Google Drive HIPAA cheat sheet

For Google Drive to be HIPAA Compliant the following must be implemented:

• Secure a Google BAA
• Implement access controls
• Enable 2-factor authentication
• Turn off link sharing and file syncing
• Sharing files outside the domain must be restricted
• Use unique passwords
• Set document visibility to private
• Disable offline storage, third-party app, and add-ons
• Regularly audit account logs, access, and shared file reports
• Ensure that ‘manage alerts’ setting is turned on to notify administrators of changes to settings
• Google Drive data must be backed up
• Train staff on how to use G Suite in a HIPAA compliant manner
• DO NOT put PHI as the title of a file

source:https://compliancy-group.com/is-google-drive-hipaa-compliant/