A BAA is available for Google Voice for Google Workspace, for managed users only, once a super administrator accepts the Google Workspace BAA. Personal (consumer) and unmanaged Google Voice accounts are not covered.
Conditional A BAA is available through the Google Workspace BAA for Google Voice for Google Workspace managed users; consumer and unmanaged accounts are not covered (checked 2026-10-20).
Short answer
A BAA is available on Google Voice for Google Workspace (Starter, Standard and Premier) when the super administrator has accepted it. Google's own terms tie PHI use to that acceptance:. Without it, treat voicemail, call logs and call recordings as off limits for PHI.
The scope follows the Workspace agreement, not the Voice product name. See Google Workspace BAA terms for the agreement itself, and All vendor HIPAA checks for other tools.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Google Voice for Google Workspace (Starter, Standard, Premier), on an account that accepted the BAA | Available | A super administrator accepts the BAA in the Admin console under Account settings > Legal and compliance | Not published by the vendor |
| Consumer (personal) Google Voice | Not available | Not applicable | Not applicable |
| Unmanaged Google Voice users | Not available | Not applicable | Not applicable |
| Workspace accounts that have not accepted the BAA | Not in effect | Acceptance by a super administrator is required first | Not published by the vendor |
Google Voice for Google Workspace is priced separately from the Workspace subscription itself.
What the BAA covers and what it excludes
Covered under the Workspace BAA (per the check):
- Google Voice, managed users only
- Gmail
- Google Meet
- Google Chat
- Drive, Docs, Sheets, Slides and Forms
- Calendar
- Vault (if applicable)
- Gemini in Google Workspace
Excluded:
- Consumer and unmanaged Google Voice accounts
- Third-party apps and add-ons
- Additional Google services outside the Workspace BAA
The Google Voice Terms of Service separate consumer or unmanaged use from managed Workspace use.
A clinic example: a front desk using a managed Voice line under an accepted BAA sits inside the agreement. A physician forwarding patient callbacks to a personal Voice number does not.
Security controls the vendor publishes
Google's Voice documentation reviewed for this card does not state these controls for Voice. Nothing is inferred from other Google products.
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
An evaluator who needs any of these for a vendor risk assessment should request them from Google in writing.
How to use Google Voice with PHI
Compliance depends on the signed BAA, your configuration and your policies. The BAA alone does not make an organization HIPAA compliant. Terms such as BAA and PHI are defined in the HIPAA glossary (BAA, PHI).
- Confirm the line belongs to a managed Google Workspace account with a Voice license.
- Have a super administrator accept the BAA before any PHI is spoken, recorded or left in voicemail.
- Keep consumer or unmanaged Voice numbers out of every PHI workflow, including after-hours forwarding and staff cell phones.
- Check that any third-party app or add-on connected to Voice is covered by its own BAA, or leave it disconnected.
- Restrict who can access voicemail and recordings through admin settings, and review access when staff leave.
- Train staff on what may be said or left in voicemail, and document the policy.
Alternatives with a BAA
These phone systems are listed for comparison. Plan scopes must be confirmed against each vendor's own BAA before relying on them. Browse HIPAA-compliant phone systems for the category.
- Dialpad: conditional.
- Nextiva: conditional.
- RingCentral: conditional.
- Vonage: conditional.
Sources
- HIPAA compliance on Google Cloud and Google Workspace (HIPAA Included Functionality) — Help article, checked 2026-10-20. "Google Voice (managed users only)"
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-20. "Administrators must review and accept a BAA before using PHI in Google services."
- HIPAA Compliance with Google Workspace and Cloud Identity – exclusions — Help article, checked 2026-10-20. "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services."
- Learn about Voice Terms of Service – Google Voice Help — Terms, checked 2026-10-20. "If you use Google Voice as a consumer user or as an unmanaged Google Workspace user, that means you agree to the Google Voice Additional Terms of Service. If you're using a Google Voice for Google Workspace account managed by your work or school, terms may apply based on your organization's agreement with Google."
- Google Voice: Business Phone System & Plans — Pricing page, checked 2026-10-20. "Starter $10 per user / month"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Can I use a personal or consumer Google Voice number for calls involving PHI?
No. Consumer and unmanaged Google Voice accounts are not covered by a BAA. Use a managed Voice line on a Workspace account that has accepted the BAA.
Does signing the Google Workspace BAA cover Google Voice?
It covers Google Voice for Google Workspace for managed users. It does not cover consumer or unmanaged accounts. Signing the BAA also does not make your organization HIPAA compliant; configuration and policies are still yours to manage.
Who accepts the Google Workspace BAA and where in the Admin console?
A super administrator accepts it in the Admin console under Account settings > Legal and compliance.
Are third-party apps and add-ons used with Google Voice covered by the BAA?
No. Third-party apps and add-ons are excluded from the Workspace BAA. Any that touch PHI need their own agreement with that vendor.