Google Workspace can meet HIPAA requirements with a signed BAA and admin configuration — but compliance is your organization's responsibility, not Google's.
Get started for freeSchedule a demo →Yes, with conditions. Google offers a HIPAA Business Associate Agreement for Google Workspace, and 23 services — including Gmail, Google Chat, Google Drive, and Google Meet — are listed as HIPAA Included Functionality. But accepting the BAA does not automatically make your organization HIPAA compliant. Google states that the customer is responsible for configuring Workspace to meet HIPAA requirements, and not every edition includes the compliance tools needed to do that.
Google offers a HIPAA Business Associate Agreement that can be accepted electronically by a super administrator in the Admin console. The BAA covers Google's obligations for the listed services, but Google states that "Customer is solely responsible for ensuring that its and its End Users' use of the Covered Services complies with HIPAA." Accepting the BAA is a starting point, not a finish line.
Source: Google Workspace HIPAA BAAGoogle publishes a specific list of HIPAA Included Functionality. Covered services include Gmail, Google Chat, Google Drive, Docs, Sheets, Slides, Meet, Calendar, Keep, Forms, Voice (managed users only), and Vault (if applicable). What is not on that list is not protected by the BAA: Gemini in Chrome is explicitly excluded, and third-party apps from the Workspace Marketplace, browser extensions, and non-listed Google services are not covered. A practice that accepts the BAA and then uses a non-covered app for PHI has a compliance gap it may not realize until an audit or breach.
Source: Google HIPAA Included FunctionalityThe BAA can be accepted on any paid Google Workspace edition. However, Google Vault — required for retention policies, legal holds, and audit — is available only on Plus ($22/user/month) and Enterprise editions. Data Loss Prevention, which prevents PHI from being shared outside the organization, is an Enterprise feature. Starter ($7/user/month) and Standard ($14/user/month) editions lack these tools, leaving organizations without the retention, audit, and data-loss controls that HIPAA expects — even with a signed BAA.
Source: Google Workspace HIPAA complianceEven on an eligible edition with a signed BAA, Google Workspace does not ship HIPAA-ready. Administrators must enforce two-factor authentication, configure mobile device management, set up Vault retention policies, create DLP rules, restrict external sharing, and disable non-covered services for users who handle PHI. Google provides a HIPAA Implementation Guide but makes clear it is informational only — the configuration burden falls on the organization.
Source: Google Workspace HIPAA complianceGoogle's HIPAA compliance documentation states that customers "must enter a Business Associate Amendment (BAA) with Google" before using Workspace services with PHI. The BAA defines Covered Services as those listed on Google's HIPAA Included Functionality page. Google states that the customer is solely responsible for ensuring compliant use of the Covered Services.Source: Google Workspace HIPAA compliance
Required plan: Google Workspace Plus or Enterprise (Plus for Vault; Enterprise for DLP and advanced security controls)
Requires IT staff to configure and maintain Google Workspace security settings, Vault policies, and sharing restrictions. Google Workspace Plus starts at $22 per user per month; Enterprise pricing requires contacting sales. DLP is Enterprise-only, so organizations that need it cannot use lower tiers. This is not a one-time setup — policies need ongoing review as Google updates features and defaults.
Purpose-built HIPAA messaging that ships compliant out of the box. Signed BAA included at signup on every plan, including the free plan. Patients reply via SMS without a Google account or app download.
Enterprise clinical messaging for hospitals and health systems with role-based routing, EHR integrations, and care team assignments.
HIPAA-compliant communication platform for medical practices with secure messaging, phone, fax, and telehealth in one system.
For a detailed comparison, see BloomText vs Google Workspace.
Yes, conditionally. Google offers a BAA for Workspace and lists 23 services as HIPAA Included Functionality, including Gmail, Chat, Drive, and Meet. But the organization must accept the BAA, configure security settings, and ensure PHI is only handled through covered services. Accepting the BAA alone does not make Workspace HIPAA compliant.
The BAA can be accepted on any paid Google Workspace edition. However, Google Vault — needed for retention and audit — is only available on Plus and Enterprise. Data Loss Prevention is Enterprise-only. Starter and Standard editions lack the compliance tools needed for meaningful HIPAA configuration.
Google publishes a HIPAA Included Functionality list of 23 covered services including Gmail, Chat, Drive, Docs, Sheets, Meet, Calendar, and Voice (managed users only). Gemini in Chrome, third-party Marketplace apps, browser extensions, and non-listed Google services are not covered. PHI handled through a non-covered service is not protected by the BAA.
A super administrator accepts the BAA electronically in the Google Admin console under Account settings → Legal and compliance. Google states that electronic acceptance has the same legal effect as a paper agreement. The BAA must be accepted before using any Workspace service for PHI.
Gmail is listed as HIPAA Included Functionality under the Workspace BAA, so it can be used for PHI when the BAA is accepted and Workspace is properly configured. However, Gmail requires the recipient to have an email address and check their inbox — it does not reach patients by text message.
Google Workspace does not include patient texting. Google Chat requires both parties to have Google accounts. Google Voice can send SMS but is a separate add-on ($10–$30/user/month on top of Workspace) and is designed as a business phone system, not a patient messaging workflow.
Last verified August 25, 2026.
