Skip to main content
BAA Directory

Is Google Sheets HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, as part of Google Workspace. Google lists Google Sheets, within Google Drive, among the services its Workspace BAA covers, once an administrator accepts it.

Automation and workspace. Checked on the vendor's own pages on .

Using Google Sheets on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Google says

“Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.”

Source: Google Workspace Admin Help, HIPAA Compliance with Google Workspace and Cloud Identity, checked .

“Administrators must review and accept a BAA before using PHI in Google services.”

Source: Google Workspace Admin Help, HIPAA Compliance with Google Workspace and Cloud Identity, checked .

“All users can access this subset of Core Services for use with PHI under the BAA as long as the health care organization configures those services to be HIPAA compliant”

Source: Google Workspace and Cloud Identity HIPAA Implementation Guide (September 2025), checked .

What the BAA covers and excludes

Covers, in Google's words:

Excludes or limits, in Google's words:

  • "Third-party applications including add-ons are not included in the Included Functionality covered by the BAA." (Google Workspace Admin Help)
  • Google's BAA does not apply to PHI that the customer "creates, receives, maintains, or transmits outside of the Covered Services (including Customer’s use of its offline or on-premise storage tools or third-party applications)." (Google Workspace HIPAA Business Associate Addendum)

What this means for ad tracking

Google Sheets often holds exported lead lists and the spreadsheets teams use to upload offline conversions to Meta or Google Ads, so rows that tie a person to their care can end up there.

A BAA with Google covers those rows while they sit in Sheets. Google's BAA does not apply to PHI the customer handles “outside of the Covered Services” (Google), so a sheet downloaded and uploaded to an ad platform leaves it behind. This directory lists Meta and Google Ads as not signing a BAA. See which ad platforms sign a BAA.

Google Sheets sits inside Google Drive, under the Google Workspace BAA. To compare storage providers, see our guide to HIPAA compliant cloud storage.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, and sends each platform only a fixed list of fields. Curve also receives outcomes from CRMs and booking systems through incoming webhooks, or as offline conversion uploads from a CRM or EHR, and credits each one to the original ad click. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Google Sheets for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Google Sheets HIPAA compliant?

Google Sheets can be used with PHI once your Google Workspace administrator accepts Google's BAA, because Google lists Sheets, within Google Drive, among its covered services. Google says those services “must be configured by IT administrators to help ensure that PHI is properly protected” (Google), so sharing, add-ons and scripts still matter.

Does Google Sheets sign a BAA?

Yes, as part of Google Workspace. Google lists Google Sheets, within Google Drive, among the services its Workspace BAA covers, and an administrator accepts that BAA in the Admin console. In Google's words: “Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.” We checked Google's own pages on October 26, 2026.

Which Google Workspace plans include a BAA for Google Sheets?

Google's covered-services list and its HIPAA implementation guide do not name particular Workspace editions. Google says the BAA is reviewed and accepted from an administrator account for a Google Workspace or Cloud Identity account, and that “users of the legacy free edition of Google Workspace (sometimes referred to as "Google Apps Standard Edition") cannot review and accept a BAA from Google at this time” (Google Workspace Admin Help).

Is Google Sheets on a personal Google account covered by a BAA?

No. Google offers its BAA to Google Workspace and Cloud Identity customers, accepted by an administrator in the Admin console, and says “Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services” (Google Workspace Admin Help). Google's pages describe no BAA for a personal Google account, so use Google Sheets with PHI only in a Workspace account whose administrator has accepted the BAA.

Can I keep lead or patient lists in Google Sheets?

Inside a Workspace account whose administrator has accepted Google's BAA, with sharing set the way your policies require. The BAA stops at Google's covered services: Google's BAA does not apply to PHI the customer handles “outside of the Covered Services” (Google), so a sheet uploaded to Meta or Google Ads is outside it. This directory lists Meta and Google Ads as not signing a BAA. Curve Compliance sends conversions to ad platforms server-side instead, with a fixed list of fields for each platform.

What should I set up before putting PHI in Google Sheets?

A super administrator accepts the BAA in the Admin console under Account settings, then Legal and compliance (Google Workspace Admin Help). Google's HIPAA implementation guide then recommends that users “avoid putting PHI in titles of such files, folders, or Shared Drives,” says admins can set the default file visibility to “Private to the owner,” and says admins “should consider disabling third party applications that can be installed, such as apps using the Google Drive SDK API and Google Docs add-ons” (Google). The same guide says other Google services that your Workspace agreement does not cover, such as YouTube and Blogger, “must be disabled for Google Workspace users who manage PHI within the Included Functionality” unless a separate BAA covers them (Google).

Are Google Sheets add-ons covered by Google's BAA?

No. Google says “Third-party applications including add-ons are not included in the Included Functionality covered by the BAA” (Google Workspace Admin Help). For Apps Script projects that update Sheets or send data to another application, Google's guide says to “ensure that PHI is included only if all recipients or users with access to the target file or system are authorized to access it” (Google).

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Google before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call