Google Workspace and HIPAA: the BAA, the covered services, and the settings that are on you

Google is a business associate when you store PHI in Workspace, and it accepts that role through a BAA you sign in the Admin console. The agreement covers a specific list of services, called the HIPAA Included Functionality. For those services, Google commits to the safeguards a business associate must provide for its own infrastructure and operations.

What Google doesn't do is configure your tenant, decide who in your office can share what, train your staff, or write your risk analysis. Its implementation guide says customers are responsible for determining whether they're a business associate or covered entity, and its Cloud documentation calls HIPAA a shared responsibility where "ultimately you are responsible for evaluating your own HIPAA compliance."

1. Sign in to the Admin console as a super admin.
2. Go to Account settings, then Legal and compliance, then Security and Privacy Additional Terms.
3. Review and accept the HIPAA Business Associate Amendment. Answer the questions about whether you're a covered entity or business associate.
4. Save a copy of the accepted terms with the date in your documentation pack. OCR will ask for the BAA, and "it's in the console" is not a document.

Do this before any PHI enters the account. Google's terms say PHI isn't permitted in the services until the BAA is in place, and a practice that's been using Gmail for patient scheduling for three years without one has a gap in its breach analysis for all three.

Signing the BAA takes four minutes. The other ten settings take an afternoon, and they're the ones that matter.Your engineer

Tick what's already configured. Each one maps to a Security Rule safeguard your risk analysis has to address.

• Personal Gmail for after-hours. A clinician forwarding to a personal account takes PHI out of the BAA entirely.
• Google Forms for intake with responses landing in a Sheet shared by link. Forms and Sheets are covered; "anyone with the link" isn't.
• Gemini features are now on the covered list, but any other AI tool connected to Drive isn't covered by Google's BAA and needs its own.
• Assuming Google keeps the logs. Six months is shorter than most OCR investigations take to start.
• Treating the BAA as the risk analysis. The tenant is one asset in the analysis, not a substitute for it.

Both will sign a BAA, both encrypt at rest and in transit, and both leave configuration to you. Both default to roughly six months of audit retention. Microsoft 365 Business Premium bundles device management and endpoint protection in one licence, where Workspace bundles device management but leaves endpoint protection to third parties. If you're already on one, stay on it and configure it. See Microsoft 365 and HIPAA for the other side.