GCP HIPAA Compliance: Cloud Run, Healthcare API & BAA Guide

Google Cloud Platform (GCP) has a unique advantage for HIPAA compliance: the BAA covers ALL GCP services. This means you can use Cloud Run, Cloud Functions, BigQuery, and other serverless services with PHI—something AWS and Azure don't fully support.

This guide is based on our experience deploying 30+ HIPAA-compliant applications on GCP for healthcare startups, telemedicine platforms, and health tech companies.

What Makes GCP Different for HIPAA?

Google Cloud's BAA covers ALL services, not just a subset. This is a massive advantage:

• AWS: 100+ eligible services, but many serverless services are NOT covered
• Azure: Most services covered, but some limitations
• GCP: ALL services covered under BAA (Cloud Run, Cloud Functions, BigQuery, etc.)

This makes GCP ideal for serverless HIPAA-compliant architectures, which are cheaper and easier to scale than traditional VM-based architectures.

How to Sign the GCP Business Associate Agreement (BAA)

GCP's BAA process is straightforward:

Step 1: Sign into GCP Console

Log in with an account that has Organization Admin or Project Owner permissions.

Step 2: Navigate to Compliance

Go to: https://console.cloud.google.com/marketplace/product/google/hipaa

Step 3: Review BAA Terms

The GCP BAA covers:

• ALL GCP services (unique advantage)
• Google's responsibilities as a Business Associate
• Your responsibilities as a Covered Entity or Business Associate
• Breach notification requirements
• Audit rights
• Data residency options

Step 4: Accept the BAA

Click "Accept Agreement" to electronically sign the BAA. This applies to your entire GCP organization.

Step 5: Configure HIPAA-Compliant Services

While all services are covered, you still need to configure them properly:

• Enable encryption at rest and in transit
• Set up access controls with IAM
• Enable audit logging
• Configure VPC Service Controls for data perimeter

Step 6: Document Your BAA Coverage

Maintain records of:

• BAA acceptance date
• List of GCP services used with PHI
• Security controls implemented
• Audit logs and compliance reports

Key Advantage: Unlike AWS and Azure, you don't need to worry about whether a specific service is HIPAA-eligible. ALL GCP services are covered.

GCP HIPAA-Eligible Services (ALL of Them)

Since ALL GCP services are HIPAA-eligible, here are the most commonly used for healthcare applications:

Compute Services

• Cloud Run: Serverless containers (fully managed, auto-scaling)
• Cloud Functions: Serverless functions for event-driven PHI processing
• Compute Engine: Virtual machines (VMs)
• Google Kubernetes Engine (GKE): Managed Kubernetes
• App Engine: Fully managed platform-as-a-service

Storage Services

• Cloud Storage: Object storage with encryption and lifecycle management
• Persistent Disk: Block storage for VMs
• Filestore: Managed file storage

Database Services

• Cloud SQL: Managed MySQL, PostgreSQL, SQL Server
• Cloud Spanner: Globally distributed relational database
• Firestore: NoSQL document database
• Bigtable: NoSQL wide-column database
• Memorystore: Managed Redis and Memcached

Healthcare-Specific Services

• Cloud Healthcare API: FHIR, HL7v2, and DICOM data management (purpose-built for healthcare)
• Healthcare Natural Language API: NLP for medical text
• Medical Imaging Suite: DICOM viewer and AI tools

Analytics & AI Services

• BigQuery: Data warehouse for healthcare analytics (HIPAA-eligible!)
• Dataflow: Stream and batch data processing
• Dataproc: Managed Spark and Hadoop
• Vertex AI: Machine learning platform (HIPAA-eligible!)

Security & Compliance Services

• Cloud KMS: Key management for encryption
• Cloud Logging: Centralized logging and audit trails
• Cloud Monitoring: Infrastructure and application monitoring
• Security Command Center: Security and risk management
• VPC Service Controls: Security perimeter for sensitive data
• Identity-Aware Proxy (IAP): Zero-trust access control
• Cloud Armor: DDoS protection and WAF
• Binary Authorization: Deploy-time security for containers

Full documentation: GCP HIPAA Compliance

Serverless HIPAA Architecture on GCP

GCP's unique BAA coverage makes it ideal for serverless HIPAA architectures. Here's a reference architecture:

1. Cloud Run for API Endpoints

Use case: RESTful API for PHI access (patient records, appointments, prescriptions)

Benefits:

• Auto-scaling from 0 to thousands of instances
• Pay only for requests (not idle time)
• Fully managed (no servers to patch)
• Built-in HTTPS with managed certificates
• VPC connectivity for private resources

Cost: $0.40 per million requests (incredibly cheap)

2. Cloud Functions for Event-Driven Processing

Use case: Process PHI when events occur (new patient record, lab result, imaging upload)

Benefits:

• Triggered by Cloud Storage, Pub/Sub, HTTP, etc.
• Serverless (no infrastructure management)
• Automatic scaling
• Pay per invocation

Cost: $0.40 per million invocations

3. Cloud Healthcare API for FHIR/HL7v2/DICOM

Use case: Store and manage healthcare data in industry-standard formats

Benefits:

• FHIR R4 compliant
• HL7v2 message ingestion
• DICOM for medical imaging
• HIPAA-compliant by default
• Built-in de-identification
• BigQuery integration for analytics

Cost: $0.01 per GB stored + API request costs

4. BigQuery for PHI Analytics

Use case: Healthcare analytics, population health, clinical research

Benefits:

• Petabyte-scale data warehouse
• SQL interface (familiar to analysts)
• Machine learning integration (BigQuery ML)
• HIPAA-eligible (unique among cloud data warehouses)
• Serverless (no infrastructure)

Cost: $5 per TB queried + $20 per TB stored

5. Cloud Storage for Medical Imaging and Documents

Use case: Store X-rays, MRIs, CT scans, patient documents

Benefits:

• Durable (99.999999999% durability)
• Encrypted at rest and in transit
• Lifecycle management (auto-archive old data)
• Object versioning
• Retention policies

Cost: $20 per TB/month (Standard class)

6. VPC Service Controls for Data Perimeter

Use case: Prevent data exfiltration and unauthorized access

Benefits:

• Create security perimeter around GCP resources
• Prevent data from leaving the perimeter
• Context-aware access (IP, device, location)
• Protect against insider threats

Cost: Free

Example Serverless HIPAA Architecture

Here's a complete serverless architecture for a telemedicine platform:

1. Frontend: Firebase Hosting (static site) or Cloud Run (Next.js)
2. API: Cloud Run (Node.js/Python/Go API)
3. Authentication: Firebase Auth or Identity Platform
4. PHI Storage: Cloud Healthcare API (FHIR) + Cloud Storage (imaging)
5. Database: Firestore (metadata) + Cloud SQL (relational data)
6. Analytics: BigQuery (population health, reporting)
7. Event Processing: Cloud Functions (triggered by new records)
8. Security: VPC Service Controls + Cloud Armor + IAP
9. Monitoring: Cloud Logging + Cloud Monitoring

Total cost: $100-300/month for a small telemedicine platform (10,000 patients)

GCP HIPAA Architecture Best Practices

1. Use VPC Service Controls for Data Perimeter

VPC Service Controls is GCP's most powerful security feature for HIPAA:

• Create a perimeter around all resources with PHI
• Prevent data exfiltration (even by admins)
• Enforce context-aware access policies
• Protect against insider threats and compromised credentials

2. Enable Encryption at Rest with Customer-Managed Keys (CMEK)

Use Cloud KMS with customer-managed encryption keys for:

• Cloud Storage buckets
• Cloud SQL databases
• Persistent Disks
• BigQuery datasets

3. Enable Encryption in Transit (TLS 1.2+)

All PHI transmission must use TLS 1.2 or higher:

• Cloud Run: HTTPS only (enforced by default)
• Cloud SQL: Require SSL connections
• Cloud Storage: Use HTTPS endpoints
• Load Balancer: TLS 1.2+ only

4. Implement Identity-Aware Proxy (IAP)

IAP provides zero-trust access control:

• Verify user identity before granting access
• No VPN required
• Context-aware access (device, location, IP)
• Works with Cloud Run, App Engine, Compute Engine

5. Enable Cloud Audit Logs for All Services

HIPAA requires audit logs of all PHI access:

• Enable Admin Activity logs (always on)
• Enable Data Access logs for all services with PHI
• Send logs to Cloud Logging
• Retain logs for 7 years (HIPAA requirement)
• Export logs to BigQuery for analysis

6. Use Cloud Monitoring for Alerting

Set up alerts for:

• Failed authentication attempts
• Unauthorized API calls
• Changes to IAM policies
• VPC Service Controls violations
• Encryption key access

7. Implement Cloud Armor for DDoS Protection

Cloud Armor provides:

• DDoS protection
• Web Application Firewall (WAF)
• IP allowlisting/denylisting
• Rate limiting
• Bot protection

8. Use Cloud KMS for Key Management

Cloud KMS provides:

• Hardware Security Module (HSM) backed keys
• Automatic key rotation
• Key versioning
• Audit logs of key usage
• Integration with all GCP services

9. Enable Binary Authorization for Containers

If using Cloud Run or GKE, enable Binary Authorization to:

• Ensure only trusted container images are deployed
• Require signed attestations
• Prevent unauthorized code execution

10. Implement Least Privilege with IAM

Use IAM for role-based access control:

• Predefined roles (e.g., Healthcare Dataset Viewer)
• Custom roles for specific permissions
• Service accounts for applications
• IAM conditions (time-based, IP-based access)
• Organization policies for guardrails

GCP HIPAA Cost Estimates

Here's what a serverless HIPAA-compliant application costs on GCP (small-to-medium healthcare startup):

Service	Configuration	Monthly Cost
Cloud Run	1M requests/month	$0.40
Cloud SQL	db-n1-standard-1 PostgreSQL	$25-40
Cloud Storage	1TB Standard class	$20
Cloud Logging	50GB logs/month	$25
Cloud KMS	5 keys	$0.30
Healthcare API	100GB FHIR data	$1
BigQuery	100GB storage + 1TB queries	$7
Networking	VPC, Cloud Armor, Load Balancer	$20-30
Total		$100-300/month

Why GCP is cheaper:

• Serverless services (Cloud Run, Cloud Functions) are pay-per-use, not pay-per-hour
• No idle costs (unlike EC2 or Azure VMs)
• BigQuery is cheaper than RDS/Azure SQL for analytics workloads
• Cloud Storage is competitively priced

Scaling costs:

• 10,000 users: $300-600/month
• 100,000 users: $1,500-4,000/month
• 1M+ users: $8,000-30,000/month

GCP HIPAA Implementation Timeline

Week 1-2: Planning & BAA

• Sign GCP BAA
• Design serverless architecture
• Select GCP services (all are eligible!)
• Document data flows and PHI storage
• Create IAM roles and service accounts

Week 3-4: Infrastructure Setup

• Configure VPC Service Controls
• Set up encryption (Cloud KMS, CMEK)
• Implement IAM policies
• Enable Cloud Audit Logs
• Configure Cloud Monitoring alerts
• Set up Cloud Armor for DDoS protection

Week 5-6: Application Deployment

• Deploy Cloud Run services
• Configure Cloud SQL with SSL
• Set up Cloud Healthcare API (if using FHIR)
• Configure Cloud Storage buckets
• Set up BigQuery datasets
• Test Cloud Functions

Week 7-8: Security & Compliance

• Conduct security assessment
• Test VPC Service Controls
• Document all security controls
• Create incident response plan
• Train team on HIPAA requirements
• Conduct internal audit

Common GCP HIPAA Mistakes to Avoid

1. Not Enabling Data Access Logs

Admin Activity logs are enabled by default, but Data Access logs are NOT. You must enable them for HIPAA compliance.

2. Not Using VPC Service Controls

VPC Service Controls is GCP's most powerful security feature. Not using it is a missed opportunity to prevent data exfiltration.

3. Storing PHI in Cloud Logging

Cloud Logging is HIPAA-eligible, but you need to ensure PHI isn't logged in plaintext. Implement log scrubbing.

4. Not Setting Log Retention to 7 Years

Default log retention is 30 days. Set it to 7 years for HIPAA compliance.

5. Using Default Service Accounts

Create custom service accounts with least privilege permissions. Don't use default Compute Engine or App Engine service accounts.

GCP vs AWS vs Azure for HIPAA: The Verdict

Feature	GCP	AWS	Azure
BAA Coverage	✅ ALL services	⚠️ 100+ services	⚠️ Most services
Serverless HIPAA	✅ Cloud Run, Functions	✅ Lambda	✅ Functions
Healthcare API	✅ Cloud Healthcare API	✅ HealthLake	✅ Health Data Services
Data Warehouse	✅ BigQuery (HIPAA)	❌ Redshift (not eligible)	⚠️ Synapse (limited)
Cost (Serverless)	✅ $100-300/mo	⚠️ $200-400/mo	⚠️ $250-450/mo
Data Perimeter	✅ VPC Service Controls	⚠️ VPC Endpoints	⚠️ Private Link

Recommendation:

• Choose GCP if: You want serverless architecture, need BigQuery for analytics, or want the simplicity of ALL services being HIPAA-eligible
• Choose AWS if: You need the broadest service ecosystem or have existing AWS infrastructure
• Choose Azure if: You're a Microsoft shop or need tight integration with Office 365/Active Directory

Need Help with GCP HIPAA Compliance?

We've deployed 30+ HIPAA-compliant applications on GCP for healthcare startups and telemedicine platforms. Our team can help you:

• Design serverless HIPAA-compliant architecture
• Implement VPC Service Controls and security perimeter
• Set up Cloud Healthcare API for FHIR/HL7v2/DICOM
• Configure BigQuery for healthcare analytics
• Conduct security assessments
• Optimize costs while maintaining compliance

Get expert help with GCP HIPAA compliance - free 30-minute consultation.

Related Resources:

• GCP HIPAA Compliance Landing Page
• Compare AWS vs Azure vs GCP for HIPAA
• HIPAA Security Rule Assessment Hub

Written by the compliance team at Tranquility Cybersecurity & Assurance. We've helped 200+ companies achieve HIPAA compliance on AWS, Azure, and GCP.