Is Google Cloud Platform HIPAA Compliant? Requirements and Setup

Is Google Cloud HIPAA Compliant? The Short Answer

Yes, with three conditions:

1. The BAA is in place. You accept Google’s HIPAA Business Associate Addendum in the Google Cloud console, unless your Google Cloud agreement already includes it.
2. Covered products only. Use PHI only in products on Google’s list of HIPAA-supported services, and follow any restrictions noted for them.
3. Your configuration. The safeguards HIPAA requires are set up and run by you.

Miss any one of the three and the environment isn’t compliant, however secure Google’s own infrastructure is.

Introduction

Google Cloud is a common choice for healthcare apps built by teams that already use Google’s tools or that need its data and AI services. Its HIPAA coverage is detailed: Google publishes not just which products are covered, but specific conditions for using some of them with PHI.

This guide covers the Google Cloud side: how to put the BAA in place, which products it covers, what developers ask about Firebase and Gemini, and how to set up each safeguard. For the requirements that apply to any host, see what HIPAA-compliant hosting requires.

The Google Cloud BAA

Google signs a BAA for Google Cloud, which it calls the HIPAA Business Associate Addendum. You can accept it in the Google Cloud console (Google: accept the BAA):

1. Open the privacy page under IAM & Admin.
2. Select a project if one isn’t already selected.
3. Under the HIPAA Business Associate Addendum heading, click Review and Accept, then I Accept.

You only need to opt in within one Google Cloud project in your account. If your Google Cloud agreement already incorporates the BAA by reference, you can’t opt in again in the console, because it’s already in place.

The BAA doesn’t make your deployment compliant. Google describes HIPAA compliance as a shared responsibility and notes that HHS has no certification program for HIPAA compliance (Google: HIPAA on Google Cloud). For what a BAA does and doesn’t do, see What Is a Business Associate Agreement (BAA)?

Which Google Cloud Products Are Covered?

Google’s BAA covers its underlying cloud infrastructure across regions and zones, but that doesn’t mean every Google product is covered. Use only the listed products for ePHI, subject to their stated conditions and your own data-location requirements. Google publishes the list, with conditions for some products, on its HIPAA compliance page and updates it regularly. Avoid pre-GA or preview offerings with PHI unless Google expressly permits that use in the offering’s notice or terms. These are the products healthcare communication apps commonly use:

Last checked: November 4, 2026.

Is Firebase HIPAA compliant?

Firebase isn’t covered as a whole. Some products Firebase apps rely on are on Google’s list, such as Firestore and Identity Platform, but Firebase Cloud Messaging is not. Check each Firebase feature you use against the list, and keep PHI out of anything that isn’t covered, including push notification content.

Is Gemini HIPAA compliant?

It depends on the product; the name Gemini alone doesn’t mean coverage. On Google Cloud, Gemini Enterprise Agent Platform and generative AI on Agent Platform are on the covered list. Check the exact product and feature against Google’s list before sending ePHI. Workspace users should follow Google’s Workspace guidance for Gemini in Workspace apps.

Does the BAA cover Google Workspace?

Google’s HIPAA page lists supported Workspace services, such as Gmail, Google Drive, and Google Meet, alongside Google Cloud products. That list isn’t the same as the agreement you have in place. Verify which agreement applies to your organization, and follow Google’s Workspace HIPAA guidance for acceptance and configuration. Accepting a BAA in the Google Cloud console doesn’t by itself complete every Workspace requirement.

Shared Responsibility on Google Cloud

Google secures its infrastructure and the products it runs. What falls to you depends on the type of product:

• Infrastructure products such as Compute Engine: you’re responsible for the operating system, patching, firewall rules, applications, and data.
• Managed products such as Cloud SQL and Cloud Run: Google runs the platform; you configure access, networking, backups, and logging.
• In every case: your identities, permissions, data, and how your application handles PHI stay with you, as do the conditions Google attaches to specific products.

How to Set Up a HIPAA-Compliant Google Cloud Environment

These are common configuration steps on Google Cloud, not a complete compliance program. Which you need, and how, depends on your architecture and risk analysis, and HIPAA’s administrative safeguards, policies, and incident procedures sit alongside them. The safeguards themselves are explained in What Are HIPAA Technical Safeguards?

1. Control access

Use Identity and Access Management (IAM) to give each person and service only the permissions they need. Require 2-Step Verification for people, and avoid broad roles such as Owner for day-to-day work.

2. Encrypt ePHI

Google Cloud encrypts data at rest by default. Use Cloud Key Management Service if your requirements go beyond that default, for example, if you need to control your own keys. Use TLS for data in transit. Encryption is addressable under HIPAA, but on Google Cloud the defaults make it the straightforward choice.

3. Log activity at two levels

Cloud Logging records administrative activity and, where you enable it, data access in your projects. Control who can read logs and where they’re exported. Your application also needs its own audit log, because platform logs alone may not identify which clinician or patient accessed a record through your application.

4. Backup and test restores

Back up every ePHI store with Backup and DR Service or the product’s own backup options. Keep copies separate from production, in another region only where your data-residency requirements allow, and test restores on a schedule.

5. Limit network exposure

Keep application servers off the public internet where appropriate, and restrict traffic with firewall rules. For supported managed services, consider VPC Service Controls to restrict access and reduce data-exfiltration risks. Check service support and limitations before defining the perimeter.

6. Watch for threats

Turn on Security Command Center, and make sure someone acts on its findings.

7. Manage sessions

Limit how long administrator sessions to the Google Cloud console last. Separately, build an inactivity timeout into your own application; the two are different controls.

8. Retain and dispose of data deliberately

Use lifecycle and retention settings to delete ePHI when your retention policy says it’s no longer needed. Don’t treat destroying encryption keys as a disposal shortcut: retire a key only after confirming that no backups or records still under retention depend on it.

Where PHI Lands in a Healthcare Communication App on Google Cloud

Most Google Cloud HIPAA guides stop at the database. In a healthcare communication app, PHI spreads into storage, logs, and services that teams don’t think of as holding patient data. The list below is illustrative, showing where these stores typically live on Google Cloud:

• Messages and conversation history, for example in Cloud SQL or Firestore: encrypted, with access limited to the application.
• Attachments such as photos, lab results, and insurance cards, for example, in Cloud Storage: private buckets, access logging, and Object Versioning.
• Call recordings and transcripts, for example, via Speech-to-Text: data logging left off, and retention rules so recordings aren’t kept forever by default.
• Logs and monitoring in Cloud Logging and Cloud Monitoring: no PHI in log lines, labels, metadata, dashboards, or alerts.
• Push notifications, sent through Firebase Cloud Messaging or directly to Apple’s and Google’s services: notification text that says only that a new message is waiting.
• AI prompts and summaries, for example, on the Gemini Enterprise Agent Platform: a covered product, regional settings where Google requires them, and the same controls as messages.
• Backups: encrypted, access-restricted, and covered by documented retention and deletion rules.

Common Mistakes on Google Cloud

Treating Firebase as one covered product. Some underlying products are covered and some, like Firebase Cloud Messaging, aren’t. Check each feature.

Using preview features with PHI. Avoid pre-GA or preview offerings with PHI unless Google expressly permits that use in the offering’s notice or terms, even when the product’s generally available version is covered.

PHI in labels and metadata. Google specifically warns against putting PHI in resource metadata, metric labels, VM labels, dashboards, or alert configurations, which are easy to overlook.

Missing a product’s conditions. Covered doesn’t always mean unconditional: Speech-to-Text data logging, Identity Platform attributes, and Agent Search locations all come with rules.

Relying on platform logs alone. Cloud Logging shows what happened in your projects, but it may not identify which user accessed a record through your application. You need both.

Real patient data in development. Test environments rarely have production’s controls. Use synthetic or de-identified data.

If you’d rather not run this yourself, our guide to managed or self-hosted hosting for HIPAA apps covers when each makes sense.

QuickBlox on Google Cloud

QuickBlox can deploy its chat, video calling, and AI agents for healthcare apps in your own Google Cloud account as an Enterprise deployment, which we install, monitor, and support. The deployment runs in your account, and messages, files, and call data are encrypted at rest and in transit, with role-based access control. See our HIPAA-compliant hosting options, or talk to our team about running on Google Cloud.

Conclusion

Google Cloud gives healthcare teams a BAA, a detailed list of covered products, and strong default encryption. Compliance comes from how you use them. Put the BAA in place, keep ePHI inside covered products and within their conditions, set up each safeguard deliberately, and map every place patient data lands, not just the database. If you’re weighing clouds, our guides to AWS HIPAA compliance and Azure HIPAA compliance cover the same ground.