HIPAA Compliance: Protect Medical Records in Google Drive For Free

Since Google offers a BAA for Google Sheets (indeed, requires one), Google Sheets is HIPAA compliant. This fact, however, does not relieve covered entities of their existing HIPAA obligations. Once the BAA has been signed, the covered entity must properly and correctly use Google Sheets in a HIPAA compliant manner.

Which Google Workspace plan can be HIPAA compliant? To become HIPAA certified when using Google Workspace, the Google Workspace plan your organization chooses must be a paid plan. This means that any of the free Google Workspace offerings are not allowed as options if you must align with HIPAA regulations.

Get The FREE HIPAA Compliance Checklist Obtain a BAA from Google prior to using G Suite with PHI. Configure access controls carefully. Use 2-factor authentication for access. Use strong passwords. Turn off file syncing. Set link sharing to off.

HIPAA-regulated entities using Google Analytics must refrain from exposing to Google any data that may be considered Protected Health Information (PHI), even if not expressly described as PII in Google's contracts and policies.

Is it possible to use the free Google Docs service in compliance with HIPAA? It is not possible to use the free Google Docs service in compliance with HIPAA because the free service lacks the capabilities required to comply with the Security Rule (access controls, event logs, audit reports, etc.).

Gmail, Calendar, Drive (including Docs, Sheets, Slides, and Forms), Apps Script, Keep, Sites, Jamboard, Google Chat, Google Meet, Google Voice (managed users only), Google Cloud Search, Cloud Identity Management, Google Groups, Google Tasks, Vault (if applicable) and AppSheet.

Google Drive is HIPAA-Compliant?with some tweaks Everyone with access should be trained on how to use Google Drive. And make sure settings and permissions are monitored regularly to track who has access to what. Even so, Google Drive covers document and file storage.

Google Drive is HIPAA-Compliant?with some tweaks The answer is it can be?but you must put in the work to tighten the settings and minimize the risk of unauthorized access to client data. Everyone with access should be trained on how to use Google Drive.