Is NotebookLM HIPAA compliant?
Checked 6 Nov 2026 from 4 vendor sources
Google says Gemini Notebook, formerly NotebookLM, is not covered by its BAA in Workspace, while the separate Gemini Notebook Enterprise on Google Cloud appears on its list of HIPAA-supported Cloud services. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Gemini Notebook (formerly NotebookLM) with Google Workspace | Not covered |
| Gemini Notebook Enterprise on Google Cloud, under the Google Cloud BAA | Covered |
What the BAA leaves out
- Gemini Notebook in Workspace is outside the BAA even though it is a Workspace core service
How to get the BAA
For the Enterprise product, enter into a Google Cloud BAA. Google’s HIPAA page points to its privacy compliance support page for how to review and accept it.
What we couldn’t confirm
Google has renamed this product Gemini Notebook, so check which version you’re using. Its healthcare marketing page promotes Gemini Notebook for clinical data, while its Privacy Hub says it isn’t covered by the Workspace BAA. We followed the Privacy Hub.
Proof from the vendor
- Generative AI in Google Workspace Privacy HubGemini Notebook is not covered by the Google BAA; formerly NotebookLM; Google plans to work toward certifications
- HIPAA compliance on Google Cloud and Google WorkspaceGemini Notebook Enterprise listed under Google Cloud supported services; NotebookLM not on the Workspace list
- What is Gemini Notebook Enterprise?Enterprise is a separate product in a Google Cloud project, distinct from the personal version
- Compliance certifications and security controls (Gemini Enterprise)Directs readers to the HIPAA page to verify Gemini Notebook
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.