Google Voice is a cloud-based phone service from Google that allows users to make and receive calls, send text messages, manage voicemails, and use a business phone number across devices.

With Google Voice, businesses can manage calling, voicemail, number assignment, call routing, and related phone features through Google Workspace.

Is Google Voice HIPAA compliant? Yes, Google Voice can be HIPAA compliant, but only when certain requirements are met.

 

What changed this year?

As of Google’s May 14, 2026 HIPAA Included Functionality page, Google Voice remains listed as included functionality, limited to managed users.

The page lists “Google Voice (managed users only)” as included under the applicable Google Workspace Business Associate Addendum. Google Voice may be used in connection with protected health information (PHI) only when the organization has accepted Google’s Business Associate Addendum, uses managed Google Workspace accounts, obtains the appropriate Google Voice licenses, and configures the service properly.

 

Will Google Voice sign a business associate agreement (BAA)?

Yes, Google will sign a BAA for eligible Google Workspace customers, which can be reviewed here.

 

What does the Google Voice BAA cover?

The Google Voice BAA covers managed Google Voice users who have the appropriate Google Voice license. Google’s HIPAA Implementation Guide states, “Licensed users of Google Voice are covered under the Google Workspace BAA.”

Their BAA covers:

  • Use of Google Voice by managed users only
  • Use of PHI through covered Google Workspace services
  • Appropriate safeguards for PHI
  • Security incident and breach notification obligations
  • Subcontractor protections
  • Individual access and amendment support
  • Accounting of disclosures
  • Access by HHS when required
  • Return or destruction of PHI at termination

Google’s BAA states that Google and the customer must each use “appropriate safeguards designed to prevent against unauthorized use or disclosure of PHI.” It means Google Voice is not automatically HIPAA compliant just because an organization uses it. The organization still needs the BAA, managed accounts, Google Voice licenses, proper administrative controls, and workforce policies governing how PHI is discussed through calls, texts, and voicemail.

 

What does the Google Voice BAA exclude?

Google Voice’s HIPAA coverage does not apply to personal Google Voice accounts, unmanaged users, other Google services that are not covered services, third-party applications, or PHI handled outside the covered Google Workspace services.

Google’s BAA states that it “does not apply to... any other Google product, service, or feature that is not a Covered Service.”

A healthcare provider using a personal Google Voice number, a free consumer account, or an unmanaged account should not assume that Google Voice is HIPAA compliant. Google’s HIPAA coverage applies to Google Voice only for managed users under Google Workspace, and administrators should obtain Google Voice licenses for users who handle PHI.

 

Conclusion

Google Voice may be HIPAA compliant, but only when used by managed Google Workspace users under Google’s BAA with the correct Google Voice licenses and HIPAA-appropriate configurations.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQS

What is a business associate agreement?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.