Is Google Sheets HIPAA Compliant?

Google Sheets, part of Google Workspace, is a widely used application for data organization and analysis. With healthcare organizations increasingly turning to cloud-based tools for data management and analysis, there are questions around the suitability of certain applications —particularly in relation to HIPAA compliance.

The good news is that Google Sheets is HIPAA compliant, provided it is configured and utilized in the right way.

Healthcare organizations can use Google Sheets to create, manage, and share sheets that contain Protected Health Information (PHI) only when they meet the following requirements:

1. Organizations must sign a relevant Business Associate Agreement (BAA) with Google, and;
2. Organizations must configure their Google Drive (Google’s cloud-based file storage and synchronization service) settings in a way that controls access to Google Sheets.

Can You Store PHI or Patient Data in Google Sheets?

Yes, it is possible to store PHI or patient data in Google Sheets, but only under specific conditions.

‍

‎‎For example, sensitive data must be protected and the ability of both users and Google to access data must be restricted through access controls and other techniques.

Will Google Sheets Sign a Business Associate Agreement?

To comply with HIPAA, third-party vendors must have a Business Associate Agreement (BAA) in place with their partners.

Google is willing to sign a BAA for Google Sheets. The BAA that Google offers covers the productivity tools that make up the Google Workspace suite, including Google Sheets, Google Drive, Google Docs, Google Slides, and Google Forms.

This comprehensive BAA underlines Google’s commitment to HIPAA compliance and willingness to meet the needs of Google Workspace customers.

HIPAA Compliance Is a Shared Responsibility

Achieving HIPAA compliance whilst using Google Sheets involves more than just configuring the settings of your Google Workspace apps. Compliance is a shared responsibility that requires active management, including;

• Activating robust access controls.
• Conducting regular permission reviews and updates.
• Training staff on secure data handling protocols.
• Ensuring PHI is not improperly shared and preventing internal and external data leaks.

When entering into BAA with 3rd-party vendors, it is often the partner organization that ends up liable for security failures and leaks. Always ensure proper data security practices are upheld.

Can PHI/Patient Data Be Leaked from Google Sheets?

Even with the proper configuration of the Google Workspace, there is a risk of PHI or patient data being leaked. Aside from the improper configuration of settings, common causes for data leaks from Google Sheets include:

• Unauthorized access.
• Incorrect sharing settings.
• Malicious cyber attacks affecting data integrity and confidentiality.

Organizations need to be aware of these risks and adopt additional safeguards to protect their handling and storing of PHI in Google Sheets.

How Does Strac Protect Google Sheets Against Data Leaks?

Strac Google Sheets DLP  is a data loss prevention software that replaces sensitive data with format-preserving pseudonyms. This allows developers and business analysts to work with sensitive data whilst staying compliant with data privacy standards such as those set out by HIPAA.

‍

‎Strac Google Sheets DLP adds an additional layer of security by ensuring sensitive and protected data is only accessible on a need-to-know basis.

To give a simplified version of the process, the software works by creating a copy of the original Google Sheet with sensitive data elements replaced by format-preserving pseudonyms. This process effectively masks PHI or any other sensitive data contained within Google Sheets, CSV files, and even Microsoft Sheets.

The list of sensitive data elements that can be pseudonymized is long and can be configured to meet the needs of your organization.

Learn more about how Strac helps organizations comply with HIPAA with ‎our guide to HIPAA Compliance or see our Google Sheets DLP demo.

Browse our complete range of Strac DLP integrations and book a free 30-minute demo to learn more.

‍