Certain GCP services in the Google ecosystem can be used in a HIPAA compliant manner. Google is willing to sign a Business Associates Agreement (BAA) for a select list of cloud services. This BAA designates specific physical safeguards handled by Google. It is your organization’s responsibility to implement all necessary technical and administrative safeguards.