Google Cloud Search is an enterprise search service that helps users find information across Google Workspace services, including Gmail and Drive, and other data sources enabled by their organization. Search results are based on the access permissions applied to the underlying content.

Is Google Cloud Search HIPAA compliant? Yes, based on our research, Google Cloud Search can be HIPAA compliant.

 

What changed this year?

As of September 2026, our review did not identify any publicly disclosed change that removed or narrowed Google Cloud Search from Google’s HIPAA business associate agreement coverage.

Google’s HIPAA Included Functionality page, dated August 31, 2026, continues to list Google Cloud Search. Google’s May 2026 HIPAA implementation guide also lists Google Cloud Search as a Core Service in which protected health information (PHI) is permitted under the applicable BAA when the service is configured appropriately.

 

Will Google Cloud Search sign a business associate agreement (BAA)?

Yes, Google will enter into a BAA that covers Google Cloud Search, which can be reviewed here.

Google makes the BAA available for electronic acceptance by a super administrator through the Google Admin console. Google states that customers who have not accepted a BAA must not use PHI in Google Workspace or Cloud Identity services.

 

What does the Google Cloud Search BAA cover?

Google Cloud Search does not have a standalone BAA. Instead, it is covered by the Google Workspace BAA because Google Cloud Search is specifically named on Google’s HIPAA Included Functionality list.

The Google Workspace BAA applies when a customer acting as a covered entity or business associate creates, receives, maintains, or transmits PHI through a covered service. Its security terms state that “Google and Customer will each use appropriate safeguards.”

The BAA covers:

  • Permitted uses and disclosures of PHI through covered services
  • Safeguards against unauthorized use or disclosure of PHI
  • Notifications of security incidents and breaches
  • Protection of PHI handled by Google subcontractors
  • Customer access to PHI for individual access and amendment requests
  • Accounting of disclosures by Google when required under HIPAA
  • Access by the U.S. Department of Health and Human Services when required by law
  • Return or destruction of PHI when the applicable services agreements end

What does the Google Cloud Search BAA exclude?

The Google Workspace BAA says it “does not apply to ... any other Google product, service, or feature that is not a Covered Service.” It also does not apply to PHI that a customer creates, receives, maintains, or transmits outside the covered services, including through offline storage, on-premises tools, or third-party applications.

Google also states that third-party applications and add-ons are not included in the functionality covered by its BAA. Technical support services are not part of the HIPAA Included Functionality, and customers should not provide PHI when using those services.

For Cloud Search connectors that index third-party data, customers are responsible for configuring access controls and permissions correctly. Google’s implementation guide warns that PHI in document titles or descriptions may appear in search results if a connector does not properly translate the source system’s permissions.

 

Conclusion

Google Cloud Search can be HIPAA compliant because Google’s Workspace BAA currently covers the service. Customers must accept the BAA and configure Cloud Search, access permissions, search history, and any third-party connectors appropriately for their HIPAA obligations.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQS

What is a BAA?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.