This blog was originally posted on the Aware website, but with the acquisition of Aware by Mimecast, we are ensuring it is also available to visitors to the Mimecast website.
Google Workspace supports HIPAA compliance, but it requires user action. Signing a BAA, configuring security measures, and training employees are essential steps.
Proper implementation is critical to safeguard PHI and meet regulatory standards. Without these actions, healthcare organizations risk noncompliance and data breaches.
Data security and compliance are especially important when dealing with sensitive healthcare information. Ensuring that your business tools and platforms adhere to regulatory standards is crucial to maintaining the trust of your patients and avoiding costly penalties. The Health Insurance Portability and Accountability Act (HIPAA) sets forth strict requirements for patient data protection, making it vital to ask the question: Is Google Workspace HIPAA compliant?
Is Google Workspace HIPAA Compliant?
Google Workspace supports HIPAA through a number of compliance measures that protect confidential user data, including configurations for HIPAA-compliant email and the ability to implement two-factor authentication on Workspace accounts. However, to be fully HIPAA compliant while using Google Workspace, end users must also take appropriate action to ensure the security of PHI and other sensitive data while using Workspace within a healthcare setting.
Some examples include signing a HIPAA Business Associate Agreement (BAA) with Google, restricting PHI to secure Google services only, and regularly training employees on their responsibilities under HIPAA to protect patient information.
What is HIPAA?
HIPAA regulates how covered healthcare entities must safeguard patient information during routine transactions. It consists of several rules and regulations, each serving a unique purpose.
Privacy Rule—Establishes standards for the protection of individuals' medical records and protected health information (PHI).
Security Rule—Outlines the safeguards that must be in place to protect electronic PHI (ePHI), ensuring its confidentiality, integrity, and availability.
Unique Identifiers Rule—Assigns unique identifiers to healthcare providers, health plans, and employers for standardizing electronic transactions.
Transactions and Code Set Rule—Sets standards for electronic healthcare transactions, including code sets for diagnoses and procedures.
Enforcement Rule—Outlines penalties and procedures for enforcing compliance with the other HIPAA rules.
What is Protected Health Information (PHI)?
PHI is any individually identifiable health information, including patient names, addresses, social security numbers, and medical records. HIPAA strictly regulates the use, disclosure, and storage of PHI.
Compliance with HIPAA is not just a checkbox—it impacts how data is collected, how long it can be stored, and how it must be protected. Willful failure to comply with HIPAA can result in penalties of $50,000 or more per incident.
Related Tags
Data Governance
Share this
Is Google Workspace HIPAA compliant?
Google Workspace—formerly G-suite—is Google's answer to Microsoft Office, and encompasses Google's range of cloud-based services. Using Google Workspace, businesses can run a cohesive and interconnected digital workplace accessible to all their employees from any location.
HIPAA-covered entities such as healthcare providers, insurance companies, and clearing houses who choose Google services for their business needs must understand how the Workspace platform supports HIPAA regulations and fulfills their obligations to protect PHI.
Out of the box, Google Workplace is not fully HIPAA compliant. Companies must take several measures to ensure proper configuration for HIPAA-compliant usage, which can be followed using Google’s HIPAA Implementation Guide.
Some essential steps toward HIPAA compliance in Google Workspace include:
Using a paid version of Google Workspace, such as Google Workspace Enterprise.
Signing a BAA with Google. A BAA is a legally binding document that establishes Google as a "business associate" and outlines its responsibilities for protecting ePHI.
Configuring Workspace for PHI, including limiting PHI to core services, restricting access to authorized personnel, and implementing encryption to protect data.
Google Workspace products and HIPAA compliance
With Google Workspace, HIPAA-covered healthcare organizations have a wide range of products to operate flexibly and collaboratively in a secure environment. Those products include Gmail, Google Drive, Google Meet, Calendar, Google Sites, Google Cloud Identity Management, Google Apps Script, and more.
Google also continues to integrate AI advancements such as Google Gemini, but organizations must verify that such tools align with compliance standards before handling PHI.
Covered entities must ensure HIPAA compliance for each of these Google products. This can be done by checking your Workspace subscription tier and settings for each application your organization utilizes.
The limitations of free Gmail Accounts for HIPAA compliance
While Google Workspace is HIPAA-compliant, free Gmail accounts are not suitable for handling PHI. Free Gmail accounts lack the necessary security features and administrative controls to comply with HIPAA regulations.
Healthcare organizations that use free Gmail accounts expose themselves to the risk of noncompliance, as they cannot sign a Business Associate Agreement (BAA) with Google, which is a mandatory step in ensuring HIPAA compliance.
Additionally, free Gmail accounts do not offer the advanced security configurations available in Google Workspace, such as HIPAA compliant email encryption, data loss prevention (DLP), and audit logging. As a result, using free Gmail accounts for storing or transmitting PHI can lead to data breaches and legal repercussions.
What is a Business Associate Agreement (BAA) and why is it important ?
A BAA is a legally binding contract between a HIPAA-covered healthcare provider and a third-party contractor, such as a SaaS provider like Google Workspace. Key reasons a BAA is important for HIPAA compliance include:
Defining permissible use and disclosures of PHI by the business associate, limiting its use to only what’s necessary.
Outlining the third party’s obligation to enact safeguards to protect the privacy and security of the PHI, including administrative, technical, and physical.
Requiring notification of any breaches of the PHI so the healthcare provider can begin mitigation procedures.
Extending HIPAA compliance to the business associates so they are bound to fines and penalties for violations rather than the healthcare provider.
Ensuring third parties hold their subcontractors to the same protections of PHI to prevent compliance gaps down the vendor chain.
Overlooking a BAA can create compliance gaps between healthcare organizations and third-party vendors that leave room for unnecessary liability risks.
To sign a BAA with Google Workspace:
Make sure your subscription level is Enterprise level. Then, log in to the Admin Console as an administrator. Navigate to Account Settings and then the Legal and Compliance area. Scroll to the “Security and Privacy Additional Terms” and locate the “Google Workspace/Cloud Identity HIPAA Business Associate Amendment.”
Click “Not accepted” and then “Review and accept” to carefully review the terms. Once you’ve read through the BAA carefully, answer the three confirmation questions. Finally, click, “I Accept” to sign Google’s BAA.
There are further steps required to make Google Workspace HIPAA compliant, but signing the HIPAA BAA is a necessary start.
How to make Google Workspace HIPAA compliant
HIPAA compliance in Google Workspace involves several steps that ensure the proper storage, handling, and monitoring of PHI.
Sign a BAA with Google, outlining the responsibilities of each party to ensure the compliant handling of sensitive data. It should be noted that the BAA is only available to Google Workspace users with the Enterprise subscription plans.
Configure Workspace to meet HIPAA standards using Google’s available functionality and third-party integrations. Variable factors, including two-factor authentication, encryption, third-party access controls, revoking permissions to unused Workspace apps, and data storage practices must all be addressed to meet current HIPAA requirements.
Creating notifications to detect suspicious activity in Workspace, configuring appropriate user groups, and providing email security are also advisable methods of maintaining HIPAA compliance throughout the Workspace platform.
Employees must also be trained on their obligations to safeguard data under HIPAA. This includes reviewing best practices for handling ePHI and defining company standards and protocols for accessing or transmitting PHI.
For ongoing compliance and to mitigate HIPAA violations as quickly as possible, additional steps can be taken. These include:
Regularly auditing and monitoring Google Workspace for HIPAA compliance. Should any violations come to light, handle them swiftly within your organization’s processes.
Establishing acceptable use policies for Google Workspace’s core services. These standards of conduct will provide employees with the framework they need for the most common compliance risks they face.
Developing key performance indicators, such as violation tracking, training completion rates, and effectiveness of corrective actions, for measuring and monitoring compliance.
Fostering a culture of compliance and ethics. A code of conduct, compliance training, policies, and a readily available compliance manual will go a long way toward building an effective compliance mindset.
It’s also important to protect and preserve PHI and other sensitive data with robust backup and recovery mechanisms that ensure retention requirements are met while preserving data integrity and availability.
Is HIPAA compliance all the coverage you need?
While HIPAA compliance is crucial for healthcare organizations, it's not the only regulation that might apply to your business. Depending on your industry and the nature of your operations, other compliance standards, such as HITRUST, may also be relevant. It's essential to assess your specific compliance needs comprehensively and explore how to configure Google Workspace to meet all the compliance obligations governing your digital workplace.
How Mimecast Aware can support HIPAA compliance in Google Workspace
Aware enables healthcare organizations and other covered entities to meet their HIPAA compliance obligations within digital tools where employees collaborate.
Mimecast Aware’s native Google integration:
Supports risk mitigation and compliance adherence within this dataset using industry-leading natural language processing (NLP) AI workflows that safeguard data using keyword and regular expression (regex) driven automations.
Provides continuous insight into complex datasets using easily configurable workflows, swiftly identifying potential data breaches, facilitating prompt remediation, and enhancing cybersecurity.
Uses federated searches to reduce investigation time and role-based access control to limit ePHI exposure and security risk.
Request a demo to discover how Mimecast Aware proactively detects unauthorized access and risky behavior and supports HIPAA compliance for Google products.
First Published Oct. 2023. Updated Apr. 2024.
Subscribe to Cyber Resilience Insights for more articles like these
Get all the latest news and cybersecurity industry analysis delivered right to your inbox
