Google Meet is an innovative VoIP and videoconferencing program that healthcare providers can use to deliver telehealth services, remote consultation services, and virtual patient sessions. However, is Google Meet compliant with HIPAA?
Google Meet is quickly turning into the trusted videoconferencing service for companies in all industrial sectors because other productivity tools are easily integrated in the Google Workspace Suite. Nonetheless, when healthcare providers use the service to send Protected Health Information (PHI), there must be some measures in place to ensure Google Meet HIPAA compliance.
To begin with, before using Google Meet to gather, share, or send Protected Health Information, a healthcare company needs to register to a Business Google Workspace or Cloud Identity account and agree to the Business Associate Addendum of Google. The Addendum gives details concerning which of Google´s services are HIPAA compliant and what are the responsibilities of customers.
Having signed the Business Associate Addendum (BAA) does not make Google Meet HIPAA compliant. To support compliance, system administrators still ought to set up the service. For instance, Meet must be made the default videoconferencing service of the company so that workstations won’t prompt calls using Hangouts, which does not comply with HIPAA when utilized in video mode.
It may additionally be required to keep private all Google Meet invites so as to hide any PHI noted in the invites (for example, patients´ names) and to limit access to Meet video recordings, which are stored in Google Drive automatically. It will definitely be required to create guidelines on the right way to use Google Meet to comply with HIPAA and teach employees about the policies.
To ensure that healthcare companies and their Business Associates comply with HIPAA when they use Google Meet, Google lately upgraded its Workspace and Cloud Identity Implementation Manual. The Manual gives advice on the right way to use Google Meet in compliance with HIPAA, along with all the tools available in the Workspace and Cloud identity services included in the Business Associate Addendum.
The Importance of HIPAA Compliance in Telehealth
It is said that healthcare experts frequently mistakenly think that talking about ePHI through any communication channel complies with HIPAA if the communication is directly from a healthcare specialist to a patient. This isn’t correct, and there are a lot of examples of unencrypted messages that are intercepted or viewed impermissibly.
Therefore, it is essential that Covered Entities and Business Associates use a safe and HIPAA-compliant tool like Google Meet when offering telehealth solutions. Nevertheless, it is similarly vital that the solution is set up in compliance with the Technical Safeguards of the Security Rule, that exclusively authorized end users can have access to, and that method of checking Google Meet communications is put in place to avoid unintentional or malicious compromise of ePHI.
The Applicable HIPAA Regulatory Text for Google Meet
Use of Google Meet for telehealth involves electronic protected health information and triggers HIPAA Security Rule safeguard requirements when a regulated entity creates, receives, maintains, or transmits electronic protected health information through the service. The HIPAA Privacy Rule establishes a baseline restriction on disclosures because a covered entity “may not use or disclose protected health information, except as permitted or required” by regulation. The HIPAA Security Rule transmission security standard requires regulated entities to “Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.” Configuration decisions for meetings, invitations, recordings, screen sharing, chat, and file handling should align with these standards and with the organization’s risk analysis and documented policies and procedures.
HIPAA Staff Training
HIPAA staff training supports compliant use of videoconferencing by establishing consistent workforce practices for scheduling, identity verification, device and workspace controls, and handling of meeting artifacts such as recordings, chat logs, screenshots, and shared files. The HIPAA Privacy Rule training standard requires a covered entity to “must train all members of its workforce on the policies and procedures with respect to protected health information” as needed to carry out their functions. The HIPAA Security Rule training standard requires organizations to “Implement a security awareness and training program for all members of its workforce (including management).” Training records should document assignment, completion dates, and refresher cadence, and should support role-based modules for staff who administer Google Workspace settings, manage telehealth workflows, or respond to security incidents. The HIPAA Journal Training can be used for this purpose because it is online, comprehensive, and suitable for onboarding and annual refresher training.