Is Google Workspace HIPAA compliant? Yes, with the BAA, for listed services.

The short answer

How Google's BAA works

Google's help article, HIPAA Compliance with Google Workspace and Cloud Identity, sets out the model:

• You accept the BAA yourself. Administrators review and accept it electronically in the Admin console before using PHI in Google services. Google says the electronic agreement has the same legal effect as a paper one. A super administrator can find the acceptance record under Account settings, then Legal and compliance.
• Only the "Included Functionality" is covered. Google keeps a separate HIPAA Included Functionality list. Recent versions list core services such as Gmail, Calendar, Drive (with Docs, Sheets, Slides and Forms), Meet, Chat, Groups, Keep, Sites, Tasks and Vault, along with some Gemini features. Check the live list; it changes.
• Third-party apps are not covered. Google's article says third-party applications, including add-ons, are not part of the Included Functionality covered by the BAA.
• "Additional Google Services" are not covered. Consumer-type services outside the list, such as YouTube or Google Photos, sit outside the BAA and should be turned off for users who handle PHI.
• Configuration is your job. Google says customers are responsible for deciding whether they're subject to HIPAA and for using the services in a compliant way.

The BAA text itself is published at workspace.google.com/terms/2015/1/hipaa_baa.html. Read it once: it's shorter than most people expect.

What about Gemini and AI features?

Google's article specifically names some Gmail smart features, such as "help me write" and contextual smart replies, as covered under Google Workspace with Gemini. Google's Cloud documentation lists the Gemini app as included but excludes Gemini in Chrome. Don't assume every AI feature is covered: check each one against the current Included Functionality list before staff paste patient details into it.

The real gap

Compliant storage isn't the same as running the front office

Many small practices accept Google's BAA and then build a front office out of Sheets: a tab of leads, a Form for intake, a shared calendar, a folder of PDFs. It can be compliant. The problems are practical:

• No client record. A patient's intake answers, appointments, notes and invoices live in different files, so nobody sees the whole picture.
• No follow-up. A lead in row 214 doesn't remind anyone to call it back.
• Access sprawl. Sharing links multiply, and it's hard to tell who can open what when staff leave.
• Add-ons creep in. The moment someone installs a mail-merge or form add-on, PHI may flow to a vendor with no BAA.

That's the gap a CRM fills. JBMOnboard360 keeps client records, scheduling and booking requests, intake forms with QR codes, invoices, team chat and AI meeting summaries in one system, under a Business Associate Agreement included on every plan and hosted on AWS in the United States. Most practices keep Google Workspace for email and documents and move the client-facing work into the CRM. Read what makes a CRM HIPAA compliant or the simple CRM setup for a small team.

JBMOnboard360 is not an EHR, doesn't process US card payments and doesn't send SMS. Professional is $79 per user per month billed annually ($99 monthly).