Yes, on paid Google Workspace editions, once your admin accepts the Google Workspace Business Associate Agreement (BAA) in the Admin console: a BAA is the contract HIPAA requires before a vendor handles patient information, and Google's HIPAA page lists Google Chat among the services it covers. Google says customers without a signed BAA must not use PHI in Workspace, and a free personal Google account is not a Workspace customer.
The short answer and why
Google puts the answer in its help center. As of November 2026, Google says Workspace and Cloud Identity customers accept the BAA electronically in the Admin console, under Account settings and then Legal and compliance, and that customers without a signed BAA "must not use PHI in Google Workspace or Cloud Identity services." Google's HIPAA page, updated October 28, 2026, lists Google Chat among the covered Workspace services. Terms change; verify on Google's site before you rely on this.
The background: HIPAA applies to covered entities (practices and other providers) and to their business associates (vendors that handle patient information for them). Before a vendor handles protected health information (PHI), anything that identifies a patient and relates to their health, care or payment, the practice needs a Business Associate Agreement (BAA) with that vendor (45 CFR 164.502(e)). Google offers one, but someone with admin rights has to click accept, and until then Google's own instruction is to keep PHI out.
There is no free business edition: Google offers a 14-day trial, then Business Starter at $7 per user per month on the annual plan or $8.40 on the flexible plan, so five people cost $35 or $42 a month. Chat is bundled; you cannot buy it alone.
What HIPAA actually asks of a chat app
HIPAA asks for more than the contract.
| What the rule needs | What Google Chat offers per its own site | |
|---|---|---|
| Signed BAA | A contract with the vendor before any PHI is shared | Accepted by an admin in the Admin console; covers Chat, Gmail, Drive, Meet, Calendar, Vault and others; excludes third-party apps and Additional Google Services |
| Access controls | Only current staff, with roles that limit who sees what | Accounts belong to your organization and are managed in the Admin console, which also holds compliance settings |
| Audit log | A record of who sent, read and exported what | Not described on the Chat and HIPAA pages we read; ask Google which editions include the reporting you need |
| Encryption in transit and at rest | An addressable safeguard for data moving and stored | Not described on the pages we read; check Google's security documentation |
| Retention and deletion | Keep and delete on a schedule you control | Google Vault is on the covered-services list; the pages we read do not say which editions include it |
| Minimum necessary | Share only what the other person needs | A policy you write; the covered-services list does not change what staff type |
What Google says
Three statements carry the weight. First, the BAA is accepted electronically in the Admin console by Workspace and Cloud Identity customers; the help page does not name specific editions. Second, customers without a signed BAA must not use PHI in Workspace. Third, the covered-services list includes Google Chat, Gmail, Drive with Docs, Sheets and Slides, Meet, Calendar, Keep, Sites, Tasks, Vault and Groups; third-party apps, add-ons and "Additional Google Services" are not covered.
Chat spaces, DMs and threads are in every edition. Business Standard is $14 per user per month annual or $16.80 flexible, Business Plus $22 or $26.40, and Enterprise is contact sales. Google's pricing page currently shows time-limited introductory discounts, one more reason to check the live page.
What a practice would have to do
- Buy a paid Workspace edition for every staff member who will see patient information. No personal Gmail accounts in the loop.
- Have a super admin accept the BAA in the Admin console: Account settings, then Legal and compliance. Save a copy and the date.
- Keep PHI inside covered services. Treat third-party add-ons and Additional Google Services as off limits for patient details unless they bring their own BAA.
- Set up Chat spaces for the team and decide who belongs in each. A space with everyone in it is where minimum necessary goes to die.
- Write retention, device and offboarding policies, use Vault for retention if your edition includes it, and train staff once.
The acceptance step is the one offices forget: Workspace gets bought for email by whoever set up the domain years ago, and nobody ever opens Legal and compliance.
The real risk in a small practice
Take a mental health group practice with four therapists and an office manager. They have had Workspace for email since the beginning, and Chat spaces grew out of it: "Scheduling," "Billing questions," "Clinical consults." Nobody accepted the BAA because nobody knew there was one. The part-time biller works from a personal Gmail account and gets forwarded threads. An intake PDF posted in a Chat space becomes a copy in Drive, then an attachment in Gmail, then a shared link to a supervisor outside the practice.
Everything in that story could be inside the BAA with a few decisions: the acceptance click, a paid seat for the biller, a rule about external sharing. The danger with a suite is that chat is never only chat. PHI spreads into mail and files the moment it enters, so minimum necessary and deletion get harder. That is why a staff-only tool appeals to some practices: fewer places for a patient's name to end up.
Alternatives with a BAA
If you are not on Workspace, buying it just for chat is a lot of suite for one job. Prices are as of November 2026; check each vendor's site.
Yodl signs a BAA with every customer, on every plan, as part of signing up, so there is no acceptance step to forget. It is $10 a month per location for 5 users, 20 GB of file storage, extra users at $2 each, month to month. It is staff chat only: channels, DMs, threads, file sharing and search, with invite-only workspaces, channel roles (Manager, Member, Viewer), an audit viewer with CSV export, retention controls and legal hold. No email, no Drive, no video. See Yodl vs Google Chat.
Microsoft Teams Essentials is $4.00 per user per month paid yearly, and Microsoft says its HIPAA BAA applies by default to commercial plans through its Online Services Data Protection Addendum. Chanty lists "HIPAA compliance and BAA" on its Business plan at $3 per user per month billed annually or $4 monthly. Google Chat stays the sensible pick for an office that already runs Gmail and Drive on Workspace and will make the admin clicks.
If you want staff chat with the BAA signed up front, Yodl is $10 a month for 5 people with a signed BAA at yodl.cc/pricing.
Google Chat is covered by the Google Workspace BAA on paid editions, but only after an admin accepts it in the Admin console, and Google says to keep PHI out until then. Already on Workspace? Click accept today. Not on it? A staff-only tool with the BAA built in is simpler.
Frequently asked questions
Does encryption make Google Chat HIPAA compliant?
No. Encryption alone would not be enough anyway. Coverage comes from the Workspace BAA, which an admin must accept, plus access controls, retention and policies on your side.
Can I use Google Chat for non-PHI scheduling messages?
Yes. A message with no patient information is not PHI, so it is fine on any edition. On a paid edition with the BAA accepted, patient details are allowed too, inside your minimum-necessary policy.
Where do I accept the Google Workspace BAA?
In the Admin console, under Account settings, then Legal and compliance. Keep a record of who accepted it and when.
Is a personal Gmail account or free Google Chat HIPAA compliant?
No. The BAA is for Google Workspace and Cloud Identity customers, and Google says anyone without a signed BAA must not use PHI in Workspace. A free personal account is not a Workspace customer.
Which Workspace edition do I need for HIPAA?
Google's help page does not name specific editions; business editions start at $7 per user per month on the annual plan. Confirm the BAA option appears in your Admin console before you put patient details anywhere.