Why Google Workspace for the Clinical Lane
The clinical lane is where PHI lives. For solo practitioners and small practices, the most practical and affordable option for a HIPAA-compliant clinical lane is Google Workspace with a signed Business Associate Agreement.
Google Workspace Business Starter runs about $7 per user per month on annual billing, or $8.40 on flexible billing. Check the current rate, because Google adjusts it. That is a fraction of the cost of dedicated healthcare communication platforms like Spruce or Klara. The BAA is available at no additional cost. It does not cover "Google Workspace" as a whole. Coverage is defined by a document Google maintains called HIPAA Included Functionality, which carries an effective date and is revised as products change. Core services like Gmail, Drive, Docs, Sheets, Meet, Calendar, Chat, Keep, Forms, Sites, Tasks and Vault have been on that list, but read the live version yourself before you rely on any service for PHI. Two exclusions matter more than the list itself. Third party applications, including Marketplace add-ons, are not covered by the BAA. Additional Google Services, the consumer facing Google products your admin can toggle on separately, are covered by neither the BAA nor the Cloud Data Processing Addendum. Never put PHI into either category.
The tradeoff is that Google Workspace requires more configuration to be HIPAA-compliant than a purpose-built healthcare platform. The configuration is not technically complex, but it requires deliberate attention to the admin settings.
The BAA Process
The BAA is signed in the Google Workspace Admin Console. The process:
1. Log in to admin.google.com as a super admin.
2. Navigate to Account settings, then Legal.
3. Find the Business Associate Amendment and review it.
4. Accept the BAA.
This takes about five minutes. Once accepted, the BAA covers the functionality Google lists as HIPAA Included Functionality, and nothing else in your account. Read the current list at workspace.google.com/terms/2015/1/hipaa_functionality/ and check the effective date at the top. Re-read it whenever Google adds a product to your plan, because the list is revised.
You must accept the BAA before using any covered service to store or transmit PHI. Using Gmail or Drive for PHI before accepting the BAA is a HIPAA violation, even if you later accept the BAA.
The Required Configuration
After accepting the BAA, the following configuration changes are required:
2-Step Verification on every account: HIPAA does not use the phrase multi factor authentication anywhere. What 45 CFR 164.312(d) requires is a Person or entity authentication standard, meaning procedures that verify a person seeking access to ePHI is who they claim to be, and it leaves the method to your risk analysis. For a practice holding PHI in Gmail and Drive, 2-Step Verification is the answer that analysis should land on, so document that reasoning and turn it on. In the Admin Console go to Security, then Authentication, then 2-Step Verification. Check "Allow users to turn on 2-Step Verification" first and give your users an enrollment window. Only then set Enforcement to On, because enforcing before enrollment locks people out of the account.
Turn off external sharing: In the Admin Console go to Apps, then Google Workspace, then Drive and Docs, then Sharing settings, then Sharing options. Set external sharing to Off. There is no long option label to look for, it is just On or Off. If you genuinely need to share with an outside party, use Allowlisted Domains and add only that domain rather than reopening sharing for everyone. Changes can take up to 24 hours to take effect, so make this change before any PHI goes into the account, not after.
Make new files private by default: This is a different setting from external sharing and people miss it. In the same Sharing settings screen, open General access default and choose "Private to the owner". The alternatives let anyone in your organization open or find a new file, which is broader than minimum necessary for a client chart. "Restricted" is the word Drive shows inside an individual file, not the admin value, so do not go looking for it here.
Audit logs: There is no switch to turn these on. Google collects Drive log events automatically, and you view them at Reporting, then Audit and investigation, then Drive log events. Go look at them now so you know they are there and you know how to pull a report. The advanced security investigation tool is a separate, higher tier feature, so on Business Starter you are working with the basic view. What HIPAA actually asks for at 45 CFR 164.312(b) is an Audit controls standard, and it is Required: mechanisms that record and examine activity in systems holding ePHI. Google does the recording. Examining is on you, so put a recurring block on your own calendar to review access on client folders and write down that you did it.
Gemini and AI Features in the Clinical Lane
Skipping this is the most common mistake I see. Gemini is on inside Workspace by default now, and it reads Gmail and Drive, which is exactly where your PHI lives.
Here is what the current Included Functionality list actually says. The Gemini app, the Gemini Mac App and Gemini in Workspace are inside the BAA. Gemini in Chrome is explicitly carved out of that same list. Google also confirms that the Gmail smart features, meaning help me write, contextual smart replies and the side panel, are covered as part of Google Workspace with Gemini in Included Functionality.
Three things to do before PHI touches the account. Read the current list yourself and confirm the Gemini entries are still worded that way, because the list carries an effective date and Google revises it. Confirm that any AI surface your staff actually use appears on it, and turn off in the Admin Console the ones that do not. And treat every third party AI add-on, Chrome extension or note taking bot as outside the BAA, because Google states plainly that third party applications including add-ons are not covered. An uncovered AI tool reading a PHI inbox is a disclosure to a vendor you never signed a BAA with.
The Client Folder Structure
The standard client folder structure for a solo practice:
Clients/
Client-[LastName]-[FirstName]-[ID]/
01-Intake/
02-Labs/
03-Session-Notes/
04-Care-Plan/
05-Exports/Each client folder is created manually when a new client is onboarded. The folder is shared only with the specific client (if they need access) and any staff members who work with that client.
The ID in the folder name is a simple sequential number (001, 002, etc.) that allows you to reference clients in non-PHI contexts (like n8n logs) without using their name.
The Five-Step Client Handoff Flow
When a client submits a clinical interest form in the app:
1. Review the submission in the Clinical Interest Google Sheet tab.
2. If proceeding, create a client folder in Google Drive using the standard structure.
3. Send an initial response from your Google Workspace Gmail account with next steps.
4. Collect any necessary documents (labs, records) via secure Google Drive sharing.
5. All subsequent clinical communication happens via Google Workspace Gmail and Drive.
The app and n8n never see any of the clinical communication or documents. The handoff from Lane 1 (app and n8n) to Lane 2 (Google Workspace) is entirely manual.
What Google Workspace Does Not Cover
Google Workspace is not a complete HIPAA compliance solution. It covers the technical safeguards for the services listed in the BAA. It does not cover:
- Administrative safeguards (policies, training, risk assessments)
- Physical safeguards (device security, workstation controls)
- Business associate agreements with other vendors you use
- State-specific privacy law requirements (which may be stricter than HIPAA)
A complete HIPAA compliance program requires attention to all three categories of safeguards. Google Workspace handles the technical safeguards for your email and file storage. The administrative and physical safeguards are your responsibility.
The Minimum Viable Compliance Program
For a solo practice just getting started, the minimum viable compliance program alongside Google Workspace is:
- A written privacy policy and notice of privacy practices
- A written security policy covering device security and access control
- Annual HIPAA training, with a dated record of who completed it
- A retention habit. Under 45 CFR 164.316 your policies must be kept in written form, which may be electronic, and you must retain them along with the record of any action, activity or assessment the rule requires you to document for 6 years from creation or from the date the policy last was in effect, whichever is later. The same section tells you to review and update them periodically. Keep every superseded version. Do not overwrite the file.
- A risk analysis under 45 CFR 164.308(a)(1)(ii)(A). This is not optional and it is not a formality. It is the first Required implementation specification in the Security Rule, worded as an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the ePHI you hold. Do it before you configure anything, because it is what tells you which settings you need. A spreadsheet is a fine format. Skipping it is not.
- Business associate agreements with any vendor who handles PHI on your behalf
This is general information, not legal advice, and it is not a substitute for legal counsel. A healthcare attorney can review your specific situation and identify any gaps. But this minimum program, combined with properly configured Google Workspace, is a reasonable starting point for a solo practice.
The Takeaway
Google Workspace with a signed BAA is the most practical clinical lane option for solo practitioners and small practices. The setup takes about two hours. The cost is roughly $7 per user per month on an annual plan.
Do the configuration correctly before any PHI enters the account. Accept the BAA, turn on 2-Step Verification, close down sharing, set up the folder structure. But be clear with yourself about what that buys you. HHS says plainly that contracting with a compliant cloud provider does not make you compliant, and that you still have to conduct your own risk analysis and set your own risk management policies. Google secures its side. The risk analysis, the written policies and the training are yours, and no admin console setting substitutes for them.