How to Make Google Workspace HIPAA compliant

Making Google Workspace HIPAA-compliant involves several steps to ensure that Protected Health Information (PHI) is handled securely and in line with HIPAA requirements. Here’s a guide to configuring Google Workspace for HIPAA compliance:

Step 1: Sign a Business Associate Agreement (BAA) with Google

• Sign the BAA: To comply with HIPAA, sign a Business Associate Agreement (BAA) with Google. Only Google Workspace paid plans (such as Business, Enterprise, or Education) are eligible for a BAA.
• How to Sign: In the Google Admin Console, go to Account Settings > Legal & Compliance and review and accept the HIPAA BAA.

Step 2: Use Only HIPAA-Compliant Services in Google Workspace

• Supported Services: The following Google Workspace services are HIPAA-compliant when configured properly and covered by the BAA:
  • Gmail
  • Google Calendar
  • Google Drive (including Docs, Sheets, and Slides)
  • Google Meet
  • Google Sites
• Limit PHI: Avoid using other Google Workspace services that aren’t covered by the BAA to store or transmit PHI.

Step 3: Enable Security Features in Google Workspace

a. Two-Step Verification (2SV)

• Require Two-Step Verification: Enforce two-step verification for all accounts to add an extra layer of security.
• How to Enable: In the Admin Console, go to Security > 2-Step Verification, and set policies to require all users to enable it.

b. Data Loss Prevention (DLP)

• Set Up DLP Rules: DLP helps prevent PHI from being shared outside your organization. Set DLP policies for Gmail and Google Drive to restrict or warn users when PHI is detected.
• How to Configure: In the Admin Console, go to Security > Data Protection, and set up DLP rules to monitor and restrict sensitive data sharing.

c. Encryption for Email and Data

• Enable TLS: Ensure that Transport Layer Security (TLS) is enabled for email transmission in Gmail to protect emails with PHI from unauthorized access.
• How to Check: TLS is enabled by default in Google Workspace, but you can verify in the Security > Email Security section of the Admin Console.

d. Access Controls

• Set User Access Permissions: Restrict access to PHI to only authorized users based on their role.
• How to Configure: Use Groups and Organizational Units in the Admin Console to assign access levels based on roles, ensuring PHI is accessible only to those who need it.

Step 4: Configure Google Drive for PHI Protection

• Set Sharing Restrictions: Configure Drive to restrict sharing of PHI only within your organization, and disable external sharing.
• Enable Link Expiration and Passwords: Set link expiration or passwords for sensitive files when shared outside your organization.
• How to Set: In the Admin Console, go to Apps > Google Workspace > Drive and Docs > Sharing Settings to set up internal-only sharing rules.

Step 5: Regularly Monitor and Audit Activities

a. Activity and Audit Reports

• Enable Activity Monitoring: Regularly review user activity in Google Workspace to detect any unusual behavior.
• How to Access: In the Admin Console, go to Reports > Audit Log to view activity logs for Drive, Gmail, and user login events.

b. Security Health Check

• Run Security Health Reports: Use the Security Health Check tool in the Admin Console to ensure compliance settings are correctly configured and spot potential risks.
• Regular Review: Schedule regular reviews of your security settings, access logs, and audit reports to stay compliant.

Step 6: Train Users on HIPAA Compliance and Google Workspace Usage

• User Training: Provide training on HIPAA-compliant usage of Google Workspace, such as best practices for handling PHI, recognizing phishing attempts, and using DLP rules.
• Compliance Reminders: Periodically remind users of policies and encourage them to report any incidents that may compromise PHI.

Step 7: Document and Maintain Compliance

• Keep a Record of the BAA: Maintain documentation of the signed BAA for compliance.
• Compliance Documentation: Document your organization’s policies and procedures for using Google Workspace in a HIPAA-compliant way, including audits, training, and security measures.
• Update Policies as Needed: As Google Workspace adds features, periodically review your settings and update your policies to stay HIPAA-compliant.

By following these steps, you can configure Google Workspace to meet HIPAA requirements and create a secure environment for handling PHI, protecting patient privacy, and maintaining compliance.