Is Google Calendar HIPAA compliant?
Booking pages built into Google Calendar. Google Calendar is on the list of Workspace services covered by Google's BAA.
Signs a BAAYes
Google Calendar appointment schedules signs a Business Associate Agreement. Google Calendar is listed among the Workspace services included in Google's BAA; a super administrator accepts the BAA in the Admin console.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: Google Cloud — HIPAA compliance (included Workspace services) · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
What you still have to configure
- Accept the BAA in the Admin console (Account settings > Legal and compliance) before patients book. source
- Review a test booking, confirmation and reminder before use. The booking description also appears in confirmation emails and event descriptions, and Google doesn't let you edit the text of reminder emails. Keep patient-specific information out of the public schedule title and description. source
Limitations
- Google's HIPAA list names Google Calendar but says nothing specific about appointment schedules — that is not an exclusion, but keep booking questions to what you need, and use only a Workspace account with the BAA accepted, not a personal Google account. source
Against our criteria
| BAA without a sales process | Yes — Accepted by a super administrator in the Admin console. | Google — HIPAA compliance with Google Workspace |
|---|---|---|
| BAA on entry-level team plans | Not verified | Not verified yet |
Alternatives
- Acuity Scheduling →BAA: conditional
- Calendly →BAA: no
- Setmore →BAA: conditional
- Square Appointments →BAA: conditional