Is Google Meet HIPAA compliant?
Yes, if you run Meet inside a managed Google Workspace account and a super administrator accepts the amendment before any patient visit takes place.
Applies to Google Meet in Google Workspace. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Host from a managed Google Workspace or Cloud Identity account.
- A super administrator accepts the amendment first: Admin console → Account settings → Legal and compliance.
- Meet is named on the Included Functionality list effective 14 May 2026.
- Keep recordings, transcripts and notes inside covered services: Drive, including Docs, is on the same list.
- Restrict Additional Google Services for staff running clinical visits.
- Block or review Marketplace add-ons and any external meeting assistant.
Does Google Meet sign a business associate agreement?
Yes. Google offers one. A Google Workspace or Cloud Identity subscription. No minimum edition is published. Super administrator → Admin console → Account settings → Legal and compliance → accept the amendment.
What this means in practice
Meet has no agreement of its own. It is one line on Google's Included Functionality list (the version effective 14 May 2026 names Google Meet alongside Gmail, Calendar, Chat and Drive) and it becomes covered when a super administrator accepts the Workspace amendment in the Admin console. There is no per-product toggle and no separate healthcare tier to buy.
Because coverage is granted service by service rather than feature by feature, the live call is rarely where practices come unstuck. Recordings, transcripts and notes have to land somewhere, and that somewhere must also be a covered service. Drive, including Docs, is on the same list, which is why keeping meeting artefacts inside Workspace matters more than any in-call setting.
Two boundaries belong in your written policy. Google excludes third-party applications and add-ons, so an external notetaking bot sitting in a telehealth visit is outside the amendment regardless of its own marketing. And the amendment reaches only information handled inside covered services: anything copied into an Additional Google Service leaves its scope.
How organizations get this wrong
- Letting an external AI notetaker join telehealth visits, when Google excludes third-party applications from what the amendment covers.
- Running visits from a personal Google account because a clinician was never given a licence on the managed domain.
- Accepting the amendment but leaving Additional Google Services enabled, so recordings get moved outside the covered list.
- Sharing a recording link broadly rather than restricting it: Google covers the service, not your sharing settings.
What the agreement does not cover
- Meet used from a free personal Google account.
- Third-party applications and add-ons, including external AI notetakers that join meetings.
- Additional Google Services.
- Gemini in Chrome.
Alternatives
Named on Microsoft's in-scope list with the agreement applying automatically
Purpose-built telehealth if the use is patient visits rather than internal meetings
Keep a record of your Google Meet agreement
Sources
- HIPAA Included Functionality: Google. Published May 14, 2026. Read July 29, 2026.
- Google Workspace HIPAA Business Associate Amendment: Google. Published September 12, 2025. Read July 29, 2026.
Google can change these terms at any time. If something here no longer matches what Google tells you, tell us.