Is Google Workspace HIPAA compliant? BAA by plan, covered services and exclusions

Google offers a BAA on paid Google Workspace and Cloud Identity editions, including Business Starter, for a listed set of services, and a super administrator must accept it before any PHI is stored. Gmail is covered once the BAA is accepted. Free consumer Gmail is not.

Short answer

Google makes a business associate agreement available on paid editions for Gmail, Drive (Docs, Sheets, Slides, Forms), Meet, Calendar, Chat and Gemini in Google Workspace. A super administrator accepts it in the Admin console. Until that happens, nothing in the account is covered, even on a paid plan.

For the email questions: Gmail in a paid, admin-managed Workspace account is covered under a signed BAA. A personal @gmail.com account is not. See Is Gmail HIPAA compliant? for the Gmail-specific entry, and Is it HIPAA compliant? All vendors for the full directory.

On cost: Business Starter starts at €6.80 per user per month with an annual commitment. The BAA is offered within the subscription, and no extra charge is stated.

Which plans include a BAA

Plan	BAA	How it is obtained	Extra cost
Business Starter, Standard, Plus; Enterprise; Essentials; Frontline; Education; Nonprofits	Available	Super administrator accepts it in the Admin console	None stated
Cloud Identity (paid)	Available	Same acceptance process	None stated
Legacy free edition (Google Apps Standard Edition)	Not available	n/a	n/a
Personal/consumer Google accounts	Not available	n/a	n/a

So Business Starter is eligible. Minimum seat count: Not published by the vendor.

To accept the BAA, a super administrator goes to Admin console > Account > Account settings > Legal and compliance > Security and Privacy Additional Terms > HIPAA Business Associate Amendment > Review and Accept. The administrator then answers three questions about covered-entity status.

What the BAA covers and what it excludes

Covered services (the Included Functionality list):

• Gmail
• Drive, including Docs, Sheets, Slides, Forms, Photos and Vids (Google Drive HIPAA status)
• Meet (Is Google Meet HIPAA compliant?)
• Calendar, Chat, Groups, Keep, Sites, Tasks
• Gemini in Google Workspace
• Gemini App (excluding Gemini in Chrome) and Gemini Mac App
• Apps Script, Cloud Search, AppSheet, Cloud Identity Management
• Vault (if applicable)
• Voice (managed users only)

Excluded:

• Third-party applications and add-ons.
• Additional Google Services outside the Included Functionality.
• Gemini in Google Chrome, which is automatically blocked for BAA customers.

Some other Gemini features may also be blocked for customers who have signed the BAA.

A clinic example: a front desk that emails appointment reminders from a paid Business Starter account is inside the list. A scheduling add-on installed from a marketplace is not, unless that vendor signs its own BAA.

Security controls the vendor publishes

Control	Published status
Encryption in transit	Not published by the vendor
Encryption at rest	Not published by the vendor
Audit log	Not published by the vendor
Access controls	Not published by the vendor
SSO	Not published by the vendor
Data residency	Not published by the vendor
SOC 2	Not published by the vendor
HITRUST	Not published by the vendor
ISO 27001	Not published by the vendor

This reflects the pages cited below, not a statement that the controls do not exist.

How to use Google Workspace with PHI

1. Have a super administrator accept the BAA before any PHI enters the account.
2. Use only paid, admin-managed accounts. Personal Gmail and Drive accounts must never hold PHI, including forwarded patient emails.
3. Keep PHI to services on the Included Functionality list.
4. Block or avoid third-party add-ons and Additional Google Services unless the vendor has its own BAA.
5. Configure sharing, access and user offboarding. Departing staff should lose access the same day.
6. Review which Gemini features the BAA blocks and manage them for your users.
7. Write staff policies and train staff, and follow Google's Workspace HIPAA Implementation Guide. More in the HIPAA guides.

Compliance depends on the signed BAA, your configuration and your policies. The BAA alone does not provide it.

Alternatives with a BAA

Listed alphabetically; placement does not depend on payment or on Chanty's interest. Chanty, Inc. publishes this directory and lists Chanty as one vendor among others.

• Box: conditional, BAA from Enterprise. Is Box HIPAA compliant?
• Chanty: conditional, BAA from the Business plan; AI agents are Enterprise only. Internal staff communication, not patient messaging.
• Doxy.me: yes, BAA on Free.
• Dropbox: conditional, BAA from Standard. Is Dropbox HIPAA compliant?
• Gmail in Google Workspace: conditional, BAA from Business Starter. Is Gmail HIPAA compliant?

Browse by category: HIPAA-compliant team chat tools, HIPAA-compliant email, and office suites, file sharing and video conferencing in the category hub.

Sources

Changes

No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.