Google Workspace HIPAA Compliance

Google Workspace can support HIPAA-compliant workflows, but compliance depends on the organization’s agreement, configuration and use. Purchasing a subscription does not complete those steps.

For a healthcare practice, the practical questions often involve Gmail and Drive. Can staff email patient documents? Who can open a shared file? What changes when a document leaves Workspace through an online fax service?

Each handoff matters. Google’s BAA covers specified Google services; it does not extend to every application connected to an account.

What Google’s HIPAA agreement covers

Google offers a Business Associate Agreement for covered Workspace and Cloud Identity services. The agreement sets responsibilities for Google and the customer.

Your organization remains responsible for how it uses those services. Information processed outside the covered services, including through third-party applications or local storage, falls outside that agreement’s scope. Google’s HIPAA BAA.

Covered functionality includes Gmail and Drive, including Docs, Sheets, Slides and Forms. Check Google’s current documentation when evaluating a particular service or feature. Google HIPAA-supported services.

An organizational Workspace account should also be distinguished from a personal Gmail account. The familiar Google interface does not bring a personal account under the practice’s agreement.

How to prepare Google Workspace for PHI

Accept the BAA before handling patient information

A super administrator can review and accept the HIPAA agreement through the Admin console under Account → Account settings → Legal and compliance.

Confirm acceptance for the relevant organizational account and retain a record. Google requires the BAA before PHI is used through the covered arrangement. Google agreement instructions.

The Workspace edition determines which administrative features are available. Compare the security, management and retention controls your deployment needs rather than treating a plan name as confirmation of compliance.

Assign responsibility for account access

Identify the accounts that handle patient information and the services each person needs.

Review authentication, account recovery, administrator privileges and departure procedures. Removing a former employee’s access should not depend on changing a password shared by the entire practice.

Assign someone responsibility for these settings. Document who can change sharing rules, approve connected applications and investigate unexpected access.

Google provides controls for reviewing and limiting third-party access to Workspace data. Review the permissions requested by each application before authorizing it. Google application-access controls.

Restrict Drive sharing deliberately

For patient documents, check the actual people and groups with access.

Google’s HIPAA guidance recommends avoiding PHI in file, folder and shared-drive titles. It also describes controls for visibility and external sharing. Google HIPAA implementation guide.

Inspect group membership as well as the file’s sharing screen. A group that was appropriate last year may now contain different staff.

Before sending a Drive link externally, confirm the intended recipient and their access. Sharing with a specific person provides a different boundary from making a document available to anyone who obtains the link.

Can Gmail be used for patient information?

Gmail is among Google’s covered services, but the organization must establish the applicable agreement and configuration.

Review more than the message itself. Recipient selection, forwarding, delegates, attachments and connected applications can affect where information goes.

Transport settings also matter. Gmail normally attempts TLS, but Google explains that it may deliver without TLS when the receiving server does not support it. Administrators can require TLS for specified domains or addresses through the secure-transport setting. Google Gmail TLS guidance.

TLS protects a transport connection. It does not determine who opens the message afterward or control a downloaded attachment.

Staff also need to know how to handle delivery failures. If a security setting blocks a message, someone must follow up on the communication that did not arrive.

Google’s BAA does not cover fax add-ons

Google explicitly states that third-party applications, including add-ons, are not covered by its Workspace BAA. Google Workspace HIPAA guidance.

Before connecting a fax application, examine the provider’s agreement, required subscription and permitted configuration. Review the permissions the application requests and the documents it can access.

Fax.Plus’s HIPAA fax setup requires Enterprise, enabled Advanced Security Controls and a signed BAA. Basic, Premium and Business do not provide an alternative HIPAA-eligible setup. Fax.Plus healthcare requirements.

Assess the actual sending route under those controls. A general integration tutorial does not establish that every feature is available or behaves identically in the healthcare configuration.

Sending a patient document from Workspace by fax

A practice may prepare or store a document in Workspace while an outside organization expects it at a fax number.

One option is to prepare the permitted document, export an appropriate copy and upload it through the HIPAA-configured Fax.Plus web application. Review the packet and verify the recipient before sending.

Exporting creates another copy. Its handling on the workstation needs to follow the practice’s device and storage rules.

Using Gmail for HIPAA email-to-fax

Fax.Plus also supports a dedicated HIPAA email-to-fax route.

The sender must be a provisioned, authorized member with email-to-fax enabled. The destination uses the recipient’s fax number followed by @tls.fax.plus.

Have the administrator verify the account and mail configuration before staff use it for patient documents. Follow the documented healthcare address format rather than assuming that a general integration button prepares the correct route. Fax.Plus HIPAA email-to-fax requirements.

For either route, assign responsibility for checking the transmission outcome. An email appearing in Sent does not establish that the fax arrived. A successful fax means the receiving endpoint acknowledged reception; it does not establish clinical review or filing. Fax.Plus transmission status.

Receiving faxes in Gmail

Fax.Plus uses notification-only email delivery by default for HIPAA-enabled accounts.

Optional fax attachments require organizational consent from the owner or administrator, individual user opt-in, and a receiving mail server supporting TLS 1.2 or higher.

If the required TLS delivery fails, no replacement notification email is sent. The fax remains available in Fax.Plus. Staff responsible for incoming documents should account for that behavior. HIPAA fax email-attachment requirements.

Once an attachment reaches Gmail, the practice is responsible for protecting that mailbox copy. Review access, delegation, forwarding, downloads and retention before enabling the feature.

Choose portal access or attachments according to the work staff need to perform. Attachments can reduce switching between applications, while adding another location that holds the document.

Opening a notification also does not establish that someone reviewed the fax or completed the action it required. Assign incoming records to a person or team and provide coverage when the usual recipient is absent.

Saving received documents in Drive

Where the practice permits it, staff can place a document copy in a restricted Drive location.

Confirm the patient and document before filing, verify the destination folder and check its permissions. Follow naming conventions that avoid unnecessarily exposing patient information in titles.

Importing a Drive file into a fax workflow does not establish automatic backup of incoming faxes to Drive. Saving a fax in Drive also does not automatically update a patient chart.

Decide which location holds the retained record and how additional copies are handled. Deleting a document from one application does not establish that copies in email, Drive or local downloads have also been removed.

Before staff adopt the process, test it with documents containing no patient information. Follow one outgoing document from its source through transmission, then one incoming document through review and filing. Include an unsuccessful delivery so the person monitoring the queue knows what to do next.