Yes, with conditions: Google offers a Business Associate Agreement (BAA) to all Google Cloud accounts for the services on its supported list. A BAA does not make a workload compliant. It only makes the listed services eligible to handle PHI.
Is Google Cloud HIPAA compliant? BAA by plan, covered services and exclusions
Yes A BAA is available to all Google Cloud accounts for the services Google lists as supported. The main exclusions are services not on that list and pre-GA offerings. Source: Google Cloud's HIPAA compliance page, checked 2026-10-20.
This page uses "BAA available on plan X for services Y" wording on purpose. Google Cloud is not "HIPAA certified," and compliance is not a property of the platform.
Short answer
Google makes the BAA available to all Google Cloud customers at standard pricing. You accept it online through Privacy compliance and records in Google Cloud. The BAA covers Google Cloud's entire infrastructure and a published list of supported products. Services not on that list, and pre-GA offerings, must not be used for PHI. For other vendors, see All vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| All Google Cloud accounts | Available | Review and accept the BAA online | None; same services at the same pricing |
No plan tiers apply and no plan is excluded. A solo practice and a hospital system use the same acceptance route.
What the BAA covers and what it excludes
Covered. The BAA covers Google Cloud's entire infrastructure, including all regions, zones, network paths and points of presence. Products named on Google's page include:
- Compute Engine
- Cloud SQL
- Cloud Storage
- BigQuery
- Google Kubernetes Engine
- Vertex AI Workbench instances
This is a partial list. The full supported-products list is on Google's page.
A clinic running a patient-intake application would typically use Compute Engine for the application and Cloud SQL for the database. It might keep scanned records in Cloud Storage. Each of those services has to be on the supported list before PHI goes into it.
Excluded.
- Any service not on the supported services list.
- Pre-GA offerings, unless the terms state otherwise.
Other Google products. Do not assume other Google products share this BAA. Check them separately: the Google Workspace HIPAA check and Is Gemini HIPAA compliant?.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | All regions and zones covered by the BAA |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" refers to the pages checked for this entry. It does not mean the control is absent.
How to use Google Cloud with PHI
Before any PHI reaches the platform, work through this checklist. Terms such as BAA and PHI are defined in the HIPAA glossary (BAA, PHI).
- Accept the BAA before any PHI is stored or processed.
- Use only services on Google's supported list.
- Keep pre-GA offerings away from PHI.
- Configure and secure your environment and applications to HIPAA requirements. Google states this is the customer's responsibility.
- Consider Cloud KMS if you have encryption requirements beyond the default at-rest encryption.
- Manage user access, including removing access when staff leave.
- Maintain staff policies and training.
Compliance depends on the signed BAA, your configuration and your policies, not on the platform alone.
Alternatives with a BAA
Each of these offers a BAA with conditions. Verdicts come from each vendor's own check.
- Amazon Web Services: conditional; BAA for all AWS accounts. See Is AWS HIPAA compliant?.
- Microsoft Azure: conditional; volume licensing or online subscription.
- Atlantic.Net: conditional; HIPAA Developer plan.
- Backblaze: conditional; B2 Cloud Storage business customers.
- Box: conditional; Enterprise plan. See the Box HIPAA check.
Related category tables (hosting, databases, storage and software development) are under HIPAA-compliant software by category.
Sources
- HIPAA compliance on Google Cloud and Google Workspace — BAA page, checked 2026-10-20. "The Google Cloud BAA includes Google Cloud's entire infrastructure (all regions, all zones, all network paths, all points of presence), and the following products:"
- HIPAA compliance on Google Cloud and Google Workspace — BAA page, checked 2026-10-20. "Google also offers HIPAA-regulated customers the same services at the same pricing that is available to all customers, including sustained use discounts."
- HIPAA compliance on Google Cloud and Google Workspace — BAA page, checked 2026-10-20. "Enter in to a Google Cloud BAA. For instructions, see the Privacy compliance and records for Google Cloud to review and accept the BAA."
- HIPAA compliance on Google Cloud and Google Workspace — BAA page, checked 2026-10-20. "You're responsible for ensuring that your environment and applications that you build on Google Cloud are properly configured and secured according to HIPAA requirements."
- HIPAA compliance on Google Cloud and Google Workspace — BAA page, checked 2026-10-20. "Customer content is encrypted at rest on Google Cloud. If you have additional encryption requirements, use Cloud KMS."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-20. See Recent changes in vendor HIPAA status.
FAQ
Is Google Cloud Platform HIPAA compliant?
A BAA is available to all Google Cloud accounts for the services on Google's supported list. Whether your use of those services meets HIPAA depends on the signed BAA, how you configure your environment and applications, and your own policies. Google states the configuration and security work is the customer's responsibility.
How do I get a Google Cloud BAA, and does it cost extra?
You review and accept the BAA online through Privacy compliance and records in Google Cloud. There is no extra cost: customers get the same services at the same pricing, and no specific plan tier is required.
Which Google Cloud services are covered by the BAA?
The BAA covers Google Cloud's entire infrastructure and a published list of supported products. Examples named on Google's page include Compute Engine, Cloud SQL, Cloud Storage, BigQuery, Google Kubernetes Engine and Vertex AI Workbench instances. Check the current full list before putting PHI in any service.
Can I use pre-GA or unlisted Google Cloud services with PHI?
No. Services not on the supported list and pre-GA offerings are excluded from the BAA unless the terms state otherwise. Keep PHI out of them.