Is Google Workspace HIPAA Compliant? The BAA, Covered Apps and Setup for a Small Practice (2026)

TL;DR: Yes, with one click and some homework. As of November 2026, Google will sign a HIPAA Business Associate Agreement (BAA) for Google Workspace, and a super admin accepts it in the Admin console under Account settings, then Legal and compliance. It covers only the services on Google's list: Gmail, Drive, Docs, Sheets, Calendar, Meet, Chat, Gemini in Workspace and a few more. Third-party add-ons, Gemini Notebook (formerly NotebookLM) and Gemini in Chrome are outside it. A free Gmail account can't get it at all. The cheapest plan with an Admin console is Business Starter at $7 a user a month on an annual plan.

I get this question from practice owners with 5 to 20 people who already run on Google. They don't want to move to Microsoft. They want to know if what they have is enough. Usually the contract part is easy. The settings part is where practices fall short.

Is Google Workspace HIPAA compliant? What Google actually signs

No software is HIPAA compliant by itself. What a vendor can do is sign a BAA, a contract saying it will protect the patient data (PHI) it handles for you. I explain that idea across the AI tools in HIPAA compliant AI.

Google signs one for Workspace, and you don't need a sales call. A super administrator reviews and accepts it electronically in the Admin console. Google's help page is blunt about the order: "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services." The BAA itself takes effect the date you accept it.

Two limits come with it. First, it applies only to the services Google names. The BAA says it does not apply to "any other Google product, service, or feature that is not a Covered Service." Second, Google puts the job of keeping PHI inside those services on you: the customer "will use controls available within the Services" to do it. That second line is what the admin checklist below is for.

Which Google Workspace plans can get the BAA, and what the cheapest one costs

Google's HIPAA help page doesn't list editions. What it requires is a super admin and the Admin console, and every paid business plan has both. A personal @gmail.com account has neither, so it can't get a BAA. Here are the plans as Google's pricing page showed them on November 8, 2026:

For a 10-person practice that's $70 a month on Starter, $140 on Standard or $220 on Plus with annual billing. Google's pricing page also advertises 50% off for new customers, for the first 20 users and 12 months, starting November 22, 2026. The full plan breakdown is in Google Workspace pricing.

Two notes before you pick. The BAA costs nothing extra on any of these. And Vault, Google's retention and eDiscovery tool, starts at Plus. Google doesn't require Vault for the BAA, but if you need to keep or search email for a set period, Plus is where that lives. Because Google doesn't publish an edition list, check that the BAA shows up under Legal and compliance in your own console before you count on it.

Which Google Workspace services the BAA covers

Google's covered list for Workspace, last updated October 28, 2026:

• Email and calendar: Gmail, Google Calendar, Google Groups
• Files: Google Drive, including Docs, Sheets, Slides, Forms, Photos and Vids
• Talking: Google Meet, Google Chat, Google Voice (managed users only)
• Notes and tasks: Google Keep, Google Tasks, Google Sites, Google Cloud Search
• Building: AppSheet, Google Apps Script, Google Workspace Studio
• AI: Gemini in Google Workspace, the Gemini app (excluding Gemini in Google Chrome) and the Gemini Mac app
• Admin: Cloud Identity Management, Google Vault (if applicable)

Anything not on that list is outside the BAA, even if it shows up in the same app launcher. Google's help page calls out two groups by name: third-party applications including add-ons, and the "Additional Google Services" that consumer accounts use, like YouTube. Gemini has its own wrinkles, covered in is Gemini HIPAA compliant.

The admin checklist for a 5 to 20 person practice

This is the order I'd work in. Most of it takes an afternoon for one admin.

1. Accept the BAA. Sign in as a super admin, go to Account settings, then Legal and compliance, and review and accept it. Do this before any patient data goes in.
2. Turn on 2-Step Verification and enforce it for everyone in the Security section. Practices get breached through one reused password more than anything clever.
3. Turn off Additional Google Services (YouTube, Blogger and the rest) for staff who handle PHI. The BAA doesn't extend to them.
4. Lock down Marketplace apps. Set the Google Workspace Marketplace settings so staff can install only apps you've allowed. Every add-on that touches patient data needs its own BAA from its vendor.
5. Tighten Drive sharing. Google's guidance is to share with specific people rather than "anybody with the link." Turn off link sharing outside your domain, or at least warn on it.
6. Turn off Gemini Notebook for the PHI group. Admin console, then Generative AI, then Gemini Notebook, then Service status, set Off for that organizational unit. Google says it isn't covered by the BAA.
7. Set Gemini conversation history to auto-delete. Generative AI, then Gemini for Workspace, then Conversation history and deletion. Google offers 3, 18 or 36 months. Pick what your retention policy says.
8. Check Google Voice. It's covered for managed users only. If front desk staff text patients from a personal Voice number, that's outside.
9. Decide on Vault. If you're on Plus, set retention rules for Gmail and Drive. If you're on Starter or Standard and need retention, that's your reason to move up.
10. Write it down. One page: which Google apps are approved for PHI, which aren't, who the admin is. That page is half of what an auditor asks for.

The traps I see most in small practices

Personal Gmail. The owner started the practice on a personal Gmail address and never moved. There's no Admin console, no BAA, and no fix short of moving to Workspace on the practice domain.

The add-on everyone forgot. A scheduling, e-signature, CRM or form tool connected to Gmail or Drive. Google covers Google Forms. It doesn't cover the third-party add-on that reads your Forms responses.

Gemini Notebook. It's a Google product inside the same account, it's great for summarizing documents, and Google says plainly that it isn't covered by the BAA. Staff will upload a referral packet to it if nobody tells them not to.

Gemini in Chrome. The Gemini app is covered, but Google's list carves out Gemini in Chrome. Same assistant, different place, different answer.

Public Sites and shared links. Google Sites is covered, but a public intake page or a Drive folder shared with "anyone with the link" is still your exposure. The BAA doesn't stop you from publishing PHI.

Google Workspace or Microsoft 365 for a practice?

If you're already on Google, stay. Moving email for a 10-person practice costs more in lost time than the BAA difference is worth. Both vendors cover their core apps and their built-in AI under a BAA. The difference is how you get it: Google needs a super admin to click accept, and Microsoft includes it automatically in the contract you agreed to when you bought. The Microsoft side is in is Copilot HIPAA compliant.

What to do today

Open your Admin console and check one thing: Account settings, then Legal and compliance. If the BAA isn't accepted, nobody should be putting patient names in Gmail or Drive yet. If it is, work down the checklist above, starting with 2-Step Verification and Marketplace apps.

This is a technology explainer, not legal advice. HIPAA turns on your workflows and your risk analysis, so take this list to your compliance counsel. If you want help setting up Workspace and AI tools for a practice without guessing, that's what my AI consulting for healthcare practices is for.

Sources

• Google Workspace Admin Help, HIPAA Compliance with Google Workspace and Cloud Identity (updated October 26, 2026): BAA acceptance path, no PHI before signing, add-ons and Additional Google Services excluded. Read November 8, 2026.
• Google Cloud, HIPAA compliance on Google Cloud and Google Workspace: Google Workspace supported services (updated October 28, 2026). Read November 8, 2026.
• Google Workspace HIPAA Business Associate Addendum (last modified September 12, 2025): Covered Services, customer controls. Read November 8, 2026.
• Generative AI in Google Workspace Privacy Hub (updated October 26, 2026): Gemini Notebook not covered by the BAA. Read November 8, 2026.
• Google Workspace Admin Help, Turn Gemini Notebook on or off for users. Read November 8, 2026.
• Google Workspace Admin Help, Manage Gemini in Workspace conversation history settings. Read November 8, 2026.
• Google Workspace pricing: Starter $7, Standard $14, Plus $22, Enterprise by quote, Vault from Plus, new-customer offer from November 22, 2026. Read November 8, 2026. Month-to-month prices from Google's Flexible Plan help page, read October 27, 2026.