document editor specifically, see Is Google Docs HIPAA compliant?
Excluded:
- Third-party applications and add-ons
- Gemini in Chrome
- Google Contacts
"HIPAA Included Functionality" is Google's term for services under the BAA. Google's implementation guide says these services must be configured by the customer organization to be HIPAA compliant. The BAA makes Drive eligible to hold PHI. It does not configure sharing, access or staff behavior for you.
In practice, a scheduling add-on that reads Drive files, or a contact list kept in Google Contacts, sits outside the agreement. Treat each as a separate vendor decision.
For comparison across tools, see HIPAA-compliant software by category, including file sharing, storage and backup.
Security controls the vendor publishes
The table reflects only what Google publishes on the pages checked. Gaps are left as gaps.
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" means the pages checked do not state it. It does not mean the control is absent.
How to use Google Drive with PHI
Compliance depends on the signed BAA, correct configuration and organizational policies. A practical checklist:
- Confirm the organization runs a paid Google Workspace or Cloud Identity account, not personal accounts or the legacy free edition.
- Have a super administrator accept the BAA in the Admin console (Account settings > Legal and compliance) before any PHI enters Drive.
- Restrict PHI to the covered services: Drive, Docs, Sheets, Slides, Forms and Vids.
- Keep third-party add-ons, Gemini in Chrome and Google Contacts away from PHI.
- Configure sharing and access controls so only the staff who need a patient file can open it.
- Set written staff policies and train staff, for example on never moving a patient spreadsheet to a personal account.
- Remove access promptly when staff leave.
Alternatives with a BAA
Each vendor below offers a BAA on the plan listed. Order is alphabetical and does not reflect payment or preference.
- Is AWS HIPAA compliant?: conditional; BAA for all AWS accounts.
- Backblaze: conditional; BAA for B2 Cloud Storage business customers.
- Is Box HIPAA compliant?: conditional; BAA on Enterprise.
- Carbonite: conditional; BAA on Safe Backup Pro Core, Power and Ultimate.
- Is Dropbox HIPAA compliant?: conditional; BAA on Standard.
Sources
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-20. "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services."
- Google Workspace and Cloud Identity HIPAA Implementation Guide — Trust center, checked 2026-10-20. "HIPAA Included Functionality : All users can access this subset of Core Services for use with PHI under the BAA as long as the health care organization configures those services to be HIPAA compliant"
- HIPAA compliance on Google Cloud and Google Workspace — Trust center, checked 2026-10-20. "Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides, and Google Vids)"
- Privacy compliance and records for Google Workspace and Cloud Identity — Help article, checked 2026-10-20. "For customers with HIPAA compliance needs, Google offers a Business Associate Amendment"
- Google Workspace pricing — Pricing page, checked 2026-10-20. "Starter €6.80 / user per month"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is Google Drive HIPAA compliant?
Conditionally. A BAA is available on paid Google Workspace and Cloud Identity accounts for Drive, Docs, Sheets, Slides, Forms and Vids. It does not apply to personal accounts or the legacy free edition, and it does not cover third-party add-ons. The organization must also configure Drive correctly and maintain its own policies.
Can I use a personal Google account for PHI?
No. Consumer Google accounts cannot accept the BAA, and Google states that customers without a signed BAA must not use PHI in Google Workspace or Cloud Identity services.
How do I sign the Google Drive BAA?
A super administrator reviews and electronically accepts the BAA in the Admin console under Account settings > Legal and compliance. Do this before any PHI is used. Google lists no extra cost for the BAA.
Which Google services are covered, and which are excluded?
Covered: Google Drive, Docs, Sheets, Slides, Forms and Vids. Excluded: third-party applications and add-ons, Gemini in Chrome and Google Contacts.