Fact · Voice privacy and security
Google's HIPAA page says the customer must determine whether it is a covered entity or a business associate, and whether it requires a business associate agreement with Google.
Checked against its source on October 17, 2026
In the source's own words
“You must determine the following: Whether you are a Covered Entity or a Business Associate of a Covered Entity. Whether you require a Business Associate Agreement with Google.”
HIPAA compliance on Google Cloud and Google Workspace, Google Cloud documentation, n.d., Customer responsibilities.
Open the original- What it measures
- Google lists two decisions as the customer's: its HIPAA status, and whether a BAA with Google is needed for its use case. The page is a starting point for a compliance review, not a certification.
- What it does not show
- The sentence assigns the decision to the customer. It does not say which products need a BAA in any given setup.