Is Google Meet HIPAA-compliant? Three Answers

Even with the correct Workspace agreement, the answer can depend on what else happens during the appointment. Calendar invitations, recordings, AI-generated notes, and third-party extensions can introduce additional considerations. Understanding the broader HIPAA rules for telehealth helps teams distinguish between an eligible video service and a complete, properly managed clinical workflow.

Yes: On Workspace, After Google's BAA

Google Meet is included in Google's list of services covered by its HIPAA Business Associate Addendum, provided the organization has entered into the applicable agreement and uses the service appropriately.

As of its August 31, 2025 update, the official HIPAA Included Functionality list explicitly includes Google Meet.

That means a healthcare practice can potentially use Meet for consultations involving protected health information (PHI). However, purchasing Workspace or using a business email address does not automatically establish the necessary contractual arrangement.

Google's HIPAA compliance documentation explains that organizations subject to HIPAA must accept Google's BAA before using PHI in covered Google services.

The agreement is available for electronic acceptance through the Google Admin console. A super administrator can navigate to Account settings, then Legal and compliance, to review the applicable HIPAA terms.

Acceptance matters because Google performs services involving electronic protected health information (ePHI) on behalf of the healthcare organization.

Under HHS business associate guidance, a cloud service provider that creates, receives, maintains, or transmits ePHI for a covered entity generally qualifies as a business associate.

The BAA establishes contractual responsibilities for handling and protecting that information. Without an appropriate agreement, a healthcare organization should not assume that ordinary commercial service terms provide the protections HIPAA requires.

Even after accepting the BAA, the practice remains responsible for its own use of the service. The practice still needs to evaluate workforce access, patient information, connected applications, and organizational security policies.

The same check applies to any platform that hosts patient visits. Bask Health's security page, for example, lists encryption at rest and in transit, two-factor authentication, and system monitoring, logging, and alerting, the kinds of controls a practice should confirm before routing appointments through a service.

Google's agreement makes qualifying use possible. It does not certify every meeting, employee account, or workflow as automatically compliant.

Meet Settings to Review Before the First Visit

The BAA covers the service, but Meet's admin settings decide how much patient information each visit creates. From the Admin console, an organization can turn recording, transcripts, Gemini note-taking, and live streaming on or off, and manage meeting access, waiting room, and participant consent settings for its users.

A cautious starting point is to keep recording, transcripts, AI notes, and live streaming off, then turn on only the features the practice's policies and patient notices cover. Meeting access and waiting room settings control who can join a visit and when.

No: On a Personal Gmail Account

A standard personal Gmail account does not provide the Google Workspace administrative arrangement needed to accept Google's HIPAA BAA.

Someone may be able to start a Google Meet call through a personal account, but that technical capability does not make it an appropriate arrangement for a HIPAA-regulated practice conducting appointments involving PHI.

The distinction is contractual as well as operational.

Google provides the HIPAA BAA through the administrative environment for eligible Workspace and Cloud Identity customers. A personal Gmail user does not have the same organization-level agreement and administrative controls.

Consequently, a clinician should not use an ordinary personal Google account as the practice's video consultation system for HIPAA-regulated care.

A Workspace Subscription Alone Is Not Enough

The same problem can arise when a practice has purchased Google Workspace but has never accepted the BAA.

This is particularly important for early-stage telehealth companies that adopted Workspace for internal email and scheduling before beginning clinical operations.

The practice may already have professional email addresses, shared calendars, and video meeting access. None of those features confirms that the organization has completed the required HIPAA agreement.

Resolve the distinction before clinical information enters the system, not after employees have already begun hosting patient appointments.

It Depends: What Else the Visit Touches

A Google Meet consultation rarely exists in isolation.

Patients may receive invitations through Calendar, clinicians may save meeting-related documents to Drive, and staff may use AI tools to summarize conversations. Each activity introduces another place where patient information could be created, stored, or shared.

Google includes several Workspace services under its HIPAA Included Functionality list. However, inclusion in that list does not eliminate the organization's responsibility to configure and use those services appropriately.

Calendar Invites

Google Calendar appears on Google's HIPAA Included Functionality list.

A practice using eligible Workspace services under an accepted BAA may therefore use Calendar as part of an appropriate healthcare workflow.

However, a calendar invitation also reaches the patient's own email account, and its contents may appear in notifications, previews, or connected personal calendars.

That creates a practical reason to limit what invitation titles and descriptions reveal.

For example, an appointment title that identifies a specific diagnosis or sensitive treatment may reveal more than the recipient needs to recognize the appointment.

A neutral title, appropriate meeting details, and a separate channel for clinical information can reduce unnecessary exposure.

This is closely related to the privacy considerations involved in HIPAA-compliant email. The receiving address, message contents, and organizational safeguards matter even when a BAA covers the sending service.

Recordings and Files in Drive

Google Drive is also included in Google's HIPAA-covered functionality, including services such as Docs, Sheets, and Forms.

This supports certain healthcare document workflows, but the customer remains responsible for access management.

Google's HIPAA documentation directs organizations to its implementation guidance for managing access to sensitive information. One practical distinction is sharing a document only with authorized recipients rather than making it accessible to anyone with a link.

A recorded consultation or document containing clinical information may count as PHI, depending on its content and context.

Saving that information to an eligible Google service does not resolve every question about who can open it, how it is retained, or whether the disclosure is permitted.

Practices should determine whether they need recordings at all and, if so, establish appropriate patient notices, access restrictions, retention procedures, and documentation.

Clinical notes are a separate question from recordings. On a platform such as Bask Health, visit documentation and prescriptions sit in its EMR and e-prescribing system, tied to the patient record, rather than in shared Drive folders that staff have to permission one file at a time.

The security of the meeting and the resulting file are related, but not identical.

Gemini Notes

AI-generated notes introduce another layer because the tool may process sensitive conversation content rather than merely transmit a video call.

Google's HIPAA Included Functionality list includes Gemini in Workspace and the Gemini app, with Gemini in Chrome expressly excluded. NotebookLM does not appear on the list.

Those distinctions are significant. A healthcare team should not assume every product with the Gemini name has the same HIPAA coverage.

It should also distinguish between native Google functionality and separate products, integrations, or extensions that may use their own services to process meeting content.

Before activating AI-assisted notes for clinical conversations, an organization should verify the specific product and feature against Google's current included-functionality list, confirm the applicable contractual coverage, and evaluate where generated information will be stored or disclosed.

Because Google may change the list, check its status when a feature is enabled rather than relying indefinitely on a previous assessment.

Add-Ons Sit Outside the BAA

An eligible Google Workspace account does not automatically extend its HIPAA protections to software supplied by other companies.

Google explicitly excludes third-party applications, including add-ons, from the Included Functionality covered by its BAA.

That distinction matters for healthcare teams that install tools for automated scheduling, meeting transcription, AI note-taking, recording management, or administrative assistance.

A third-party extension may interact with Google Meet while separately collecting information about participants or processing the contents of a clinical conversation.

If that vendor creates, receives, maintains, or transmits PHI on behalf of a HIPAA-regulated organization, the practice needs to evaluate the vendor's business associate status and obtain an appropriate BAA when required.

The organization should also assess what information the application accesses, where it stores it, and which safeguards apply.

The same contractual distinction is important when evaluating Zoom or another video platform for clinical use. An agreement covering the primary meeting service does not automatically cover every external application connected to it.

Before allowing an add-on into a patient encounter, the practice needs to review it as its own service, with its own data-handling and contractual responsibilities.

FAQs

Is Google Meet or Zoom HIPAA Compliant?

Both platforms can potentially support HIPAA-regulated telehealth when the healthcare organization has the right service arrangement, an applicable business associate agreement, and appropriate privacy and security safeguards.

The relevant question is not simply which video platform the practice chooses. It is whether the specific account, contracted services, connected tools, and operating procedures meet applicable HIPAA requirements.

Does Google Drive Meet HIPAA Requirements?

Google Drive is included in Google's HIPAA Included Functionality list.

A healthcare organization using an eligible Workspace arrangement under an accepted BAA may use Drive for appropriate PHI-related activities. Still, it remains responsible for access permissions, sharing settings, and its own security policies.

HHS's Summary of the HIPAA Security Rule explains that regulated entities must implement administrative, physical, and technical safeguards appropriate to their risks.

A covered cloud service does not remove those responsibilities.

Can Patients Join From a Personal Gmail Account?

Yes. The relevant HIPAA BAA is between Google and the healthcare organization's eligible Workspace or Cloud Identity account, not between Google and each patient joining an appointment.

Patients do not need to enter into their own BAA merely to participate in a meeting hosted by the practice.

The healthcare organization must still use an appropriately configured and covered service, manage the information it discloses, and comply with applicable privacy and security requirements.

References

1. U.S. Department of Health and Human Services. (n.d.). Business associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
2. U.S. Department of Health and Human Services. (n.d.). Summary of the HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
3. Google. (n.d.). HIPAA compliance with Google Workspace and Cloud Identity. https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity
4. Google. (2025). HIPAA compliance on Google Cloud and Google Workspace. https://docs.cloud.google.com/docs/security/compliance/hipaa