Is Google Chat HIPAA Compliant? Here Is How

Short answer: It depends. Google Chat can be HIPAA compliant, but only when it is part of a Google Workspace account covered by a signed Business Associate Agreement (BAA) with Google and configured correctly. A free or personal Google account is not covered, so consumer Google Chat is not HIPAA compliant.

How it can be compliant

Google offers a BAA to eligible Google Workspace customers, and Google Chat is one of the “included functionality” services under that BAA. If your organisation (1) has executed Google’s BAA, (2) restricts PHI to the covered core services, and (3) configures access, retention, and admin controls appropriately, then using Google Chat for PHI can fall inside HIPAA.

Where teams get it wrong

The BAA does not cover personal Gmail or free accounts, it does not automatically cover every Google service, and turning on the wrong integrations or add-ons can push PHI outside covered functionality. Compliance is a shared responsibility: Google provides the covered infrastructure, and you must configure and operate it correctly.

When a purpose-built option is better

If you are building a patient-facing product or embedding messaging into your own app, an internal collaboration tool like Google Chat is the wrong shape. You want a chat API you control, with a BAA, audit trails, and the option to self-host.

Related

• Is WhatsApp HIPAA Compliant?
• Is Text Messaging (SMS) HIPAA Compliant?
• Is iMessage HIPAA Compliant?
• HIPAA-compliant chat & messaging API
• Healthcare chat SDK

Frequently asked questions

Is free Google Chat HIPAA compliant?

No. Only Google Workspace under a signed BAA, configured correctly.

Does Google sign a BAA?

Yes, for eligible Workspace customers, covering specified core services.