Is Google Sheets HIPAA Compliant?

Share this article on:

Is Google Sheets HIPAA compliant? Can HIPAA-covered entities use Google Sheets to create, view, or share spreadsheets containing identifiable protected health information or would using Google Sheets violate HIPAA Rules? In this post we assess whether Google Sheets supports HIPAA compliance. 

Under HIPAA Rules, healthcare organizations are required to implement safeguards to ensure the confidentiality, integrity, and availability of PHI. While it is straightforward to implement controls internally to keep data secure, oftentimes third parties are contracted to provide services that require access to PHI. They too must abide by HIPAA Rules covering privacy, security, and breach notifications.

A third-party that requires access to PHI – or copies of health data – to perform services on behalf of a covered entity is considered a business associate. A covered entity and business associate must enter into a contract – a business associate agreement – in which the business associate agrees to comply with certain aspects of the HIPAA Privacy, Security, and Breach Notification Rules. Without a business associate agreement in place, any sharing of PHI would be considered a HIPAA violation.

While Google does not look at the information uploaded to Google Sheets, since Google can potentially access the information, and data is stored on its servers, a business associate agreement would be required.

Will Google Sign a BAA with HIPAA Covered Entities for Google Sheets?

Google is committed to protecting the privacy of its customers’ data and ensuring all of its services are secure and data can always be accessed. Google is aware of the requirements of the Health Insurance Portability and Accountability Act and the firm is prepared to enter into a business associate agreement with HIPAA covered entities for certain services.

Google offers a BAA for G Suite, which includes Google Drive. Google Sheets, Google Docs, Google Slides, and Google Forms are all part of Google Drive and are covered by the BAA.

Google explains in its terms and conditions that any HIPAA covered entity or business associate of a HIPAA covered entity that wishes to use G Suite in connection with any PHI must enter into a BAA with Google before any of its services are used in connection with PHI.

Is Google Sheets HIPAA Compliant?

Since Google offers a BAA, is Google Sheets HIPAA compliant? Google can be considered a HIPAA compliant service provider as Google supports HIPAA compliance for G Suite Basic, G Suite for Education, G Suite Business, and G Suite Enterprise domains and will enter into a BAA with healthcare customers.

Once a BAA has been obtained, it is the responsibility of the covered entity or business associate to ensure that Google Sheets and all other Google Drive and G Suite products and services are used correctly in a manner that does not violate HIPAA Rules.

Author: HIPAA Journal

Share This Post On