Step-by-Step: Establishing a BAA with Google for HIPAA

Are you using Google services to store or process protected health information (PHI)? If so, establishing a Business Associate Agreement (BAA) with Google is crucial to ensure your organization complies with HIPAA regulations. A BAA is a legally binding contract that outlines the responsibilities of both parties in protecting PHI.

Understanding the BAA

A BAA:

  • Defines the scope of services provided by Google.
  • Outlines the responsibilities of both parties in protecting PHI.
  • Specifies the terms for handling and disclosing PHI.
  • Addresses incident response procedures and breach notifications.

Obtaining a BAA with Google

To obtain a BAA with Google, you must:

  1. Have a paid Google Workspace account: This is a prerequisite for accessing the BAA option.
  2. Sign in as an administrator: The BAA process requires administrator privileges.Navigate to the Legal and Compliance section: This is typically found in the Admin console.
  3. Locate the HIPAA Business Associate Amendment: Look for this option under Security and Privacy Additional Terms.
  4. Review and accept the amendment: Carefully read the terms and conditions and answer the required questions.

Google BAA Infographic 

Leveraging Google Cloud for HIPAA Compliance

Google offers a comprehensive HIPAA compliance guide that provides valuable insights into how Google Cloud can support your organization’s efforts to meet HIPAA requirements. This guide covers:

  • Google’s approach to HIPAA compliance: Learn about Google’s commitment to data security and privacy.
  • HIPAA requirements met by Google Cloud: Understand how Google Cloud services align with HIPAA regulations.
  • Implementing HIPAA-compliant solutions with Google Cloud: Discover best practices and guidance for using Google Cloud to protect PHI.https://services.google.com/fh/files/misc/gsuite_cloud_identity_hipaa_implementation_guide.pdf

Google offers a HIPAA compliance guide that provides an overview of how Google Cloud can be used to support your organizations’ HIPAA compliance efforts. This guide includes information on Google’s approach to HIPAA compliance, the HIPAA requirements that Google Cloud meets, and the steps organizations can take to implement HIPAA-compliant solutions using Google Cloud.

Beyond the BAA: Ensuring HIPAA Compliance

While obtaining a BAA is essential, it’s not the sole requirement for HIPAA compliance. Your organization must also:

  • Implement robust security measures: Use encryption, access controls, and regular vulnerability assessments.
  • Train staff on HIPAA regulations: Ensure employees understand their responsibilities in protecting PHI.
  • Conduct regular risk assessments: Identify potential vulnerabilities and address them promptly.
  • Monitor and audit access logs: Track activity related to PHI to detect unauthorized access.

What is not covered under a BAA with Google

Not all of Google’s services are covered under your BAA, and it’s important that your organization is aware of what services are covered and not covered. Some of the services your may have on your website currently are not covered, and might put your organization at risk.

Here’s a list of items that your BAA doesn’t cover:

  • Third-party apps: These aren’t covered by Google’s BAA. You’ll need to sign additional vendor agreements directly with these vendors. You should also disable any third-party apps that request access to your files or drives unless you have a BAA.
  • Google Analytics: While Google Analytics is a powerful tool for website developers, it’s crucial to understand that its standard configuration is not HIPAA compliant. This presents a serious issue for websites handling Protected Health Information (PHI).
  • Consumer Platforms: Platforms intended for personal use, such as YouTube or Blogger are not covered.
  • Experimental or Pre-General Use Offerings: It’s always fun to be on the cutting edge, but in this case, you could be using technologies that aren’t covered under a BAA.

Conclusion

Establishing a BAA with Google is a vital step in ensuring HIPAA compliance for organizations that handle PHI. By following the outlined steps, leveraging Google Cloud’s capabilities, and implementing additional security measures, you can protect patient information and avoid potential legal consequences.

Don’t let HIPAA compliance keep you up at night. Let Total HIPAA handle the complexities so you can focus on what matters most. Schedule a free consultation today and ensure your organization is fully compliant.

 

Resources:
https://support.google.com/a/answer/3407054?hl=en
https://services.google.com/fh/files/misc/gsuite_cloud_identity_hipaa_implementation_guide.pdf

 

 

Sharing is caring!

Documents

Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.


Download Now

Want to stay informed?

Join our community, stay ahead of the curve on HIPAA compliance and receive free expert guidance.

State of HIPAA Compliance in 2025

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!

Document
Register for Webinar

Related Posts

Essential Guide to Email Authentication and Deliverability: How to Configure DMARC, SPF, and DKIM Records

Essential Guide to Email Authentication and Deliverability: How to Configure DMARC, SPF, and DKIM Records

Essential Guide to Email Authentication and Deliverability: How to Configure DMARC, SPF, and DKIM Records
*This process is technical and requires access to your Domain Name Server (DNS). It’s recommended to have an IT professional handle these configurations to avoid potential issues. If you proceed yourself, back up your current settings with screenshots or copies before making any changes.
Organizations rely heavily on email for marketing and communication, making it a prime target for malicious actors. Phishing, spoofing, and other email attacks can inflict significant financial and reputational damage. In response to this growing threat, email providers are tightening their security measures, and businesses that aren’t paying attention risk having their emails blocked.
A recent announcement from Microsoft, highlighted in their Tech Community blog, highlights that Outlook is implementing stricter requirements for high-volume senders to protect users from unwanted and potentially harmful messages. This move serves as a clear signal: email authentication is no longer optional – it’s required for all organizations, regardless of their sending volume.
The key to making sure your emails reach their intended recipients is all in the configuration and alignment of your Domain-based Message Authentication, Reporting and Conformance (DMARC), Sender Policy Framework (SPF), and DomainKeys Identified Mail (DKIM) records. These protocols verify an organization actually sent the emails and tells receiving servers your messages are legitimate and shouldn’t be sent to spam folders or blocked.
What makes SPF, DKIM, and DMARC so crucial?
SPF (Sender Policy Framework): This record lists the authorized mail servers permitted to send emails on your behalf. When your email server receives an email, it checks it and verifies if the sending server’s IP address matches the list in your SPF record. This helps prevent attackers from spoofing your domain using unauthorized servers.
DKIM (DomainKeys Identified Mail): DKIM adds a digital signature to your outgoing emails. This signature is cryptographically linked to your domain and verified by the receiving server using a public key published in your DNS records. DKIM ensures the integrity of the email content and confirms that it hasn’t been tampered with in transit.
DMARC (Domain-based Message Authentication, Reporting & Conformance): DMARC builds upon SPF and DKIM. It tells receiving servers what to do with emails that fail SPF and/or DKIM checks. You can set policies to “none” (monitor), “quarantine” (send to spam), or “reject” (block). DMARC also enables reporting, allowing you to gain valuable insights into who sends emails using your domain and identify potential spoofing attempts.
Microsoft’s Stance: A Wake-Up Call
The stricter requirements being implemented by Outlook for high-volume senders emphasize the need for organizations to set up and review their authentication protocols. While the current focus is on high-volume senders, it is clear: email providers are looking for authenticated mail. Failing to correctly set up your DMARC, SPF, and DKIM records will lead to deliverability issues of emails.
What Your Company Needs to Do Now:
Regardless of size or email volume, every company should take the following steps to make sure its email authentication is configured correctly. Here’s a checklist:
Audit Your Existing Records: Check for existing SPF, DKIM, and DMARC configurations. Are they accurate and up-to-date?
Implement Missing Records: If you are missing any of these records, add them immediately. *Consult with your IT team or email service provider for guidance.
Check Alignment: It’s crucial to make sure there is alignment between your SPF, DKIM, and DMARC records. This means that the domain used for SPF and the signing domain in DKIM should match the “From” address domain in your emails. DMARC relies on this alignment to function effectively.
Start with a Monitoring Policy: For DMARC, it’s often best to start with a “none” policy to monitor how your emails are being handled and identify any legitimate sending sources that might not be properly authenticated.
Gradually Enforce Stronger Policies: Once you clearly understand your email flows and have addressed any authentication issues, move gradually towards stronger DMARC policies like “quarantine” or “reject” to protect your domain from spoofing actively.
Regularly Review and Update: The email landscape is constantly changing. Regularly review and update your authentication records as needed, especially when changing your emails or third-party sending services.
The Benefits of Proper Email Authentication:
Properly configuring and aligning your DMARC, SPF, and DKIM records offers significant benefits:
Improved Email Deliverability: Your legitimate emails are more likely to reach the inbox, avoiding spam folders and blocks.
Enhanced Brand Reputation: Protecting your domain from spoofing builds trust with your recipients and safeguards your brand’s reputation.
Increased Security: You significantly reduce the risk of using your domain for phishing and other malicious activities.
Compliance with Evolving Standards: By staying ahead of the curve, you ensure your email practices align with the increasingly stringent requirements of email providers.
The message is clear: email authentication is no longer optional. The recent emphasis from major providers like Microsoft underscores its critical importance in maintaining reliable and secure email communication. By taking the steps to audit and align your DMARC, SPF, and DKIM records, your organization can protect itself, customers, and reputation. Don’t wait until your emails are blocked – act now to secure your email.
Have questions or need help with your HIPAA compliance? Schedule a call with our experts today. https://www.totalhipaa.com/get-started/
To check your DMARC Records go here
https://www.totalhipaa.com/dmarc-lookup-free/
All records, a free and easy tool to use
https://easydmarc.com/

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)