Does Google Workspace sign a BAA? (2026)

Checked November 11, 2026 on Google's Workspace HIPAA help article and its list of covered services (last updated October 28, 2026). Confirm the current list with Google before you rely on a service.

What does Google say?

Google's help article says the BAA "is made available to customers for electronic acceptance via their Admin console," under Account settings, then Legal and compliance. It also says that "customers who have not signed a BAA with Google must not use PHI in Google Workspace."

The BAA covers only the services on Google's included functionality list. For Workspace, that list includes:

• Gmail, Google Calendar, Google Chat and Google Meet
• Google Drive, including Docs, Sheets, Slides, Forms, Photos and Vids
• Google Keep, Sites, Tasks and Groups
• Gemini in Google Workspace and the Gemini app, except Gemini in Google Chrome
• Google Voice, for managed users only
• AppSheet and Apps Script

The help article is just as clear about what's left out: "Third-party applications including add-ons are not included in the Included Functionality covered by the BAA."

Personal Gmail is the real problem

Many solo practitioners start with a personal @gmail.com address and never move. The BAA is accepted in the Workspace Admin console, and a personal account doesn't have one. So there's nothing to sign, and patient email on that account sits outside any BAA.

The fix is a Workspace account on your practice domain, with the BAA accepted before any patient email arrives. Old patient threads in the personal account should be moved out, and the personal address should stop appearing on your website, intake form and email signature.

What to change after you accept the BAA

Accepting the BAA covers the services. It doesn't set them up for you. Google's article leaves sharing choices to "organizational PHI policies," and its implementation guidance recommends sharing with specific people rather than anyone with the link. For a solo practice with a VA, that means:

1. Drive sharing: turn off "anyone with the link" for files that hold patient information, and share folders with named people only.
2. Add-ons and connected apps: review every Marketplace add-on and third-party app with access to Gmail or Drive. Each is outside Google's BAA and needs its own, or should be removed.
3. Calendar event titles: name visits "Video visit" or "Follow-up," not the condition. Invites you send to patients copy the title into their inbox and onto shared family calendars.
4. VA access: give your VA their own Workspace user, not your password, so you can see and remove access.
5. Google Voice: only the Workspace Voice license for managed users is covered. The free Google Voice app isn't. Our texting guide covers the options.
6. Gemini in Chrome: it's excluded from the list, so don't paste patient details into it.

What may go into Workspace, and what to keep out

With the BAA accepted, covered services can hold patient information: emails with patients, intake answers in a Google Form, a Sheet your VA uses to track lab-fee payments. That doesn't make each of those a good idea. A Sheet of patient names and lab dates is covered, but it's easy to share too widely and hard to audit. Your EHR is usually the better home for anything clinical.

Keep out of Workspace anything that flows to a tool without a BAA. A Google Form is covered; a Zap that copies its answers to a CRM is not. See Is Zapier HIPAA compliant?

Google Workspace or Microsoft 365?

Both sign. In our BAA table, Microsoft includes its BAA by default in the Data Protection Addendum for commercial plans, and covers Exchange Online, Teams, SharePoint, OneDrive for Business and Forms. Pick the one your practice already lives in. Switching suites to get a BAA is rarely worth it when both offer one.

If you'd rather not run patient email through either suite, Paubox is an email service that says it includes a BAA with all accounts. To check the rest of your stack, use the BAA checker.

This is general information, not legal advice. Confirm BAA terms with each vendor.

Common questions

Is Google Workspace HIPAA compliant?

Google signs a BAA for Workspace, accepted by a super admin in the Admin console, and it covers services like Gmail, Drive, Calendar and Meet (as of November 2026). You still need to set sharing, access and add-ons up correctly.

Is Gmail HIPAA compliant?

Gmail in a Google Workspace account is covered once the BAA is accepted. A personal @gmail.com account has no Admin console to accept the BAA in, so keep patient email off it.

Are Google Forms HIPAA compliant?

Google Forms is part of Google Drive, which is on the list of services covered by the Workspace BAA. Forms in a personal Google account aren't covered, and add-ons that read form responses need their own BAA.

Does Google's BAA cover Gemini?

Google's list of covered services, last updated October 28, 2026, includes Gemini in Google Workspace and the Gemini app, but excludes Gemini in Google Chrome.