Is Google Voice HIPAA compliant?
Yes, if you use Google Voice inside a paid Google Workspace account with licenses assigned to the staff who handle patient information, and your administrator accepts Google's amendment first: the free consumer version cannot be used with patient information.
Applies to Google Voice (Google Workspace). Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Use Google Voice under a paid Google Workspace or Cloud Identity account. Google's wording is 'Google Voice (managed users only)', so free Voice on a personal Google account is outside the agreement.
- Assign a Google Voice license to every staff member who will handle patient information through Voice.
- A super administrator must accept the HIPAA Business Associate Amendment first: Admin console → Account settings → Legal and compliance.
- Keep patient information only inside services named on Google's HIPAA Included Functionality list.
- Review and restrict which Marketplace apps and add-ons can connect to your Workspace and Voice data.
Does Google Voice sign a business associate agreement?
Yes. Google offers one. A paid Google Workspace or Cloud Identity subscription with Voice licenses assigned. Google's amendment keys off an active Services Agreement rather than naming an edition. Sign in as a super administrator → Admin console → Account settings → Legal and compliance → accept the HIPAA Business Associate Amendment.
What this means in practice
The phrase that governs everything here is Google's own: Voice is covered for managed users only. A managed user is one whose account lives inside your paid Google Workspace or Cloud Identity subscription and has a Voice licence assigned. The free consumer version of Google Voice, running on someone's personal Google account, sits entirely outside the amendment no matter how the number is used.
That is exactly the shape of the usual failure. A clinician sets up a free Voice number so patients are not calling their mobile, forwards practice calls to it, and never mentions it because it felt like a personal convenience rather than a practice system. Voicemails, transcripts and call history then accumulate somewhere with no agreement behind it.
Doing this properly means the administrator accepts the amendment first, then works through who actually speaks to patients by phone and licences all of them, not just reception. Afterwards it is a matter of keeping the perimeter honest: patient information stays within the services named on Google's Included Functionality list, and Marketplace add-ons that could read Voice data are restricted.
How organizations get this wrong
- A clinician forwarding practice calls to a free Google Voice number on a personal account, which sits outside the amendment entirely.
- Licensing reception for Voice but not the billing clerk who spends all day returning insurance calls about named patients.
- Assuming everything Google makes is covered once the amendment is accepted, rather than checking each product against the Included Functionality list.
- Connecting a Marketplace call-logging or CRM add-on to Voice, when third-party apps and add-ons are explicitly outside coverage.
What the agreement does not cover
- Third-party applications and add-ons, including Marketplace apps.
- The free consumer version of Google Voice on a personal Google account.
- Any Google product not named on the Included Functionality list, and Additional Google Services.
- Gemini in Chrome.
Alternatives
Phone, fax and messaging sit under one agreement with a published covered-services list
Programmable Voice and SIP are eligible if you are building a custom phone workflow
Keep a record of your Google Voice agreement
Sources
- HIPAA Included Functionality: Google. Published May 14, 2026. Read July 29, 2026.
- Google Workspace HIPAA Business Associate Amendment: Google. Read July 29, 2026.
- HIPAA Compliance with Google Workspace and Cloud Identity: Google. Read July 29, 2026.
Google can change these terms at any time. If something here no longer matches what Google tells you, tell us.