Google Workspace HIPAA Implementation Guide

A comprehensive guide to implementing HIPAA compliance for Google Workspace, based on Google's official HIPAA Implementation Guide (February 2024) and industry best practices.

⚠️ Disclaimer

This information is provided for general educational and informational purposes only. It should not be considered as legal advice or a definitive guide for HIPAA compliance.

Important Notes:

1. The information shared is based on Google's official HIPAA Implementation Guide (February 2024) and general best practices
2. Each healthcare organization has unique compliance requirements and should:
   • Consult with qualified legal counsel and compliance experts
   • Conduct their own risk assessments
   • Develop policies and procedures specific to their needs
   • Ensure proper implementation and ongoing monitoring
3. HIPAA regulations and Google Workspace features may change over time
4. Organizations are solely responsible for their own HIPAA compliance
5. Having technical controls in place does not guarantee HIPAA compliance

Always refer to the latest official documentation from Google and consult with appropriate professionals before implementing any HIPAA-related configurations or policies.

---

📋 Summary of Key Tasks

#	Task
1	Sign a BAA with Google
2	Configure OUs and restrict Non-Core Services for PHI users
3	Apply sharing and access controls for Gmail, Drive, Calendar, and other Core Services
4	Implement DLP rules to prevent PHI exposure
5	Train users on HIPAA compliance and Google Workspace security
6	Monitor audit logs and configure alerts for suspicious activity
7	Maintain documentation and evidence for audits
8	Regularly review and update policies

---

1. Understand Your Scope and Responsibilities

Determine if a BAA is Required

Objective: Confirm whether your organization needs a Business Associate Agreement with Google.

Steps:

1. Confirm whether your organization is a HIPAA-covered entity or business associate
2. If required, sign a Business Associate Addendum (BAA) with Google Workspace
   • This is mandatory for using Google Workspace with Protected Health Information (PHI)

Identify PHI Use Cases

Objective: Document how PHI will be handled in your organization.

Steps:

1. Document how PHI will be used, stored, and transmitted within Google Workspace
2. Identify which users, departments, and workflows will handle PHI

Assign Roles and Responsibilities

Objective: Establish clear ownership of compliance efforts.

Steps:

1. Designate a HIPAA Compliance Officer and Google Workspace Administrator to oversee compliance efforts
2. Ensure all users handling PHI are trained on HIPAA requirements

Licensing Decision

Objective: Select the appropriate Google Workspace subscription.

Considerations:

• Take into account Google Workspace capabilities such as:
  • Data Loss Prevention (DLP)
  • Security Health checks
  • Security Investigation tool
  • Google Vault
  • And other security features

📖 Reference: Detailed comparison of Google Workspace Subscriptions

---

2. Configure Google Workspace Services

Enable Only HIPAA-Compliant Core Services

Objective: Restrict services to only those covered under the BAA.

Steps:

1. Use the Admin Console to disable Non-Core Services for users handling PHI
2. Create Organizational Units (OUs) to separate users who handle PHI from those who do not
3. Configure service access for each OU to ensure only HIPAA-compliant services are enabled for PHI users

Allowed Services for PHI

• Gmail
• Calendar
• Drive (Docs, Sheets, Slides, Forms)
• Google Chat
• Google Meet
• Keep
• Sites
• Jamboard
• Tasks
• Vault
• Google Cloud Search
• Google Voice (managed users only)

Disallowed Services for PHI

• Disable all Non-Core Services (e.g., YouTube, Google Photos, Blogger)
• Disable any Core Services where PHI is not permitted (e.g., Google Contacts)

---

3. Configure Sharing and Access Settings

Objective: Implement proper data sharing controls.

Steps:

1. Configure sharing settings for each service in the Admin Console
2. Periodically review sharing reports in the Security Center to ensure compliance

Drive and Docs

• Set default file visibility to Private
• Restrict external sharing of files and folders
• Disable sharing with external domains unless explicitly required
• Use Data Loss Prevention (DLP) rules to prevent PHI from being shared inappropriately

Calendar

• Set default sharing to Only free/busy information for external users
• Encourage users to mark calendar entries containing PHI as Private

Google Chat

• Disable external communication for users handling PHI
• Create separate Chat Spaces for PHI-related discussions
• Avoid using PHI in room names

Google Meet

• Restrict external guest access to meetings involving PHI
• Disable anonymous guest participation

Google Sites

• Restrict publishing of Sites containing PHI to internal users only

Jamboard

• Restrict sharing of Jamboard files to internal users only

---

4. Implement Security Controls

Objective: Establish robust security measures.

Steps:

1. Use the Security Health Tool to identify and address security gaps
2. Regularly review audit logs and configure alerts for suspicious activity

Account Security

• Enforce 2-Step Verification (2SV) for all users
• Use Security Keys for high-risk accounts

Access Control

• Use Context-Aware Access to restrict access based on user location, device, and IP address
• Limit admin privileges to only those who need them

Audit Logs

• Enable and monitor audit logs for all services, including Gmail, Drive, and Admin activity

Data Encryption

• Ensure data is encrypted in transit and at rest (Google Workspace provides this by default)

---

5. Configure Organizational Units (OUs)

Objective: Segregate PHI and non-PHI users.

Steps:

1. Set up OUs in the Admin Console
2. Test configurations to ensure proper access restrictions

Create OUs for PHI and Non-PHI Users

• Separate users who handle PHI into a dedicated OU
• Configure service access and sharing settings specific to each OU

Restrict Non-Core Services for PHI Users

• Disable services like YouTube, Google Photos, and other Non-Core Services for the PHI OU

Apply Policies to OUs

• Use the Admin Console to apply security and sharing policies to each OU

---

6. Implement Data Loss Prevention (DLP)

Objective: Prevent unauthorized PHI exposure.

Steps:

1. Configure DLP rules in the Admin Console
2. Train users on how DLP policies work

Create DLP Rules

• Configure DLP rules to detect and prevent sharing of PHI in Gmail, Drive, and Chat
• Use predefined templates for HIPAA compliance or create custom rules to identify sensitive data (e.g., Social Security Numbers, medical record numbers)

Test DLP Policies

• Simulate DLP rules to ensure they are correctly identifying and blocking PHI

Monitor DLP Reports

• Regularly review DLP reports to identify potential violations

---

7. HIPAA Training

Objective: Ensure all users understand their compliance responsibilities.

Steps:

1. Develop a training program for HIPAA compliance
2. Track user completion of training

HIPAA Training Program

• Provide mandatory HIPAA training for all users handling PHI
• Include specific training on Google Workspace security and sharing settings

Ongoing Education

• Conduct regular refresher training sessions
• Share updates on new features or changes to Google Workspace policies

---

8. Monitor and Audit

Objective: Maintain continuous compliance monitoring.

Steps:

1. Set up alerts in the Admin Console
2. Schedule periodic audits and document results

Enable Alerts

• Configure alerts for suspicious activity, such as unauthorized access or data sharing
• Use the Admin Console to set up notifications for key events (e.g., password changes, new admin accounts)

Review Audit Logs

• Regularly review audit logs for Gmail, Drive, and Admin activity
• Use the Security Center to identify trends and potential risks

Conduct Periodic Audits

• Perform regular internal audits to ensure compliance with HIPAA policies
• Document findings and corrective actions

---

9. Maintain Evidence for Compliance

Objective: Prepare for audits and maintain compliance documentation.

Steps:

1. Create a compliance documentation repository
2. Periodically download and archive audit reports

Document Policies and Procedures

• Maintain written policies for Google Workspace configurations and HIPAA compliance
• Include details on how PHI is protected and monitored

Retain Audit Logs

• Store audit logs and DLP reports for the required retention period (e.g., 6 years for HIPAA)

Prepare for Audits

• Use the Compliance Reports Manager to download Google Workspace audit reports (e.g., SOC 2, ISO 27001)
• Maintain evidence of user training and security configurations

---

10. Review and Update Policies

Objective: Keep policies current with regulatory and platform changes.

Steps:

1. Subscribe to Google Workspace updates
2. Schedule regular policy reviews

Stay Informed

• Regularly review updates to Google Workspace services and HIPAA regulations
• Adjust configurations as needed to maintain compliance

Test Configurations

• Periodically test security and sharing settings to ensure they are functioning as intended

Update Policies

• Revise policies and procedures to reflect changes in Google Workspace or HIPAA requirements

---

📁 Repository Contents

File	Description
README.md	This implementation guide
google-workspace-hipaa-implementation.xlsx	Detailed implementation checklist spreadsheet

---

🔗 Useful Resources

• Google Workspace HIPAA Compliance
• Google Workspace BAA
• Compare Google Workspace Editions
• Google Workspace Security Center
• Data Loss Prevention (DLP) for Google Workspace
• Google Workspace Admin Help

---

📄 License

This guide is provided for informational purposes. Please consult with legal and compliance professionals for your specific implementation needs.

---

🤝 Contributing

Contributions to improve this guide are welcome. Please submit issues or pull requests with suggested improvements.