Skip to main content
BAA Directory

Is Google Docs HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, as part of Google Workspace. Google lists Google Docs, within Google Drive, among the services its Workspace BAA covers, once an administrator accepts it.

Automation and workspace. Checked on the vendor's own pages on .

Using Google Docs on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Google says

“Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.”

Source: Google Workspace Admin Help, HIPAA Compliance with Google Workspace and Cloud Identity, checked .

“Administrators must review and accept a BAA before using PHI in Google services.”

Source: Google Workspace Admin Help, HIPAA Compliance with Google Workspace and Cloud Identity, checked .

“All users can access this subset of Core Services for use with PHI under the BAA as long as the health care organization configures those services to be HIPAA compliant”

Source: Google Workspace and Cloud Identity HIPAA Implementation Guide (September 2025), checked .

What the BAA covers and excludes

Covers, in Google's words:

Excludes or limits, in Google's words:

What this means for ad tracking

Google Docs can hold intake notes, referral letters and call notes, so text that ties a person to their care can end up there. Google's guide recommends that users “avoid putting PHI in titles of such files, folders, or Shared Drives” (Google).

A BAA with Google covers the documents Google Docs stores in your Workspace account. It does not cover Meta or Google Ads, so anything copied from a Doc into an ad platform should carry no health details. This directory lists Meta and Google Ads as not signing a BAA. See which ad platforms sign a BAA.

Google Docs sits inside Google Drive, under the Google Workspace BAA. To compare storage providers, see our guide to HIPAA compliant cloud storage.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Google Docs for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Google Docs HIPAA compliant?

Google Docs can be used with PHI once your Google Workspace administrator accepts Google's BAA, because Google lists Docs, within Google Drive, among its covered services. Google says those services “must be configured by IT administrators to help ensure that PHI is properly protected” (Google), so sharing settings and add-ons still matter.

Does Google Docs sign a BAA?

Yes, as part of Google Workspace. Google lists Google Docs, within Google Drive, among the services its Workspace BAA covers, and an administrator accepts that BAA in the Admin console. In Google's words: “Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.” We checked Google's own pages on October 26, 2026.

Which Google Workspace plans include a BAA for Google Docs?

Google's covered-services list and its HIPAA implementation guide do not name particular Workspace editions. Google says the BAA is reviewed and accepted from an administrator account for a Google Workspace or Cloud Identity account, and that “users of the legacy free edition of Google Workspace (sometimes referred to as "Google Apps Standard Edition") cannot review and accept a BAA from Google at this time” (Google Workspace Admin Help).

Is Google Docs on a personal Google account covered by a BAA?

No. Google offers its BAA to Google Workspace and Cloud Identity customers, accepted by an administrator in the Admin console, and says “Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services” (Google Workspace Admin Help). Google's pages describe no BAA for a personal Google account, so use Google Docs with PHI only in a Workspace account whose administrator has accepted the BAA.

What should I set up before putting PHI in Google Docs?

A super administrator accepts the BAA in the Admin console under Account settings, then Legal and compliance (Google Workspace Admin Help). Google's HIPAA implementation guide then says admins can “Restrict” or “Allow” sharing outside the domain and set the default file visibility to “Private to the owner,” and that admins “should consider disabling third party applications that can be installed, such as apps using the Google Drive SDK API and Google Docs add-ons” (Google). The same guide says other Google services that your Workspace agreement does not cover, such as YouTube and Blogger, “must be disabled for Google Workspace users who manage PHI within the Included Functionality” unless a separate BAA covers them (Google).

Are Google Docs add-ons covered by Google's BAA?

No. Google says “Third-party applications including add-ons are not included in the Included Functionality covered by the BAA” (Google Workspace Admin Help). Its implementation guide adds that customers “are solely responsible for determining if they require a BAA or any other data protection terms in place with a third party before sharing PHI with the third party using Google Workspace services or applications that integrate with them” (Google).

Can I keep lead or patient lists in Google Docs?

Inside a Workspace account whose administrator has accepted Google's BAA, with sharing set the way your policies require. The BAA stops at Google's covered services: a list copied from a Doc into Meta or Google Ads is outside it, and this directory lists Meta and Google Ads as not signing a BAA. Curve Compliance sends conversions to ad platforms server-side instead, with a fixed list of fields for each platform.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Google before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call