Google Workspace and HIPAA: BAA, covered services and setup

Who this page is for

• Your practice has used Google Workspace for years, and nobody remembers accepting a BAA.
• You’re moving off free Gmail and choosing between Google and Microsoft.
• Staff share patient spreadsheets in Drive, use Calendar for appointments, or try Gemini features.
• Your IT person set Workspace up for a regular small business, not for a practice.

The problem

A chiropractic office runs on Google Workspace. Patient intake comes in through Google Forms, the schedule lives in a shared Calendar with patient names, and a Drive folder of X-ray reports is shared “anyone with the link” so the outside billing company can open it.

Every one of those services can be covered by Google’s BAA. The link sharing setting, the calendar visibility and the missing BAA acceptance are what create the risk. Those are settings, not products.

Google’s BAA: how it works

Google’s HIPAA help page says customers subject to HIPAA must “review and accept a BAA” before using PHI in Google services. It also says customers who have not accepted the BAA “must not use PHI” in those services.

The steps:

1. Sign in to the Admin console with a super administrator account.
2. From the Home page, go to Account settings, then Legal and compliance.
3. Review the HIPAA Business Associate Addendum and accept it.
4. Take a screenshot of the acceptance, as Google suggests, and file it with your HIPAA documentation. Under 45 CFR 164.316, you keep documentation for 6 years.

Google says electronic acceptance has the same legal effect as a paper agreement.

Why it matters legally: a business associate contract must meet 45 CFR 164.504(e). Google’s BAA is how Google gives you those assurances for the services it covers.

Which editions qualify

Google’s help page doesn’t name specific editions or exclude any. I’d confirm it in your own Admin console before you rely on it [VERIFICAR].

A free @gmail.com account is different. It has no Admin console and no Legal and compliance section, so there’s no way to accept the BAA there. If PHI is in a personal Gmail account, moving to Workspace is the first step.

Covered services as of August 31, 2026

Google’s HIPAA Included Functionality list covers:

• Gmail, Google Calendar, Google Chat, Google Meet
• Google Drive, including Docs, Sheets, Slides, Forms and Vids
• Google Groups, Google Sites, Google Keep, Google Tasks
• Google Vault (if applicable) and Google Cloud Search
• Google Voice, for managed users only
• AppSheet, Apps Script and Cloud Identity Management
• Gemini in Workspace, the Gemini app (excluding Gemini in Chrome) and the Gemini Mac app

Google says it may add products to the list. Check it again whenever you start using a new Google feature with PHI.

What isn’t covered

• Third-party apps and add-ons. Google’s help page says they “are not included in the Included Functionality covered by the BAA.” A scheduling add-on or e-signature plug-in needs its own BAA from that vendor.
• Additional Google Services. Google says the BAA doesn’t extend to them. The implementation guide names YouTube, Blogger and Google Photos as examples to turn off for users who handle PHI.
• Google Contacts. The implementation guide says Contacts is not a permitted PHI service.
• Pre-release features. The guide says not to use pre-GA offerings with PHI.
• Technical support conversations. The guide says not to share PHI with Google support.
• Gemini in Chrome. It is expressly excluded on the covered list.

Settings to change first

These come from Google’s implementation guide and its 2-Step Verification instructions. Do them in this order.

1. Turn on 2-Step Verification for everyone. In the Admin console, go to Menu, Security, Authentication, 2-step verification (Google’s steps). Allow enrollment, give staff a deadline, then enforce it. For admins, consider the “Only security key” method, which also accepts passkeys.
2. Put PHI users in their own organizational unit. The guide recommends separate organizational units so you can turn services on or off for the people who handle PHI.
3. Turn off services that aren’t covered for that unit, like YouTube, Blogger and Photos.
4. Restrict Drive sharing. Restrict sharing outside the domain, set new files to private to the owner, and avoid PHI in file and folder names.
5. Lock down Calendar. Set internal sharing to free/busy or none for PHI users, external sharing to free/busy only, and have staff mark PHI events as private.
6. Control apps. Review Marketplace and third-party app access, and disable Chat apps unless you need them.
7. Set up DLP rules to detect PHI in Gmail and Chat, if your edition includes DLP.
8. Set Groups to private for any group that receives PHI.
9. Configure Meet guest and recording settings. Recordings and transcripts land in Drive and follow Drive sharing rules.
10. Turn on admin alerts for suspicious logins, new admins and suspended users, and review the reports regularly.

Then add Workspace to your HIPAA risk analysis as a system that holds ePHI, and record each choice you made.

Google Workspace vs Microsoft 365

	Google Workspace	Microsoft 365
How the BAA is offered	Super admin accepts it in Admin console, Legal and compliance	Available by default through the Microsoft Online Services Data Protection Addendum to covered entities and business associates (Microsoft)
Email	Gmail covered	Exchange Online in scope
Files	Drive, Docs, Sheets, Slides, Forms covered	SharePoint Online and OneDrive for Business in scope
Chat and video	Chat and Meet covered	Microsoft Teams in scope
AI assistant	Gemini in Workspace covered (Gemini in Chrome excluded)	Microsoft Copilot and Copilot Chat listed in scope
Not listed when I checked	Contacts, YouTube, Blogger, Photos	Microsoft Bookings
Published price (as of October 2026)	Didn’t display when I checked [VERIFICAR]	Business Basic $7.00 per user per month, paid yearly (Microsoft)
Endpoint detection and response	No EDR product in Workspace plans that I could confirm [VERIFICAR]	Business Premium includes Defender for Business and Intune (Microsoft)

I don’t work with Google or Microsoft directly. Both are fine choices for a small practice. Pick the one your staff already know, then set it up correctly.

My recommendation by scenario

• If you’re on Workspace and never accepted the BAA, stop putting new PHI in it until a super admin accepts it, then work through the settings list above.
• If you’re on free Gmail, move to Workspace or Microsoft 365. Don’t try to make a personal account work.
• If staff use add-ons for scheduling, forms or signatures, list each one and get a BAA from each vendor, or replace it with a covered Google service.
• If you need encryption for email that leaves the practice, compare add-ons on the HIPAA compliant email page.
• If you need endpoint protection too, plan on adding EDR separately, since I couldn’t confirm an EDR product inside Workspace plans.

Common mistakes

1. Assuming a paid plan means the BAA is accepted. It isn’t accepted until a super administrator does it.
2. “Anyone with the link” sharing on PHI folders. It’s the fastest way to expose records to people outside your practice.
3. Patient names in calendar titles with open sharing. Calendar is covered, but if internal sharing shows event details, everyone in your domain can read patient names.
4. Unvetted add-ons. The add-on vendor sees your data and isn’t covered by Google’s BAA.
5. Shared admin password. The super administrator account controls the BAA and every setting. Give it 2-Step Verification with a security key and don’t use it for daily email.

Before you change settings, run through the HIPAA security checklist so you know which gaps matter most. If you’d like help setting up Workspace security or comparing it with Microsoft 365, tell me about your current Google setup.