Vendor compliance profile

Is Google Workspace HIPAA compliant?

Google Workspace may support HIPAA-regulated workflows only for included Workspace or Cloud Identity functionality after the Google BAA is accepted and the environment is configured appropriately. Free consumer Google accounts and unsupported add-ons should not be used for PHI.

Visit vendor site

HIPAA status signal

Conditional

BAA public signal

Google Workspace BAA

SOC 2 evidence signal

Public evidence

PHI warning: Gmail subject lines, Drive file names, Calendar metadata, Docs comments, Meet chat, Apps Script, Marketplace apps, and third-party add-ons may expose PHI if not governed.

HIPAA, BAA, and SOC 2 summary

HIPAAGoogle states that Workspace and Cloud Identity customers subject to HIPAA must enter a BAA before using PHI in included Google services.
BAAGoogle Workspace administrators can accept Google's HIPAA BAA through Admin console legal and compliance settings. Verify included functionality, edition, and account scope.
SOC 2Google Workspace compliance resources provide security and privacy documentation. Review current SOC and compliance records for the exact services and regions in use.
CategoryHIPAA-Compliant Email and Messaging Software

What it may be used for

  • General business workflows that do not include PHI.
  • Healthcare-adjacent operations after BAA scope and configuration have been verified.
  • Vendor risk review, procurement research, and compliance planning.

What not to use it for

  • Using free Gmail or consumer Google accounts for PHI.
  • Sending PHI through unsupported Workspace functionality, third-party Marketplace apps, or unmanaged add-ons.
  • Assuming the Google BAA covers every connected app, script, integration, or user behavior.

What to verify with the vendor

  • Whether the vendor will sign a BAA for your exact product, plan, and use case.
  • Which services, add-ons, regions, and support channels are covered by the agreement.
  • Whether your intended workflow stores, transmits, or processes PHI.
  • Which admin, access control, retention, audit log, and encryption settings must be enabled.

Safer alternatives and related profiles

Paubox

HIPAA: HIPAA-focused email | SOC 2: AWS-backed evidence

SendGrid

HIPAA: Not HIPAA eligible | SOC 2: Public evidence

HubSpot

HIPAA: Conditional | SOC 2: Public evidence

Klaviyo

HIPAA: Unable to confirm | SOC 2: Verify with vendor

Wix

HIPAA: Conditional | SOC 2: Verify with vendor

FAQ

Is Google Workspace HIPAA compliant?

Google Workspace may support HIPAA-regulated workflows only for included Workspace or Cloud Identity functionality after the Google BAA is accepted and the environment is configured appropriately. Free consumer Google accounts and unsupported add-ons should not be used for PHI.

Will Google Workspace sign a BAA?

Google Workspace administrators can accept Google's HIPAA BAA through Admin console legal and compliance settings. Verify included functionality, edition, and account scope.

Can Google Workspace be used with PHI?

Do not use this vendor with PHI until your organization verifies BAA scope, covered services, configuration, access controls, data retention, and connected integrations.

Last checked and source notes

Last checked
2026-04-30
Confidence
High
Dataset rows
267 vendors