---
title: "Google Workspace HIPAA Compliance: How to Sign the BAA, What It Covers, and a Settings Checklist"
description: "Google Workspace HIPAA compliance, step by step: accept Google's BAA, keep PHI in covered services, lock down settings, and vet every Gmail add-on."
author: "Andrew Rivers"
url: https://www.keeping.com/content/google-workspace-hipaa/
datePublished: 2026-11-09
---

# Google Workspace HIPAA Compliance: How to Sign the BAA, What It Covers, and a Settings Checklist

> **The short answer:** Google Workspace HIPAA compliance starts when a super admin accepts Google's HIPAA Business Associate Amendment in the Admin console. The BAA covers only the services Google lists, such as Gmail, Drive, Calendar, Meet, Chat, Groups and Vault, and you still configure them: enforce 2-Step Verification, restrict sharing and turn off uncovered services. Add-ons aren't covered, so any vendor whose Gmail add-on handles patient email for you needs its own BAA.

If your practice runs on Google Workspace and someone has told you to “sign the BAA”, that’s the right instinct, but it’s step two of eight. Google Workspace HIPAA compliance means accepting Google’s Business Associate Amendment in the Admin console, keeping patient information inside the services Google covers, and configuring those services yourself.

A consumer @gmail.com account can’t accept Google’s BAA, so it can’t be your practice’s patient mailbox. A paid Workspace account with the BAA accepted can be, as our answer to [is Google Workspace HIPAA compliant](https://www.keeping.com/content/is-gmail-hipaa-compliant/) explains. The checklist below covers the whole setup, with the Admin console path for each setting, so one admin can work through it in an afternoon.

## Google Workspace HIPAA compliance checklist

Work through the whole list, in order, before any patient information goes into Workspace.

1. [Confirm your plan offers Google’s BAA](#which-google-workspace-plan-is-hipaa-compliant), and know what your edition adds.
2. [Accept the BAA](#how-to-sign-the-google-workspace-baa) in the Admin console as a super admin.
3. [Keep patient information in covered services](#which-google-workspace-services-does-the-baa-cover) only.
4. [Give staff who handle PHI their own organizational unit](#how-to-make-gmail-and-google-workspace-hipaa-compliant-the-settings) and turn off the services the BAA doesn’t cover.
5. [Enforce 2-Step Verification](#how-to-make-gmail-and-google-workspace-hipaa-compliant-the-settings) for everyone.
6. [Lock down sharing](#how-to-make-gmail-and-google-workspace-hipaa-compliant-the-settings) in Drive, Calendar and Groups.
7. Control third-party apps, and [get a BAA from every vendor](#do-gmail-add-ons-need-their-own-baa) whose add-on handles patient email, including a Gmail help desk such as Keeping.
8. [Set up retention, alerts and a few written staff rules](#retention-alerts-and-staff-rules).

> **Sharing patient email in Gmail?**
>
> Keeping's HIPAA plan includes a signed BAA, so your front desk can assign, note and track patient emails without leaving Gmail.
>
> [See the HIPAA plan](https://www.keeping.com/lp/hipaa-compliant-help-desk/)

## Which Google Workspace plan is HIPAA compliant?

Google doesn’t publish a list of Workspace editions that can accept its BAA. Its instructions rule out only non-admin users and the legacy free edition, and a consumer Gmail account has no Admin console at all. Before you commit to a plan, or put any patient data in, open Legal and compliance in your own Admin console and confirm the BAA is offered there.

Some AI summaries and vendor guides say you need Business Standard or higher. They don’t cite Google for it, and Google’s own pages don’t say it. What your edition does change is the tooling around the BAA:

| Feature | Business and Enterprise plans that include it | Why it matters for patient email |
| --- | --- | --- |
| Google Vault | Business Plus, Enterprise Standard and Enterprise Plus; add-on licenses for some editions | Retention rules and legal holds on email and files |
| DLP for Gmail | Enterprise Standard and Enterprise Plus | Rules that catch patient identifiers in outgoing mail |
| Hosted S/MIME | Enterprise Plus | Message encryption with recipients who also use S/MIME |
| Endpoint management | Fundamental on Business Standard, advanced on Business Plus, enterprise on Enterprise | Control over the phones and laptops that open patient email |

Prices are Google’s list prices on November 9, 2026: Business Standard is $14 and Business Plus is $22 per user a month on an annual plan, and Google quotes Enterprise plans through sales. Business Plus is the lowest Business plan with [Google Vault](https://www.keeping.com/content/google-vault/) included, so start there if you want retention rules and legal holds.

## How to sign the Google Workspace BAA

Google’s BAA is an online amendment that a super admin accepts in the Admin console. You don’t request it from anyone, and Google lists no fee for it: you pay only for your Workspace edition. Accept it before any patient information is entered, stored or sent in Workspace. Google says customers who haven’t accepted it must not use PHI in its services.

A business associate agreement is the contract in which a vendor agrees to protect the health information it handles for you. Here’s how to accept Google’s, per its [Legal and compliance instructions](https://knowledge.workspace.google.com/admin/compliance/privacy-compliance-and-records-for-google-workspace-and-cloud-identity):

1. Sign in to the Google Admin console as a super administrator.
2. Go to Menu > Account > Account settings > Legal and compliance.
3. In Security and Privacy Additional Terms, click Google Workspace/Cloud Identity HIPAA Business Associate Amendment and read it.
4. Click Review and Accept, answer the three questions that confirm you’re a HIPAA covered entity, and click OK.
5. Take a screenshot of the accepted amendment in Legal and compliance and file it with your HIPAA records.

Google says electronic acceptance has the same legal effect as a paper agreement, and that screenshot is how you show it was accepted ([Google’s HIPAA page](https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity)).

## Which Google Workspace services does the BAA cover?

Google’s BAA covers a specific list of Workspace services, and patient information belongs only in those. The list includes Gmail, Calendar, Drive and Docs, Meet, Chat, Groups, Vault and Gemini in Workspace. Services that aren’t on Google’s list sit outside it, including Google Contacts, consumer services like YouTube and every third-party add-on.

| Service | Covered by Google’s BAA? | Notes |
| --- | --- | --- |
| Gmail | Yes |  |
| Google Calendar | Yes | Restrict external sharing (below) |
| Google Drive, Docs, Sheets, Slides, Forms and Vids | Yes |  |
| Google Meet | Yes | Recordings save to Drive and follow Drive sharing settings |
| Google Chat | Yes |  |
| Google Groups | Yes | Includes collaborative inbox |
| Google Vault | Yes | Where your edition includes it |
| Google Voice | Managed users only |  |
| Google Keep, Sites and Tasks | Yes |  |
| Gemini in Workspace, the Gemini app and the Gemini Mac app | Yes | As Workspace core services; includes Help me write in Gmail |
| Cloud Identity Management | Yes |  |
| AppSheet, Apps Script, Cloud Search and Workspace Studio | Yes | Studio connections to third-party services aren’t covered |
| Google Contacts | No | Keep patient details out of contacts |
| Additional Google services such as YouTube and Blogger | No | Turn off for staff who handle PHI |
| Pre-release and early access features | No |  |
| Gemini in Chrome | No | Turn off for staff who handle PHI |
| Gemini as an additional Google service | No |  |
| Marketplace apps, add-ons and other third-party apps | No | Each vendor that handles PHI needs its own BAA |

Several guides list Google Groups and Google Voice as off limits. Google’s list includes both, with Voice covered for managed users only. Google Contacts is the one people miss: it’s part of every Workspace account, but it isn’t on Google’s list.

Google keeps the current list on its [Google Cloud HIPAA page](https://docs.cloud.google.com/docs/security/compliance/hipaa), and the old Workspace list URL now redirects there. Check it every few months, because Google updates it.

## How to make Gmail and Google Workspace HIPAA compliant: the settings

After the BAA, the rest of the work happens in the Admin console. Separate the staff who handle patient information, turn on 2-Step Verification, limit apps and sharing, set Gmail’s transport rules, and keep records. Google’s [HIPAA Implementation Guide](https://services.google.com/fh/files/misc/gsuite_cloud_identity_hipaa_implementation_guide.pdf) is the source for most of these steps. The paths below are where each setting lives today.

1. **Give PHI staff their own organizational unit.** Settings apply per organizational unit, so put everyone who touches patient information in one. Then turn off the services the BAA doesn’t cover for that unit at Apps > Additional Google services.
2. **Enforce 2-Step Verification.** Go to Security > Authentication > 2-step verification. Let users enroll first, then turn enforcement on. Google already enforces it for admin accounts.
3. **Limit third-party apps.** In Apps > Google Workspace Marketplace apps, set Manage access to apps to allowlisted apps only, then add the ones you’ve approved at Apps list > Allowlist app. Review the apps that already have access to Google data under Security > Access and data control > API controls, and turn off Docs add-ons and Chat apps your team doesn’t use.
4. **Restrict sharing.** In Apps > Google Workspace > Drive and Docs > Sharing settings, make new files private to their owner and limit sharing outside your organization. In Apps > Google Workspace > Calendar > Sharing settings, set external sharing to “Only free/busy information (hide event details)”. Make any group that receives patient email private.

### Google Workspace HIPAA compliant email: Gmail settings

- **Require TLS with the partners you exchange PHI with.** Gmail tries to encrypt every message in transit with TLS, but that only works if the other side’s server supports it. To require it for a lab, a billing company or a referral partner, add their domain at Apps > Google Workspace > Gmail > Compliance > Secure transport (TLS) compliance.
- **Know what encryption you have.** Confidential mode controls forwarding and expiry, but it isn’t encryption. Among Business and Enterprise plans, hosted S/MIME needs Enterprise Plus, and the recipient must use S/MIME too. Our guide on how to [encrypt email in Gmail](https://www.keeping.com/content/how-to-send-encrypted-email-in-gmail/) covers both.
- **Add DLP rules if you have them.** On Enterprise Standard and Enterprise Plus, DLP for Gmail can catch patient identifiers in outgoing mail and block or warn before it’s sent.

### Retention, alerts and staff rules

- **Retention.** If your edition includes [Vault](https://www.keeping.com/content/google-vault/), set retention rules for Gmail and Drive. Google says Vault isn’t designed to be a backup or archive tool, so plan a separate backup.
- **Alerts and reports.** The HIPAA Security Rule requires audit controls. Set alerts for suspicious sign-ins and admin privilege changes, and review the security and audit reports on a schedule.
- **Staff rules and training.** Write down a few rules and walk every new hire through them: no patient details in subject lines, file names, Chat space names or group names, and use Bcc when emailing a list.

## How to share a patient inbox in Google Workspace

Front desks and billing teams usually share one address, like frontdesk@. HIPAA’s Security Rule requires unique user identification ([45 CFR 164.312](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312)), so everyone who opens patient email needs their own login. That rules out the first of the four common setups below, a shared password, and leaves three that work.

- **A shared password.** Everyone signs in as frontdesk@, so nobody can tell who read or sent what. It breaks the unique-login rule, and there are better ways than [sharing a password](https://www.keeping.com/content/secure-email-collaboration/).
- **Google Groups collaborative inbox.** Covered by the BAA, and your team can take and assign conversations at groups.google.com. Assignment doesn’t limit who can see a message, though: every collaborator reads every patient email, so keep the group private and its membership tight. Our guide to the [Google Groups collaborative inbox](https://www.keeping.com/content/google-groups-collaborative-inbox/) covers the setup.
- **Gmail delegation.** Gmail is covered, and each delegate opens the shared mailbox from their own account. There’s no assignment, and anyone with access can delete a message for the whole team. See how a [shared mailbox in Google Workspace](https://www.keeping.com/content/google-workspace-shared-mailboxes/) works, and when [Gmail delegation](https://www.keeping.com/content/gmail-delegation/) is enough.
- **A shared inbox add-on.** Adds owners, internal notes and status to each conversation inside Gmail. It also reads your patient email, so it needs its own BAA.

## Do Gmail add-ons need their own BAA?

If the add-on handles patient email for you, yes. Google states that third-party applications, including add-ons, aren’t covered by its BAA. A vendor whose add-on stores, reads or sends patient email on your behalf is your business associate and needs its own BAA with you. An add-on that never touches patient data doesn’t.

Start with an inventory. Under Security > Access and data control > API controls, Manage App Access shows the third-party apps that have connected to your Google data. Remove what nobody uses, then ask each remaining vendor whether it signs a BAA and on which plan. Most major help desks put the BAA on an upper plan. Our comparison of [HIPAA compliant help desk software](https://www.keeping.com/content/hipaa-compliant-help-desk-software/) shows which ones sign it and where.

Keeping is a shared inbox and help desk for HIPAA compliant Gmail: your team works inside the Gmail it already uses, and the HIPAA plan is $49 per user per month billed annually, BAA included. That’s not an enterprise upgrade, and the 2-user minimum is the same as on every Keeping plan. It needs three things from you: your own Google Workspace BAA from the steps above, every teammate signing in with their own Google Workspace account, and your shared address connected with Google sign-in or Keeping’s HIPAA-safe forwarding.

[Start your free trial on the HIPAA plan](https://app.keeping.com/signup?plan_id=HIPAA-USD-Yearly) with test data, ask us for the BAA, and your account is set up as HIPAA Enabled before any patient email goes in. The trial itself isn’t covered. See [how the HIPAA plan works](https://www.keeping.com/lp/hipaa-compliant-help-desk/), or compare plans on [Keeping pricing](https://www.keeping.com/pricing/).

## Frequently asked questions about Google Workspace and HIPAA

### Is Google email HIPAA compliant?

Gmail can hold patient email once your organization accepts Google’s BAA in the Admin console and configures Workspace to match. A consumer @gmail.com account can’t accept the BAA, so it shouldn’t be your practice’s patient mailbox. Patients can still write to you from any address they choose.

### How much does HIPAA compliant Google Workspace cost?

Google lists no fee for its BAA, so the cost is your Workspace edition. Vault is included from Business Plus up, and some other editions can add Vault licenses. Any add-on that handles patient email, such as a help desk, may cost extra and needs its own BAA.

### Is Google Meet HIPAA compliant?

Google Meet is on the list of services Google’s BAA covers, so you can use it for patient calls once the BAA is accepted. Recordings and transcripts save to Drive and follow your Drive sharing settings, so restrict outside sharing and limit who can record.

### Is Google Voice HIPAA compliant?

Google Voice is covered by Google’s BAA for managed users, meaning Voice accounts your organization assigns and controls through the Admin console. A personal Google Voice number isn’t covered. Accept the BAA first, then keep patient calls and texts on the managed accounts.

### Is Gemini in Gmail covered by Google’s BAA?

Yes. Google lists Gemini in Workspace among its covered services, and its HIPAA page names Help me write, contextual smart replies and the Gmail side panel. Gemini in Chrome isn’t covered, so turn it off for staff who handle patient information.

### Is Google Workspace HIPAA compliant for therapists?

The rules are the same for a solo therapist as for a large clinic. Accept Google’s BAA in the Admin console, keep client information in covered services, and set up sign-in and sharing. A practice of one still needs the BAA before any client email goes in.