Conditional A BAA is available on Google Workspace and Cloud Identity accounts managed in the Admin console, and personal Google accounts are excluded. Verified 2026-10-28; next check 2027-01-28. Google Docs is covered because it is part of Google Drive under the Workspace BAA. A Docs file in a personal account is not covered.
Short answer
Docs falls under the Workspace BAA as part of Google Drive. A Workspace administrator accepts the BAA electronically in the Admin console. Google's help article says customers without a signed BAA must not use PHI in Google services (exact wording in Sources).
Personal Google accounts have no Admin console and cannot accept the BAA, so consumer Google Docs is out for PHI. For the "how to make Google Docs HIPAA compliant" question, the steps are: sign the BAA on a managed account, then configure the account and set staff policies. For the wider product family, see Is Google Workspace HIPAA compliant?. Other products are listed under all vendor HIPAA checks.
Which plans include a BAA
The BAA becomes effective on the date the customer electronically accepts it. Admins accept it in Account settings > Legal and compliance.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Business Starter | Available | Admin accepts electronically in the Admin console | Not published by the vendor |
| Business Standard | Available | Admin accepts electronically in the Admin console | Not published by the vendor |
| Business Plus | Available | Admin accepts electronically in the Admin console | Not published by the vendor |
| Enterprise | Available | Admin accepts electronically in the Admin console | Not published by the vendor |
| Education | Available | Admin accepts electronically in the Admin console | Not published by the vendor |
| Nonprofits | Available | Admin accepts electronically in the Admin console | Not published by the vendor |
| Cloud Identity | Available | Self-serve acceptance by an admin in Account settings > Legal and compliance | Not published by the vendor |
| Personal Google account | Not available | No Admin console, so no acceptance path | Not applicable |
Google's pricing page lists Business Starter at €6.80 per user per month on the EU monthly plan.
What the BAA covers and what it excludes
Covered under the BAA:
- Google Drive, including Docs, Forms, Sheets, Slides and Vids (see the Google Drive HIPAA status)
- Gmail
- Calendar
- Chat
- Meet
- Keep
- Sites
- Tasks
- Groups
- Cloud Search
- Vault
- Voice (managed users only)
- Gemini in Workspace
- The Gemini app (excluding Gemini in Chrome)
- Cloud Identity Management
Excluded from the BAA:
- Personal accounts
- Third-party apps and add-ons, including Docs add-ons
- Additional Google Services
- Gemini in Chrome
- Technical support. Do not share PHI with Google support.
Docs is covered only because it is part of Drive. A referral log kept as a Doc in the clinic's managed Drive is within scope. The same log in a front-desk employee's personal Gmail Drive is not. For the Gemini items, see Is Gemini HIPAA compliant?.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" means the pages listed in Sources do not state it. It does not mean the control is absent.
How to use Google Docs with PHI
Compliance depends on the signed BAA, your configuration and your policies. The BAA alone does not make an organization compliant. Terms such as BAA and PHI are defined in the HIPAA glossary.
- Sign the BAA first. An admin accepts it in the Admin console before any PHI goes into a Doc. Drafting a patient letter "just this once" before acceptance is outside the BAA.
- Use managed accounts only. Staff who share a billing or referral Doc must be on your Workspace or Cloud Identity domain, not on personal Gmail addresses.
- Keep PHI out of add-ons and third-party apps. Allow them only if the add-on vendor has its own BAA with you.
- Keep non-covered services away from PHI. That includes Gemini in Chrome and Additional Google Services.
- Never send PHI to Google technical support. When you open a ticket about a broken Doc, redact patient details from screenshots and descriptions.
- Use audit logs and access controls. Restrict sharing on documents that hold PHI, and review the audit log for unexpected access.
- Train staff. Cover which account to use, what not to paste into non-covered tools, and what to do if PHI lands in the wrong place.
Alternatives with a BAA
Other document and e-signature tools with BAA availability, listed without ranking:
- Box: conditional, Enterprise plan
- Notion: conditional, Enterprise plan
- Adobe Acrobat and Adobe Acrobat Sign: conditional, Acrobat Sign Solutions for enterprise
- DocHub: conditional, Site License
Compare more options in HIPAA-compliant document management software.
Sources
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-28. "The HIPAA BAA is made available to customers for electronic acceptance via their Admin console."
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-28. "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services."
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-28. "Third-party applications including add-ons are not included in the Included Functionality covered by the BAA."
- HIPAA compliance on Google Cloud and Google Workspace — Trust center, checked 2026-10-28. "The following Google Workspace services are included in the Google Cloud BAA: … Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides, and Google Vids)"
- HIPAA compliance on Google Cloud and Google Workspace — Trust center, checked 2026-10-28. "Customer content is encrypted at rest on Google Cloud."
- Google Workspace HIPAA Business Associate Addendum — BAA page, checked 2026-10-28. "This BAA will be effective as of the date electronically accepted by Customer (the "BAA Effective Date")."
- Google Workspace and Cloud Identity HIPAA Implementation Guide — Vendor page, checked 2026-10-28. "Technical Support Services: Technical support services provided to Customer by Google are not part of the HIPAA Included Functionality. Customers should not provide PHI to Google when accessing technical support services."
- Google Workspace and Cloud Identity HIPAA Implementation Guide — Vendor page, checked 2026-10-28. "Admins can use audit logs for tracking Apps Script created by Employees in the domain."
- Google Workspace pricing — Pricing page, checked 2026-10-28. "All plans billed monthly, all prices €EUR"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Can I put PHI in a free personal Google Docs account?
No. Personal Google accounts are excluded from the BAA. They have no Admin console, so no one can accept it. Use a managed Workspace or Cloud Identity account with a signed BAA.
How do I sign the Google BAA?
An administrator accepts it electronically in the Admin console, under Account settings > Legal and compliance. It is effective on the date of acceptance. This applies to Workspace plans and to Cloud Identity.
Are Google Docs add-ons covered by the BAA?
No. Third-party apps and add-ons, including Docs add-ons, are excluded. Keep PHI out of them unless the add-on vendor signs its own BAA with you.
Does the BAA cover Gemini in Workspace and Gemini in Chrome?
It covers Gemini in Workspace and the Gemini app, but not Gemini in Chrome. See Is Gemini HIPAA compliant? for details.