Is Google Cloud HIPAA compliant? The BAA, covered products and what stays with you
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/is-google-cloud-hipaa-compliant
Last updated: November 11, 2026
Is Google Cloud HIPAA compliant? Not on its own. As of November 11, 2026, Google Cloud can hold PHI under Google's BAA, on covered products that you configure yourself. HHS certifies no cloud, Google's included.
So a Google Cloud HIPAA compliant build is something you assemble, not something you buy. This guide covers how the business associate agreement (BAA) is accepted, what it covers and what stays with you. Google's BAA page uses the name Google Cloud Platform, or GCP in its browser title. Every Google fact below was read on Google's own pages on November 11, 2026. We sell managed hosting on AWS, so weigh this as a disclosure.
TL;DR: Quick answer
Is Google Cloud HIPAA compliant? Not on its own. Google says its cloud supports HIPAA compliance within the scope of a BAA.
You accept the BAA in the console, starting from the Google Cloud IAM & Admin page. Google says one project per account is enough.
As of November 11, 2026, Google's HIPAA page lists 146 Google Cloud products under the BAA. Disable services that are not listed, and keep PHI off pre-GA offerings.
No product with Firebase in its name is on that list. Google lists BAA coverage as No for Firebase Authentication.
Configuration, access, logging, encryption keys and the risk analysis stay with you. A Google Cloud HIPAA compliant build is your work, not Google's.
Does Google sign a BAA for Google Cloud, and who accepts it?
Google offers a BAA for Google Cloud, and the customer accepts it in the Google Cloud console. HHS says a customer that keeps electronic protected health information (ePHI) in a cloud without a BAA is in violation of the HIPAA Rules. Our guide to the business associate agreement covers what the contract must contain.
As of November 11, 2026, Google's console help page lists four steps. The labels below come from that page, not the live console.
Go to the Google Cloud IAM & Admin page.
If a project isn't already selected, select one.
Below "Google Cloud Platform HIPAA Business Associate Addendum", click "Review and Accept".
Read the agreement and click "I Accept".
Google says accepting in one project per account is enough. These steps apply only when your agreement does not already include the HIPAA BAA.
The person who clicks states that they have legal authority to bind the customer. Google's BAA tells anyone without that authority not to click. Google's public help page names no console role for this step, so check with your Google Cloud administrator.
Google's compliance page also points organizations to their account manager for a BAA. It says the BAA is not open to changes. The online BAA does not apply to customers of an unaffiliated reseller, or where an offline version was signed. Accepting the BAA is step one of a Google Cloud HIPAA compliant build, not the last.
Which products does the Google Cloud BAA cover?
As of November 11, 2026, Google's HIPAA page lists 146 Google Cloud products under the BAA, plus Google Cloud's entire infrastructure. The table shows common building blocks of a Google Cloud HIPAA compliant build and any note Google's page attaches to each.
Product, as Google lists it | On the covered list (November 11, 2026) | What Google's page adds |
|---|---|---|
Compute Engine, Persistent Disk | Yes | No product note. A separate Google guide puts the bulk of the security responsibilities for infrastructure services on the customer. |
Cloud Storage | Yes, with a note | Enable Object Versioning to keep history and recover from accidental deletion. |
Cloud SQL, Spanner, Firestore, BigQuery | Yes | No product note. Firestore in Datastore mode is listed separately, with its own note. |
Google Kubernetes Engine, Cloud Run, App Engine | Yes | No product note. |
Cloud Logging | Yes, with a note | Set audit log export destinations and log access controls. Review audit logs regularly. |
Cloud Monitoring | Yes, with a note | Keep PHI out of metric labels, VM labels, dashboard titles and alerting configurations. |
Cloud CDN | Yes, with a note | Do not request caching of PHI. |
Identity Platform | Yes, with a note | Store only the minimum sign-in data. No PHI in custom attributes. Do not use its SDKs and client libraries with PHI. |
Any Google Cloud service not on the list | No | Disable it when working with PHI. If it cannot be disabled, do not use it for PHI. |
Pre-GA offerings (Early Access, Alpha, Beta, Preview, Experimental or a similar label) | Not for PHI | Unless a notice or the offering's own terms expressly say otherwise. |
Products with Firebase in the name | None listed | Check each service. See the Firebase section below. |
Check three things. Is the product on Google's list by its current name? Does its note add limits? Is the feature generally available, with no pre-GA label in its documentation? Google's BAA does not apply outside its covered services, so a Google Cloud HIPAA compliant design keeps PHI on listed products only. The list changes, so read Google's page again before PHI goes to a new product.
Google Workspace is a separate product family with its own BAA step in the Admin console. Our guide to the Google Workspace BAA covers what that agreement leaves out.
Is Firebase covered by the Google Cloud BAA?
Not as a brand. As of November 11, 2026, Google's covered list names no product with Firebase in its name. Firebase's terms page puts Firebase Authentication, Cloud Firestore, Cloud Functions for Firebase and Cloud Storage for Firebase under the Google Cloud Platform Terms of Service. Yet Google's page comparing Identity Platform with Firebase Authentication lists BAA coverage as Yes for the first and No for the second. So sitting under the Google Cloud terms is not the same as BAA coverage.
Under the Crashlytics and App Distribution terms, covered entities and business associates may not send PHI to Google without its prior written consent. For a Google Cloud HIPAA compliant app, check each Firebase service against the covered list and its own terms.
What stays with you on a Google Cloud HIPAA compliant build?
Five things stay with you: configuration, access, logging, encryption keys and the risk analysis. Google calls HIPAA compliance a shared responsibility, the idea behind the shared responsibility model. Google's BAA says the customer alone is responsible for making sure its use of the services complies with HIPAA.
Configuration. Google says it provides the infrastructure security controls. You are responsible for configuring and securing the environment and applications you build on them.
Access. Google says customers always remain responsible for their access policies and their data. Its HIPAA page says to tightly control service accounts and service account keys.
Logging. As of November 11, 2026, Google says Admin Activity audit logs are always written. Data Access audit logs, which record reads and writes of your data, are disabled by default, except for BigQuery. Once on, they go to a log bucket that keeps them 30 days unless you change the retention. See our glossary entry on audit logging.
Encryption keys. Google's encryption page, last updated in May 2024, says Google owns and manages the keys used in default encryption at rest. Cloud KMS lets you create and control your own keys. HHS says encryption alone cannot safeguard ePHI as the Security Rule requires.
The risk analysis. HHS says the customer should understand the provider's environment so it can run its own risk analysis. The Security Rule requires an accurate and thorough assessment of the risks to the ePHI you hold. Our HIPAA risk analysis guide lists the elements to cover.
HHS says that in an investigation its Office for Civil Rights will weigh a customer's failure to implement security features its contract left to it. So those features are part of any Google Cloud HIPAA compliant setup.
Should you run it yourself on Google Cloud, or use a managed host?
Run it yourself if your team can configure Google Cloud and keep it configured. Use a managed host if it cannot and the workload fits a standard server stack.
Question | Run it yourself on Google Cloud | Use a managed host |
|---|---|---|
Whose BAA do you accept? | Google's, in the console. | The host's own BAA, for the servers and services it runs. |
Who configures servers, access and logging? | Your team. | The host, for the layers named in its contract. |
Where does the workload run? | On Google Cloud. | On the host's platform, which may be another cloud. |
Which services can you use? | Any product on Google's covered list. | What the host's plans include. |
Who do you need on staff? | Engineers who know Google Cloud and keep records of its settings. | An owner for the application, the vendors and the risk analysis. |
What stays with you either way? | The risk analysis, workforce access and your other vendors' BAAs. | The same. |
Best fit | A product team already building on Google Cloud. | A site, portal or app with no cloud engineers behind it. |
Whether you run a Google Cloud HIPAA compliant build or pay a managed host, the risk analysis stays with you. Our guide to managed vs self-managed HIPAA hosting sets out the trade-off.
Disclosure: where do our own managed plans run?
Our plans run on single-tenant AWS. Each plan is one server in one AWS availability zone. We sell this, so weigh it as a disclosure. We answer the question is AWS HIPAA compliant in a separate guide.
The service is fully managed infrastructure. Our team applies OS and PHP updates. Your application code, CMS, plugins, themes, modules and extensions stay with you. We sign the BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run. Email, SMS, EHR, form and AI model vendors need their own BAA. Every plan includes:
CloudFront CDN and a web application firewall (WAF).
EBS storage with 7-day snapshot retention.
Encryption at rest and in transit.
Six-year audit logging.
Tested encrypted backups.
Managed plans from $229 a month.
When do you not need us?
You do not need us if your team already runs a Google Cloud HIPAA compliant setup and can keep it configured. Keep your setup, and use the product table and the five items above as a checklist. Stay on Google Cloud too if your product depends on its data, analytics or AI services. Our plans run on AWS. If you have no cloud engineers and one managed server fits your workload, request a quote for your application.
Frequently asked questions
Is Google Cloud HIPAA compliant?
Not on its own. Google says its cloud supports HIPAA compliance within the scope of a BAA. As of November 11, 2026, PHI belongs only on covered products that you configure yourself.
Does the BAA alone make Google Cloud HIPAA compliant?
No. Google says the covered entity is responsible for building its solution on the approved services and then for putting the compliance controls in place. HHS says its Office for Civil Rights does not endorse, certify or recommend specific technology or products.
Where do you accept the BAA in the Google Cloud console?
Go to the Google Cloud IAM & Admin page and select a project. Below the HIPAA Business Associate Addendum, click "Review and Accept", then "I Accept". Google's help page says these steps apply only when your agreement does not already include the BAA. Customers of an unaffiliated reseller follow their reseller agreement. Google also points organizations to their account manager.
Are Cloud Storage and Cloud SQL covered by the Google Cloud BAA?
Yes. Both are on Google's covered list as of November 11, 2026. Cloud Storage is not Google Drive, which sits on the separate Google Workspace list. A Google Cloud HIPAA compliant design still needs your own access and logging settings.
Is Firebase HIPAA compliant?
Not as a brand. As of November 11, 2026, the list of products under the Google Cloud BAA names no product with Firebase in its name. Google lists BAA coverage as No for Firebase Authentication. Check each Firebase service against that list and its own terms before it touches PHI.
Does the Google Cloud BAA cover Google Maps Platform?
No. As of November 11, 2026, Google Maps Platform is not on the covered list, and the BAA does not apply outside its covered services. The Maps Platform terms bar using it to transmit, store or process health information subject to HIPAA. Keep PHI away from it in any Google Cloud HIPAA compliant app.
Recap: Google Cloud HIPAA compliant
To recap, is Google Cloud HIPAA compliant? Not on its own. Accept the BAA in the console. Keep PHI on products from Google's covered list. Then do the five jobs that stay with you, from configuration to the risk analysis. A managed host is the other route, and ours runs on AWS.
This article is general information, not legal advice. Google facts are as read on November 11, 2026, and Google can change them. Whether a Google Cloud HIPAA compliant build meets the rules depends on your own configuration and risk analysis. Confirm details with Google and qualified counsel. We sell HIPAA compliant hosting on AWS. Reviewed November 2026.
Sources
Google Cloud: HIPAA compliance on Google Cloud and Google Workspace (page footer November 10, 2026).
Google: Google Cloud Platform HIPAA Business Associate Addendum (last modified September 22, 2025).
Google Cloud console help: Privacy compliance and records for Google Cloud.
Google Cloud: HIPAA compliance offering page and Service Specific Terms.
Google Cloud: Differences between Identity Platform and Firebase Authentication.
Firebase: Terms of Service for Firebase Services (last modified September 24, 2026) and Crashlytics and App Distribution terms (last updated June 1, 2023).
Google Cloud: Shared responsibilities and shared fate on Google Cloud.
Google Cloud: Default encryption at rest, Cloud Audit Logs overview and Cloud Logging quotas and limits.
Google Workspace Help: HIPAA compliance with Google Workspace and Cloud Identity.
Google Maps Platform: Terms of Service (last modified August 26, 2026).
HHS: Guidance on HIPAA and Cloud Computing (last reviewed December 23, 2022).
45 CFR 164.308.