Guide

Can Google Voice be your practice line? The BAA test for phone tools

Summary

Google Voice can serve as a therapy practice phone number, but only the Google Workspace edition with managed users, and only after an administrator accepts Google's business associate agreement. Google's own HIPAA coverage list names Google Voice for managed users only, so a free consumer account sits outside that agreement. The test underneath the brand is whether the tool stores voicemail, transcripts or texts holding patient information.

By Gale Editorial · Updated 2026-09-01. Every figure cited to a dated source. How we write.

Can Google Voice be a HIPAA-covered practice line?

Yes, on two conditions. Google's HIPAA Included Functionality list, as of the page's own date of August 31, 2026, names Google Voice as covered by Google's business associate agreement for managed users only 1. The agreement itself is offered to Google Workspace and Cloud Identity customers, and an administrator has to review and accept it before any patient information goes into any covered service 2. A free consumer account meets neither condition.

Two things about that list belong somewhere you will read them again. The list carries a date rather than a promise, so the sentence above is true as of that date and has to be re-read at renewal. And Google puts the question of whether HIPAA applies at all on the customer rather than on itself 2. The vendor supplies a contract and a list of covered services. The practice decides whether it is a covered entity.

But a product appearing on the list settles less than it looks like it settles. The list tells you an agreement is available for that edition. It says nothing about whether the way your line gets used puts patient information anywhere the agreement has to reach, which is the question sitting underneath this one.

Where the line falls between carrying a call and keeping it

A phone tool needs a business associate agreement when it maintains patient information for the practice, not only when it carries a conversation. The codified test at 45 CFR 160.103 is functional and says nothing about what the vendor calls itself: a business associate is a person who, on behalf of a covered entity and outside its workforce, creates, receives, maintains, or transmits protected health information for a regulated function 3.

The exception people reach for is the conduit exception, and HHS wrote it narrower than its reputation. In the 2013 omnibus final rule the department called it a narrow one, intended to exclude only those entities providing mere courier services, naming the Postal Service and its electronic equivalents 4. A telecommunications company is HHS's own example of the occasional, random access that does not make a company a business associate 4. That is the basis for the old rule of thumb that a plain phone carrier signs nothing.

But the same passage draws the line that decides voicemail. An entity that maintains protected health information on behalf of a covered entity is a business associate and not a conduit, even where it never views the information, and the exception reaches transmission plus the temporary storage incident to it 4. HHS also calls the determination fact specific, turning on the nature of the services provided and the extent to which the entity needs access 4.

The Security Rule's definitions point the same way. Voice transmitted via telephone falls outside the definition of electronic media only where the information being exchanged did not exist in electronic form immediately before the transmission 3. A live call between two handsets can sit outside it. A voicemail stored in an app, an automatic transcript of that voicemail, a text thread, a call log carrying patient names: each is information kept in electronic form, and each moves the question back to the vendor's agreement.

What accepting the BAA commits both sides to

A written agreement, and a duty that outlasts the signature. Where a tool is a business associate, the satisfactory assurances cannot be informal: 45 CFR 164.502(e)(2) requires them to be documented through a written contract or other written agreement meeting the applicable requirements of 164.504(e) 5. On Google's side of it, an administrator reviews and accepts the agreement before protected health information goes into any covered service 2.

164.504(e)(2) is where the contract's contents live, including the term that matters most at the end of a vendor relationship. A business associate contract obligates the business associate to return or destroy all protected health information it holds when the contract terminates, or, where that is not feasible, to go on protecting the information under the same terms indefinitely 6.

Ask what happens to two years of stored voicemail on the day the practice changes vendors, and that clause is the answer.

The practice keeps a duty of its own after signing. Under 164.504(e)(1)(ii), the practice is itself out of compliance if it knows of a pattern of activity amounting to a material breach by the business associate and takes no reasonable steps to cure it, then fails to terminate the contract where the cure fails and termination is feasible 6.

What the Security Rule asks of the tool carrying the calls

Two things, and neither is satisfied by an agreement alone. The transmission security standard at 45 CFR 164.312(e)(1) applies to electronic protected health information moving over an electronic communications network 7. Its encryption implementation specification at (e)(2)(ii) is labeled Addressable rather than Required, worded as implementing a mechanism to encrypt whenever deemed appropriate, and the encryption specification at (a)(2)(iv) carries the same label 7.

The rule uses those two labels deliberately, so the distinction is worth reading in the regulation itself rather than in a vendor's compliance summary. That text is current as displayed on 2026-09-01, and the technical safeguards attach to whatever tool carries the information, whoever sells it.

The other half of it is what goes into the message in the first place. The minimum necessary standard at 45 CFR 164.502(b) is a reasonable-efforts duty to limit protected health information to the minimum needed for the purpose, and it carries a closed list of uses and disclosures it does not reach, including disclosures to, or requests by, a health care provider for treatment 5. A voicemail confirming a time needs less in it than a voicemail explaining why the time moved.

A sequence for setting the practice line up

Decide what the line will hold before choosing what runs it. The order matters because storage is what pulls a phone tool inside the agreement. Four steps fit in an afternoon and the first is free: write down which of voicemail, voicemail transcription, texting and call logs the practice will turn on, and what a patient could reasonably leave in each of them.

1. Check the vendor's current covered-services list for the exact product name and edition, not the brand. Google's names Google Voice for managed users only, as of August 31, 2026 1. 2. Have an administrator accept the business associate agreement before the first patient call, and keep a dated copy with the practice's other compliance records 2. 3. Turn off what is not covered. A consumer account still forwarding to the same handset is a common way a covered edition stops being the thing patients actually reach. 4. Set a diary date. The list carries a date 1, so re-reading it at each renewal is the only way this answer stays current.

Whatever ends up carrying it, the practice line is a vendor relationship and a recurring cost, which is where it belongs in the startup budget.

Applying the same test to any phone vendor

Ask any phone vendor for two documents and read them in this order: the business associate agreement itself, and the vendor's own list of which products that agreement covers. A general claim of HIPAA compliance on a marketing page is neither document. Google's structure is a useful model here precisely because both exist in public and the covered-services list names an edition rather than a brand 1.

Then run the storage test against the features you plan to switch on. Where a vendor maintains voicemail, transcripts, texts or logs holding patient information on the practice's behalf, the conduit reading does not reach it, and HHS calls that determination fact specific 4. Where the vendor will not put its covered products in writing, that is an answer too.

Two adjacent questions travel with this one and are not settled here. A number that reaches patients in more than one state raises marketing across lines, where the issue is the license named in the advertisement. And vendor management for a solo practice is largely this same routine repeated on each tool: a written agreement, a covered-services list, a date in the calendar.

Set that date the same day the agreement is accepted. A covered-services list that changed six months ago is indistinguishable from one that did not, until somebody reads it.

Common questions

There is no path to a business associate agreement for it. Google offers the agreement to Google Workspace and Cloud Identity customers, and its covered-services list names Google Voice for managed users only, as of that page's date of August 31, 2026. A consumer account sits outside both, so patient information should not land in its voicemail, transcripts or texts.

Often not for plain carriage. HHS calls the conduit exception a narrow one covering mere courier services and gives a telecommunications company as its example of occasional, random access that does not create the relationship. But the same guidance says an entity that maintains protected health information is a business associate even where it never views it, and calls the determination fact specific.

It can. Voice via telephone is outside the Security Rule's electronic media definition only where the information did not exist in electronic form immediately before the transmission, and a stored transcript is information kept in electronic form. Whether a specific product crosses that line is fact specific, so ask the vendor whether the transcription feature is inside its covered services.

The assurances must be documented in a written contract or other written agreement meeting 45 CFR 164.504(e), and that contract has to obligate the vendor to return or destroy the protected health information it holds at termination, or keep protecting it under the same terms where return is not feasible. The practice also carries a duty to cure or terminate on a known pattern of material breach.

The rules above turn on what a tool stores and who holds it, not on whose name is on the account. Separating a personal number from a practice number is mostly a practical call: how discoverable the number becomes once it appears in directories, who reaches you after hours, and whether the number can move if the practice is ever sold or handed on.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

  1. 1.Google LLC (2026). HIPAA Included Functionality. Google Workspace Terms. link ✓That Google's HIPAA BAA covers Google Voice for managed users only, as of the page's own stated date of August 31, 2026.
  2. 2.Google LLC (2026). HIPAA Compliance with Google Workspace and Cloud Identity. Google Workspace Admin Help / Google Workspace Knowledge. link ✓That the BAA is offered to Google Workspace and Cloud Identity customers, that an administrator must review and accept it before PHI is used in Google services, and that Google leaves the determination of whether HIPAA applies to the customer.
  3. 3.U.S. Department of Health and Human Services (2000). § 160.103 Definitions. Electronic Code of Federal Regulations (eCFR), Title 45, Part 160, Subpart A. link ✓The functional definition of a business associate as a person who creates, receives, maintains or transmits PHI on behalf of a covered entity, and the electronic media definition's carve-out for voice via telephone where the information did not exist in electronic form immediately before the transmission.
  4. 4.U.S. Department of Health and Human Services, Office of the Secretary (2013). Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules. Federal Register, 78 FR 5566 (January 25, 2013). link ✓The narrowness of the conduit exception and its limit to mere courier services, the telecommunications-company example of occasional random access, the rule that an entity maintaining PHI is a business associate even if it never views it, and HHS's statement that the determination is fact specific.
  5. 5.U.S. Department of Health and Human Services (Office for Civil Rights) (2026). § 164.502 Uses and disclosures of protected health information: General rules.. Electronic Code of Federal Regulations (eCFR), Title 45, Subtitle A, Subchapter C, Part 164, Subpart E. link ✓The requirement that satisfactory assurances be documented in a written contract or other written agreement meeting 164.504(e), and the minimum-necessary standard at (b) with its closed list of uses and disclosures it does not reach, including disclosures to a health care provider for treatment.
  6. 6.U.S. Department of Health and Human Services (2026). 45 CFR 164.504 - Uses and disclosures: Organizational requirements. Electronic Code of Federal Regulations (eCFR). link ✓That a business associate contract must obligate return or destruction of PHI at termination (or continued protection where that is not feasible), and the covered entity's duty at (e)(1)(ii) to cure or terminate on a known pattern of material breach.
  7. 7.U.S. Department of Health and Human Services (2026). § 164.312 Technical safeguards. Electronic Code of Federal Regulations (eCFR), Title 45, Part 164, Subpart C. link ✓The transmission security standard at (e)(1) for ePHI moving over an electronic communications network, and the Addressable label on the encryption implementation specifications at (e)(2)(ii) and (a)(2)(iv).

https://www.gale.care/for-providers/pq-google-voice-as-practice-line · 7 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers

Findability, by specialty

How practices like yours get found in local search and AI answers — the honest playbook, per specialty.

SEO for private practices · SEO for AI search / answer engines (all verticals)