Is Google Sheets HIPAA Compliant?
Google Sheets is HIPAA compliant and can be used to create, manage, and share spreadsheets containing Protected Health Information (PHI) provided organizations subscribe to a Google Workspace plan that supports HIPAA compliance and Google Drive is configured to control access to files saved as Google Sheets. In addition, system administrators are required to review and accept Google’s Business Associate Addendum to the Workspace Service Agreement.
Under HIPAA Rules, healthcare organizations are required to implement safeguards to ensure the confidentiality, integrity, and availability of PHI. While it is straightforward to implement controls internally to keep data secure, oftentimes third parties are contracted to provide services that require access to PHI. They too must abide by HIPAA Rules covering privacy, security, and breach notifications.
A third-party that requires access to PHI – or copies of health data – to perform services on behalf of a covered entity is considered a business associate. A covered entity and business associate must enter into a contract – a business associate agreement – in which the business associate agrees to comply with certain aspects of the HIPAA Privacy, Security, and Breach Notification Rules. Without a business associate agreement in place, any sharing of PHI would be considered a HIPAA violation.
Google does not look at the information uploaded to Google Sheets, but has “persistent access” to data is stored on its servers, so a business associate agreement is required.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Will Google Sign a BAA with HIPAA Covered Entities?
Google is committed to protecting the privacy of its customers’ data and ensuring all of its services are secure and data can always be accessed. Google is aware of the requirements of the Health Insurance Portability and Accountability Act and is prepared to enter into a business associate agreement with HIPAA covered entities for certain services in the Workspace suite of productivity tools.
However, rather than agreeing to the terms of each individual customer’s Business Associate Agreement, Google offers a one-size-fits-all Business Associate Addendum to the Workspace Service Agreement which covers productivity tools such as Google Drive. Google Sheets, Google Docs, Google Slides, and Google Forms.
To help organizations configure the productivity tools in compliance with HIPAA, Google also offers a HIPAA Implementation Guide for services with “covered functionality”.
Is Google Sheets HIPAA Compliant?
Since Google offers a BAA, is Google Sheets HIPAA compliant? Google can be considered a HIPAA compliant service provider as Google supports HIPAA compliance for most business Workspace accounts. Once a BAA has been obtained, it is the responsibility of the covered entity or business associate to ensure that Google Sheets and all other Google Drive and Workspace products and services are used correctly in a manner that does not violate HIPAA Rules.
