Skip to main content
BAA Directory

Does Google Workspace sign a BAA?

The answer

Signs a BAA

Yes. Google offers a HIPAA Business Associate Addendum for Google Workspace, covering the services it lists.

Automation and workspace. Checked on the vendor's own pages on .

On this page

What Google says

“This HIPAA Business Associate Addendum (“BAA”) is entered into between Google and the customer agreeing to the terms below ("Customer"), and supplements, amends and is incorporated into the Services Agreement(s) (defined below) solely with respect to Covered Services (defined below).”

Source: Google Workspace HIPAA Business Associate Addendum, checked .

What the BAA covers and excludes

Covers, in Google's words:

  • Google's list of covered Workspace services: "AppSheet, Apps Script, Cloud Identity Management, Gemini app (excluding Gemini in Chrome), Gemini Mac App, Gemini in Workspace, Gmail, Google Calendar, Google Chat, Google Cloud Search, Google Drive (including Google Docs, Google Forms, Google Pics, Google Sheets, Google Slides, and Google Vids), Google Groups, Google Keep, Google Meet, Google Sites, Google Tasks, Google Vault (if applicable) and Google Voice (managed users only)." (Google Workspace HIPAA included functionality)

Excludes or limits, in Google's words:

  • The covered list excludes "Gemini in Chrome", and Google Voice is covered for "managed users only".

What this means for ad tracking

Google Workspace often holds the lead notifications, Sheets and Forms that marketing teams work from. Google Forms and Sheets are on the covered list; Google Analytics and Google Ads are separate products.

A Workspace BAA does not extend to Google Ads or Google Analytics. See the Google Ads and Google Analytics 4 entries.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

How Curve helps

  • Keep Google Workspace for what it does well. Curve carries the conversion signal to your ad platforms separately, under its own BAA.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • Identifiers are hashed with SHA-256 to each platform's requirements.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Google Workspace sign a BAA?

Yes. Google offers a HIPAA Business Associate Addendum for Google Workspace, covering the services it lists. In Google's words: “This HIPAA Business Associate Addendum (“BAA”) is entered into between Google and the customer agreeing to the terms below ("Customer"), and supplements, amends and is incorporated into the Services Agreement(s) (defined below) solely with respect to Covered Services (defined below).” We checked Google's own pages on September 29, 2026.

Is Google Workspace HIPAA compliant once the BAA is signed?

A BAA is Google's commitment to protect the PHI it handles for you. How you set up Google Workspace still matters, and the BAA does not reach ad platforms that receive data from your site or from Google Workspace.

Does a BAA with Google Workspace cover my ad pixels?

No. A BAA covers the data Google handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with Google.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Google before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call