Is Google Workspace HIPAA compliant? What the BAA covers, and the apps it leaves out

Google will sign a business associate agreement (BAA) for its workplace suite, but no Google product is certified and nothing is covered by default. So, is Google Workspace HIPAA compliant? Only inside a boundary you draw yourself: after a super admin accepts the BAA, and only for the services on Google's published covered list. Everything outside that list is yours to switch off.

We read Google's HIPAA pages on October 23, 2026. Below is what they say today, where the covered list actually lives now, and the four boundaries we would check before putting a patient's name anywhere near it.

Is Google Workspace HIPAA compliant? Google's own answer is "shared responsibility"

Google does not claim the suite is compliant. Its compliance documentation says plainly that the U.S. Department of Health and Human Services "doesn't offer a certification program for HIPAA compliance", that "Complying with HIPAA is a shared responsibility between you and Google," and that "ultimately you are responsible for evaluating your own HIPAA compliance."

That is the frame for every "HIPAA compliant" badge you will meet while shopping. A vendor can sign a BAA, publish a covered-services list and ship the controls you need - none of that is a certificate, because HHS issues none. We list 80 tools in Legal & Compliance and 156 in Healthcare as of October 2026, and in our view the only claim worth weighing from any of them is which services a signed agreement names.

Google's second statement is the hard one: "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services". That page carries a "Last updated 2026-10-20" stamp. Paying for Workspace does not accept the BAA for you.

You can skip the rest of this if your practice never puts protected health information (PHI) into email, documents, calendars, chat or video calls - if patient data lives only in your EHR and never leaves it, Workspace is just office software. In our view few practices are in that position for long.

Step one: a super admin accepts the BAA in the Admin console

Google says the agreement is "made available to customers for electronic acceptance via their Admin console." To check whether yours has been accepted, Google's instruction is to start from a super administrator account, open the Admin console home page, go to Account settings, and then Legal and compliance.

Two practical consequences follow from that one sentence. A consumer Google account has no Admin console, so a free @gmail.com address has no route to a BAA at all. And because acceptance is an action a named super admin takes, it is worth recording who accepted it and when - your own HIPAA documentation will want that, and Google's page is where you go to confirm the agreement is in force.

The covered list names 18 Workspace services, and it has moved

Coverage is not "Google Workspace." It is a named list that Google calls HIPAA Included Functionality. Most guides still cite it at a workspace.google.com terms URL; when we followed that URL on October 23, 2026 it returned a 301 redirect to Google Cloud's HIPAA compliance documentation, where the Workspace list now sits alongside the much longer Google Cloud one.

That page lists these Google Workspace services as included in the Google Cloud BAA: AppSheet, Cloud Identity Management, Gemini App (excluding Gemini in Google Chrome), Gemini in Google Workspace, Gemini Mac App, Gmail, Google Apps Script, Google Calendar, Google Chat, Google Cloud Search, Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides and Google Vids), Google Groups, Google Keep, Google Meet, Google Sites, Google Tasks, Google Vault (if applicable) and Google Voice (managed users only).

Read the parentheses, because they carry the restrictions people miss.

Both lists carry their own revision dates on that page: the Google Cloud list says "Last updated: 2025-09-17" and the Google Workspace list says "Last updated: 2025-08-31." The page itself was refreshed on 2026-10-20. In our view that gap is the single most useful thing on the page, because it tells you how old the service list is relative to Google's shipping pace.

What the BAA does not cover: additional services, add-ons, and everything off Google

Google's Workspace HIPAA page draws two exclusions in its own words. First, "Third-party applications including add-ons are not included in the Included Functionality covered by the BAA" - that is every Marketplace add-on, every sidebar tool, every script-driven integration someone on your team installed. Second, "neither the Cloud Data Processing Addendum (CDPA) nor the Google Workspace BAA terms extend to Additional Google Services" - the Admin console bucket of extra Google products that sit outside the core suite and are switched on separately.

The Google Cloud page gives the instruction that follows from this: disable the services you are not covered for, and "If you can't disable a service, you must not use it for PHI." That is a setting, not a policy document, and it is the one step in this post that nobody can do for you.

Two more boundaries worth naming. Your public website, booking widget and the analytics on them are not Workspace, so nothing here covers them - tracking on a patient-facing page is a separate problem, and one with its own moving law, as we covered in what SB 690 changes for session replay. And the BAA is about Google's obligations as your business associate; it says nothing about whether your configuration is defensible. Google links a HIPAA Implementation Guide from the same page as its configuration reference, and the logging, device and access tooling that backs up those settings is the same Operations software you already buy.

Gemini is on the list. Gemini Notebook is not named on it

The AI question is where the dates start to bite, and it is the part we would check before letting anyone paste a chart note into a prompt.

Google's Workspace HIPAA page says the Gmail features - "help me write, contextual smart replies, and side panel features" - "are covered as part of Google Workspace with Gemini in HIPAA Included Functionality." The covered list backs that up with three Gemini entries: Gemini App, Gemini in Google Workspace and Gemini Mac App. It also carves one out: Gemini in Google Chrome is excluded by name.

Now the timing problem. That list was last revised on 2025-08-31. On July 16, 2026, Google renamed NotebookLM to Gemini Notebook, telling admins there was "no action required" and that the change reached all Workspace customers, Workspace Individual subscribers and personal-account users. The covered list predates that announcement and does not use the new name anywhere.

So the honest answer to "is Gemini Notebook covered?" is that Google's current list does not say. "Gemini App" may or may not be intended to include it. We would not read an ambiguity in a BAA service list as coverage, and if you want Gemini Notebook in a PHI workflow we would get that in writing from Google support or your reseller first.

Which Workspace edition do you need? Google's HIPAA page names none

You will see claims that the BAA requires a particular tier. Google's HIPAA page sets no minimum edition and has no supported-editions banner on it; it addresses Workspace and Cloud Identity customers generally, and describes acceptance through the Admin console.

The edition question is real, but it is about controls rather than coverage. The security tooling you may need to meet your own safeguards is tiered: Google's Workspace pricing page lists data loss prevention under its Enterprise edition, and Vault appears on the covered list with the qualifier "if applicable." Google localizes that page heavily - the version we read on October 23, 2026 priced plans in Indian rupees - so check your own country's page and your own contract rather than a comparison table.

What to do this week

1. Confirm the BAA. Open Account settings, then Legal and compliance in the Admin console as a super admin, and record whether the HIPAA amendment is accepted and by whom.
2. Re-read the list at its current home on Google Cloud's HIPAA page, not from a blog, and note the revision date you saw.
3. Compare the list against what your team actually uses. Anything not on it is a service to switch off for the people who touch PHI, or to keep PHI out of.
4. Audit add-ons and Additional Google Services separately. These are the two exclusions Google states outright, and they are the two most likely to be switched on by default.
5. Write down the AI boundary. Which Gemini surfaces are allowed, which are not, and who asked Google about anything the list does not name.

If you are choosing the rest of the stack around this - forms, scheduling, e-signature, compliance monitoring - the Healthcare and Legal & Compliance categories are where we list those tools, and makers of them can submit a product for a free listing.

Dates, jurisdiction and the limits of this post

Every quotation above comes from a Google page we read on October 23, 2026. The Workspace HIPAA help page was stamped 2026-10-20; the covered-services lists on Google Cloud's HIPAA page were stamped 2025-08-31 (Workspace) and 2025-09-17 (Cloud). These documents change without notice, and the covered list has already moved URL once, so treat anything here as a pointer to a page you should open yourself rather than a current statement of the terms.

HIPAA is U.S. law, and this post describes only it. Nothing here is legal advice, and we have quoted Google's wording rather than restating it as a stronger rule than it makes. Read the current list, the BAA text in your own Admin console and your own contract, and take professional advice where real money or patient data rests on the answer.