What Business Plus leaves out
Google Workspace Business Plus is the minimum edition we work with, and plenty of practices stay on it. It is a good edition. It is not the most protective one, and you should know exactly what it goes without before you choose it.
Why Business Plus is our minimum
Below Business Plus, three things do not exist at any price: Google Vault, which holds your retention policies; control over how long a session stays signed in, which is how automatic logoff works; and the device management our approach relies on. Without them, a retention policy or a mobile policy is a document with nothing behind it. Business Plus has all three.
Side by side
Both editions share the foundations. The rows where they differ are what Business Plus leaves out.
| Business Plus | Enterprise Standard | |
|---|---|---|
| What both editions have | ||
| Google's HIPAA business associate agreementAccepted in the Admin console | Yes | Yes |
| Google VaultRetention policies and legal holds | Yes | Yes |
| Session length controlHow automatic logoff works | Yes | Yes |
| Two-step verificationIncluding security keys and passkeys | Yes | Yes |
| Alert centerGoogle's alerts about suspicious activity | Yes | Yes |
| Activity logs kept by GoogleAdmin, Drive, Gmail, login and app access | 6 months | 6 months |
| Where they differ | ||
| Rules that catch patient informationBlock it, or warn the sender, before it leaves by Drive, Gmail or Chat | No. A Drive report shows what it found, afterwards | Yes |
| Context-Aware AccessLet people in only from approved devices or places | No. We protect remote access with two-step verification, session limits and device policy | Yes |
| Security dashboard and health pageWeak settings at a glance | No | Yes |
| Investigation toolSearch activity; the premium tool can act on what it finds | Basic | Premium |
| Trust rules for Drive sharingFiner control over sharing outside the practice | No. Basic sharing controls and trusted domains, which we set | Yes |
| Logs kept past Google's six monthsAutomatic export to long-term storage | No. We download and archive them for you | Yes |
What we do on Business Plus instead
- Set Drive sharing outside the practice to restricted by default, with your trusted domains.
- Review who has shared what outside the practice every month, and tell you straight away if something is exposed in between.
- Deploy and run Paubox for email that carries patient information, if you choose it.
- Protect remote access with two-step verification, session limits and device policy.
- Download your activity logs on a schedule and keep them past Google's six months.
What that means for you
These measures make up for what Business Plus leaves out. They do not replace it. On Business Plus, keeping patient information from leaving the practice by email or Drive depends more on each person's care than it would on Enterprise Standard. Your risk analysis should say so, and we will help it say so accurately.
Changing your mind
You can upgrade to Enterprise Standard at any time. We coordinate it with your Google partner and add what it brings to your configuration, with no extra setup fee. Enterprise Standard costs more per user than Business Plus; your Google partner quotes the difference.
Last checked against Google's published edition comparison: 7 September 2026.
See where you stand first
Twenty-seven questions, one for each safeguard in the HIPAA Security Rule. You score yourself, and every item names who would have to close it — us, your leadership, or your own team.
Take the HIPAA Checkup