Is Google Voice HIPAA compliant?
Yes, if you use Google Voice inside a paid Google Workspace account with licenses assigned to the staff who handle patient information, and your administrator accepts Google's amendment first — the free consumer version cannot be used with patient information.
Applies to Google Voice (Google Workspace). Last reviewed against Google's own documentation. Next review December 4, 2026.
Reviewed by Carlos Mendez — IT Security Manager, regional healthcare network.
What you must do
- Use Google Voice under a paid Google Workspace or Cloud Identity account. Google's wording is 'Google Voice (managed users only)', so free Voice on a personal Google account is outside the agreement.
- Assign a Google Voice license to every staff member who will handle patient information through Voice.
- A super administrator must accept the HIPAA Business Associate Amendment first: Admin console → Account settings → Legal and compliance.
- Keep patient information only inside services named on Google's HIPAA Included Functionality list.
- Review and restrict which Marketplace apps and add-ons can connect to your Workspace and Voice data.
Does Google Voice sign a business associate agreement?
Yes. Google offers one. A paid Google Workspace or Cloud Identity subscription with Voice licenses assigned. Google's amendment keys off an active Services Agreement rather than naming an edition. Sign in as a super administrator → Admin console → Account settings → Legal and compliance → accept the HIPAA Business Associate Amendment.
What this means in practice
The phrase that governs everything here is Google's own: Voice is covered for managed users only. A managed user is one whose account lives inside your paid Google Workspace or Cloud Identity subscription and has a Voice licence assigned. The free consumer version of Google Voice, running on someone's personal Google account, sits entirely outside the amendment no matter how the number is used.
That is exactly the shape of the usual failure. A clinician sets up a free Voice number so patients are not calling their mobile, forwards practice calls to it, and never mentions it because it felt like a personal convenience rather than a practice system. Voicemails, transcripts and call history then accumulate somewhere with no agreement behind it.
Doing this properly means the administrator accepts the amendment first, then works through who actually speaks to patients by phone and licences all of them, not just reception. Afterwards it is a matter of keeping the perimeter honest: patient information stays within the services named on Google's Included Functionality list, and Marketplace add-ons that could read Voice data are restricted.
How organizations get this wrong
The specific mistakes we see with Google Voice, not generic advice.
- A clinician forwarding practice calls to a free Google Voice number on a personal account, which sits outside the amendment entirely.
- Licensing reception for Voice but not the billing clerk who spends all day returning insurance calls about named patients.
- Assuming everything Google makes is covered once the amendment is accepted, rather than checking each product against the Included Functionality list.
- Connecting a Marketplace call-logging or CRM add-on to Voice, when third-party apps and add-ons are explicitly outside coverage.
What the agreement does not cover
- Third-party applications and add-ons, including Marketplace apps.
- The free consumer version of Google Voice on a personal Google account.
- Any Google product not named on the Included Functionality list, and Additional Google Services.
- Gemini in Chrome.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
Phone, fax and messaging sit under one agreement with a published covered-services list
Programmable Voice and SIP are eligible if you are building a custom phone workflow
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Google Voice, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Google’s own published documentation, read on the date shown.
- HIPAA Included Functionality — Google. Published May 14, 2026. Read July 29, 2026.
- Google Workspace HIPAA Business Associate Amendment — Google. No publication date given. Read July 29, 2026.
- HIPAA Compliance with Google Workspace and Cloud Identity — Google. No publication date given. Read July 29, 2026.
Change history
- — First published. Google Voice was historically outside the amendment; the Included Functionality list effective 14 May 2026 now names it for managed users.
This page is information, not certification and not legal advice. It reflects Google’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.