Google Workspace HIPAA setup

For practice email, calendar, or files on Google Workspace: a paid plan on your own domain, since a free @gmail.com account can't be covered. On Microsoft 365 or another provider the shape is the same: accept the business associate agreement (BAA), find the covered services, turn off the rest, lock down sharing, and record it.

Google's BAA covers specific services only, and anything outside that list is off-limits for protected health information (PHI). This takes about an hour. For vendors beyond Google, see vendors and business associate agreements.

Step 1: Accept the BAA

1. Sign in to admin.google.com as the super-admin.
2. Account → Account settings → Legal and compliance → Security and Privacy Additional Terms.
3. Review and accept the Google Workspace/Cloud Identity HIPAA Business Associate Amendment. You'll affirm that you're a Covered Entity, that you'll use Workspace with PHI, and that you're authorized to bind the practice.
4. Save a PDF of the amendment text and a screenshot of the acceptance confirmation. File them with your BAAs and log the date in your HIPAA process log.

Step 2: Know what's covered

Google publishes a HIPAA Included Functionality list (search that phrase, or see workspace.google.com/terms/2015/1/hipaa_functionality/). At the time of writing it included the core apps (Gmail, Calendar, Drive/Docs/Sheets/Slides/Forms, Meet, Chat, Tasks, Keep, Groups, Sites, and Voice for managed users) plus specific Gemini surfaces, with some excluded (for example, Gemini in Chrome). Anything not on the list is an "Additional Service" and must never hold PHI.

The list changes. Save a dated copy (print to PDF) at setup, and re-check it at your annual review.

Step 3: Turn off what isn't covered

1. Apps → Additional Google services.
2. Confirm that new additional services are off by default.
3. Review the list. Turn off anything you don't need. Common ones people forget: YouTube, Google Photos, Maps, Blogger, Google Analytics, Chrome Sync.
4. For anything you deliberately leave on (Maps for directions, say), write a one-line risk acceptance: "Enabled for [purpose]. Not to be used to store or transmit PHI." Log it.

With one user, apply all of this at the top-level organizational unit (OU). A later user who doesn't handle PHI, such as a marketing assistant, gets a separate OU.

Step 4: Tighten the covered services

These are all in the Admin Console under Apps → Google Workspace → [service]:

• 2-Step Verification: enforced for all users, especially the super-admin (Security → Authentication → 2-step verification).
• Drive sharing: restrict external sharing, or at minimum turn on warnings when sharing outside your domain; turn off "anyone with the link" as a default.
• Calendar: external sharing set to free/busy only, so client names in event titles aren't exposed.
• Gmail: consider an external-recipient warning; decide whether confidential mode is available.
• Meet: decide on recording and transcription settings (off, unless covered by your AI policy and client consent).
• Chat: external chat off, unless you need it.

Step 5: Operating habits

• Calendar titles: use initials or a code instead of full client names.
• Email: scheduling only. Redirect clinical content to your electronic health record (EHR) system's portal.
• Drive: administrative documents only. Clinical records stay in the EHR.
• Third-party add-ons (Gmail extensions, Drive integrations) are not covered by Google's BAA, even when they run inside Workspace.

Record template

Copy this into your compliance folder and fill it in when you're done.

Google Workspace HIPAA configuration: [domain]
Documented: [date]      Prepared by: [admin email]
Plan: [Business Starter / Standard / ...]

BAA
  Accepted: [date] by [admin email]
  Copy filed at: [location]

Covered-services list
  Snapshot saved: [date, location]

Tenant
  Users: [n] ([name, role])
  OUs: [list]; HIPAA settings applied at: [OU]

Additional services
  Default for new services: OFF
  Enabled with risk acceptance: [service, purpose, date]

Covered-service settings
  2SV enforced:           [yes/no, date]
  Drive external sharing: [setting]
  Calendar external:      [setting]
  Meet recording:         [setting]
  Chat external:          [setting]

Revision history
  [date]: [change]

Shared in the Private Practice Toolkit. Admin Console menu names change occasionally; if a path above doesn't match, search the Admin Console for the setting name.