Is Google Gemini HIPAA compliant?
Checked 6 Nov 2026 from 4 vendor sources
Google lists the Gemini app as a Workspace core service and Gemini in Workspace as included functionality under its Workspace BAA, and lists Gemini Enterprise under its Google Cloud BAA, but excludes Gemini in Chrome. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Gemini in Chrome | Not covered |
| Gemini app enabled as an Additional Product | Not covered |
| Gemini app as a Google Workspace core service, and the Gemini Mac App, with Workspace BAA accepted | Covered |
| Gemini in Google Workspace apps, with Workspace BAA accepted | Covered |
| Gemini Enterprise and related Gemini services on Google Cloud, under the Google Cloud BAA | Covered |
What the BAA leaves out
- Gemini in Chrome
- Gemini app as an Additional Product
- Third-party apps and add-ons
- Gemini Notebook in Workspace (see NotebookLM entry)
- Any Workspace service not on the included functionality list
How to get the BAA
A Workspace super administrator reviews and accepts the BAA electronically in the Admin console.
What the vendor says to do
- A super administrator accepts the BAA in the Admin console under Account settings, Legal and compliance
- Enable only the Gemini app as a Workspace core service, not as an Additional Product
- Turn off Gemini in Chrome access for users handling PHI
- Use organizational units to separate PHI users from others and turn off non-core services for them
- Restrict external Drive sharing and review third-party apps and add-ons
- Do not include PHI in Gemini feedback
What we couldn’t confirm
Google’s pages don’t list exactly which Workspace editions qualify, and they don’t state a position on personal Google accounts. Google’s consumer Gemini page warns against entering confidential information.
Proof from the vendor
- HIPAA compliance on Google Cloud and Google WorkspaceIncluded functionality list: Gemini app excluding Chrome, Gemini in Workspace, Google Cloud Gemini services
- Generative AI in Google Workspace Privacy HubGemini can support HIPAA workloads, Gemini in Chrome not covered by the BAA
- Google Workspace and Cloud Identity HIPAA Implementation Guide (September 2025)Additional Product Gemini app not compliant, setup recommendations
- HIPAA Compliance with Google Workspace and Cloud IdentityHow the BAA is accepted, third-party add-ons excluded
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.