Question

A healthcare startup is building a patient-record analytics platform on Google Cloud and must comply with HIPAA. Their compliance officer wants to ensure that every Google Cloud product used to store, process, or transmit electronic protected health information (ePHI) is legally permitted under HIPAA. As the cloud architect, what is the correct first step to establish this compliance foundation?

Accepted Answer

Execute the Business Associate Agreement (BAA) with Google and restrict the architecture to products that Google lists as covered under the BAA.

Answer

Enable Customer-Managed Encryption Keys (CMEK) on all services, which automatically makes any Google Cloud product HIPAA-compliant.

Answer

Purchase an Assured Workloads folder configured for the HIPAA control package, which grants legal HIPAA coverage for all Google services.

Answer

Submit a support case requesting a third-party HITRUST audit report and rely on it as the binding compliance agreement for ePHI handling.