Skip to main content
BAA Directory

Is Google Calendar HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, as part of Google Workspace. Google lists Google Calendar among the services its Workspace BAA covers, once an administrator accepts that BAA.

Scheduling and intake. Checked on the vendor's own pages on .

Using Google Calendar on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Google says

“Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.”

Source: Google Workspace Admin Help, HIPAA Compliance with Google Workspace and Cloud Identity, checked .

“Administrators must review and accept a BAA before using PHI in Google services.”

Source: Google Workspace Admin Help, HIPAA Compliance with Google Workspace and Cloud Identity, checked .

“All users can access this subset of Core Services for use with PHI under the BAA as long as the health care organization configures those services to be HIPAA compliant”

Source: Google Workspace and Cloud Identity HIPAA Implementation Guide (September 2025), checked .

What the BAA covers and excludes

Covers, in Google's words:

Excludes or limits, in Google's words:

What this means for ad tracking

Calendar entries can carry a patient's name, the reason for a visit and a video link, so an appointment can tie a person to their care. Google's HIPAA implementation guide says “By default, all calendars share all information to anyone within your domain, and only free/busy information with all external parties” (Google).

A BAA with Google covers the calendar data Google stores for you. It does not cover Meta or Google Ads, so a booking counted as a conversion should reach them without the appointment's details. This directory lists Meta and Google Ads as not signing a BAA. See which ad platforms sign a BAA.

Google Calendar sits in Google Workspace alongside Google Drive and Google Meet, under the same BAA. For where patient files should live, see our guide to HIPAA compliant cloud storage.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Curve also keeps ad attribution when a visitor leaves your site to book in a scheduler such as IntakeQ, Acuity or Jane App, and bookings made days later still match. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare schedulers, see our guide to HIPAA compliant scheduling software.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Google Calendar for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Google Calendar HIPAA compliant?

Google Calendar can be used with PHI once your Google Workspace administrator accepts Google's BAA, because Google lists Calendar among its covered services. Google's guide says that by default “all calendars share all information to anyone within your domain” (Google), so check sharing settings before appointments with PHI go in.

Does Google Calendar sign a BAA?

Yes, as part of Google Workspace. Google lists Google Calendar among the services its Workspace BAA covers, and an administrator accepts that BAA in the Admin console. In Google's words: “Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.” We checked Google's own pages on October 26, 2026.

Which Google Workspace plans include a BAA for Google Calendar?

Google's covered-services list and its HIPAA implementation guide do not name particular Workspace editions. Google says the BAA is reviewed and accepted from an administrator account for a Google Workspace or Cloud Identity account, and that “users of the legacy free edition of Google Workspace (sometimes referred to as "Google Apps Standard Edition") cannot review and accept a BAA from Google at this time” (Google Workspace Admin Help).

Is Google Calendar on a personal Google account covered by a BAA?

No. Google offers its BAA to Google Workspace and Cloud Identity customers, accepted by an administrator in the Admin console, and says “Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services” (Google Workspace Admin Help). Google's pages describe no BAA for a personal Google account, so keep appointments with PHI in a Workspace calendar whose administrator has accepted the BAA.

Which Google Calendar settings should I change before adding PHI?

Google's HIPAA implementation guide says employees should consider marking calendar entries that contain PHI as “Private.” For employees who handle PHI, it says admins should consider internal calendar sharing of “No sharing” or “Only free/busy information,” and external sharing of “Only free/busy information” for the domain (Google). The same guide says other Google services that your Workspace agreement does not cover, such as YouTube and Blogger, “must be disabled for Google Workspace users who manage PHI within the Included Functionality” unless a separate BAA covers them (Google). A super administrator accepts the BAA first, in the Admin console under Account settings, then Legal and compliance (Google Workspace Admin Help).

Is the Google Meet link in a Calendar invite covered too?

Google Meet is also on Google's list of covered services, and Google's guide says “Google Meet, the video meeting experience by Google, supports HIPAA compliance.” The same guide notes that a Meet recording “is automatically shared with guests invited to the Calendar event” (Google). See the Google Meet entry.

Can a Google Calendar booking be sent to Meta or Google Ads as a conversion?

Not with its details. Google's BAA covers the calendar data Google stores for you, not Meta or Google Ads, and this directory lists Meta and Google Ads as not signing a BAA. Curve Compliance keeps ad attribution when a visitor leaves your site to book in a scheduler such as IntakeQ, Acuity or Jane App, and sends the conversion server-side with a fixed list of fields for each platform.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Google before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call