Is Google Gemini HIPAA Compliant? What Healthcare Organizations Should Consider and Know

Generative AI tools such as Google Gemini are increasingly built into the software healthcare organizations already use, and compliance professionals are often asked whether these tools can be used with patient information. The answer depends on more than the tool itself. Google includes certain Gemini products within the scope of its HIPAA business associate terms. Still, that coverage is one input into a broader decision that belongs to each organization’s compliance program, privacy and security officials, IT security team, and business leadership.

This article summarizes Google’s published documentation on Gemini and HIPAA as of the date of publication, identifies the areas Google excludes, and outlines questions organizations commonly work through before deciding whether and how a Gemini product fits within their compliance program. Our article here should be considered general and educational information, and not legal advice, nor a substitute for your organization’s own policies, procedures, and risk analysis.

Google addresses HIPAA coverage for Gemini through two separate agreements: the Google Workspace Business Associate Amendment and the Google Cloud Business Associate Agreement. Google refers to both as a “BAA.” Gemini coverage flows through whichever agreement an organization has entered into; Google does not offer a separate Gemini-specific BAA.

Under both agreements, coverage applies only to products on Google’s published list and only after the organization has entered into the applicable agreement. Because Google updates these lists and has recently renamed several products, the lists themselves, rather than this article, should be treated as the current reference.

Google’s HIPAA Included Functionality list for Workspace, dated August 31, 2026, includes three Gemini entries:

• Gemini app, excluding Gemini in Chrome.
• Gemini Mac App.
• Gemini in Workspace refers to the Gemini features within covered Workspace services such as Gmail, Google Docs, Google Sheets, and Google Drive. Google’s help center states that Gmail’s Help me write, contextual smart replies, and side-panel features are covered under this entry.

Google’s HIPAA guidance for Workspace administrators states that customers who have not signed a BAA with Google must not use PHI in Workspace services, and that administrators must review and accept a BAA before PHI is used. Google also places responsibility on each customer to determine whether it is subject to HIPAA and whether it intends to use PHI in Google services.

Coverage is tied to the organization’s Workspace environment. Google’s administrator documentation distinguishes the Gemini app provided as a core service under a qualifying Workspace edition from Gemini accessed under other terms, such as through a personal Google account, a Workspace Individual subscription, or as an Additional Google Service. Your Workspace administrator and IT security team are the right resources to confirm which edition and access path applies to your users.

Gemini coverage sits within your broader Google Workspace HIPAA compliance posture. Our guide, “Is Google Workspace HIPAA Compliant?”, covers Gmail, Drive, and other core services.

Organizations that build on Google Cloud work under the Google Cloud BAA. Google’s HIPAA compliance page for Google Cloud and Google Workspace lists the covered products. Its Gemini entries currently include Gemini Enterprise, Gemini Enterprise Agent Platform, Gemini Enterprise for Customer Experience, Gemini Code Assist, Gemini in BigQuery, Gemini in Colab Enterprise, and Gemini Notebook Enterprise.

The same page describes practices Google expects of Cloud customers handling PHI, including disabling services that are not on the covered list (and not using a service with PHI if it cannot be disabled) and not using pre-general-availability (pre-GA) offerings with PHI unless Google’s terms expressly allow it.

Because Google has renamed several Gemini products, a vendor proposal or internal request may refer to an older name. Matching product names against Google’s current list is a useful step for IT security and procurement during any review.

Google’s documentation identifies several Gemini access points that fall outside its HIPAA coverage. These distinctions are not always visible to end users, which is one reason organizations often address them in policy and workforce training.

The Workspace list excludes the Gemini app entry from the Chrome Workspace list by name. Because Chrome is often the same browser workforce members use to access covered Workspace services, organizations may wish to address this distinction specifically in their AI use policy and training.

Google’s BAA is entered into by the organization for its Workspace or Cloud environment. A personal Google account, including one with a paid individual AI subscription, is not part of that agreement. Organizations commonly address personal-account use in their acceptable use and AI use policies.

If questions arise about whether patient information was entered into a tool outside the organization’s agreement, the matter should be referred to the privacy officer in accordance with the organization’s incident response procedures. Whether any particular event is reportable depends on the facts and the risk assessment described in the Breach Notification Rule; it is not something an individual workforce member can determine in advance.

Google states that its Workspace BAA terms do not extend to Additional Google Services, the Google products outside the core Workspace services. Google provides the administrator controls for these services, and decisions about them are typically made in collaboration with IT security. Products that do not appear on Google’s current list should be treated as outside the scope of its HIPAA coverage.

Google’s Workspace help center states that third-party applications, including add-ons, are not included in the functionality covered by the BAA. Google’s documentation also does not identify connections between the Gemini app and non-Google services as Included Functionality. Any third-party tool that would create, receive, maintain, or transmit PHI on the organization’s behalf generally calls for its own vendor review and, where the vendor is a business associate, its own BAA. Our page on business associate agreements explains what these agreements typically address.

Google renamed NotebookLM to Gemini Notebook on July 16, 2026. Gemini Notebook Enterprise appears on the Google Cloud list. The Workspace version of Gemini Notebook does not appear on the Workspace list dated August 31, 2026. Because notebooks created in the Gemini app can also be opened in Gemini Notebook, organizations evaluating the Gemini app may wish to ask Google, through their administrator or account team, how notebook content is treated before any use involving PHI.

The table below summarizes Google’s Workspace and Google Cloud HIPAA lists as of August 31, 2026, along with points organizations commonly confirm internally. It reflects only Google’s coverage; it is not a determination that any use is appropriate for a particular organization.

No software product is HIPAA compliant on its own. The U.S. Department of Health and Human Services (HHS) does not offer a certification program for HIPAA compliance, and Google describes compliance as a shared responsibility between Google and its customers.

Google’s BAA addresses Google’s obligations as a business associate for covered services. The covered entity or business associate using the product remains responsible for its own obligations under the Privacy, Security, and Breach Notification Rules, including risk analysis, access management, workforce training, and policies and procedures.

In practice, the more useful question for a compliance program is not “Is Gemini HIPAA compliant?” but “Has our organization evaluated, documented, and approved this use, and do our safeguards support it?” Our guide to AI governance in a healthcare compliance program discusses how organizations structure that review.

The considerations below are areas organizations commonly review through their established governance process, with the privacy and security officials, IT security, legal or contracting, and business leadership each contributing. Many of them extend work a compliance program already performs for other vendors and technologies.

1. Contracting and approval. Has the organization, through its normal contracting and approval process, decided to enter into the applicable Google agreement? Google’s process allows a Workspace super administrator to accept the BAA electronically in the Admin console, and Google notes that a screenshot of the acceptance in the Legal and compliance section can serve as evidence. Because accepting a BAA is entering into a contract, many organizations route that decision through legal and leadership rather than leaving it to an administrator. Google Cloud BAA is a separate agreement.
2. Scope of approved use. Which Gemini products and access paths, if any, has the organization approved, for which workforce roles, and for what purposes? Some organizations begin with uses that do not involve PHI while their broader review is underway.
3. Technical configuration. What controls does IT security recommend for the organization’s environment, such as limiting Gemini to approved groups, managing Additional Google Services, and applying sharing practices consistent with Google’s Workspace HIPAA Implementation Guide? Specific settings vary by edition and environment.
4. Minimum necessary. How does the privacy officer apply the Privacy Rule’s minimum necessary standard to each approved use, and how will that expectation be communicated to the workforce?
5. Security risk analysis. Has each approved Gemini product been incorporated into the risk analysis required under 45 CFR 164.308(a)(1)(ii)(A), including what ePHI it may access, who can use it, and which controls apply? Our guide to the HIPAA security risk analysis walks through the process. Organizations typically revisit the analysis when Google changes its lists or when their own use changes.
6. Policies and training. Does the organization’s AI use policy identify approved tools, approved and prohibited uses, and how workforce members should raise questions or concerns? These expectations are often incorporated into the security awareness and training program under 45 CFR 164.308(a)(5), including the distinctions between work and personal accounts and between the Gemini app and Gemini in Chrome.
7. Review of AI-generated content. What human review does the organization expect before AI-generated content is used in a medical record, a claim, or a patient communication? Generative AI can produce fluent text that still contains errors.
8. Incident response. Do the organization’s procedures address what happens if information is entered into an unapproved tool, so that the privacy officer can evaluate the situation promptly and consistently?

If your organization is developing an AI use policy, our AI Governance Compliance Checklist provides a starting structure you can adapt to your program.

Whether your organization is evaluating Gemini or another AI tool, understanding how the tool handles patient information is one part of a broader governance effort that also includes policies, safeguards, workforce training, and ongoing oversight.

Compliancy Group helps healthcare organizations bring these activities together on a single platform, The Guard, including security risk assessments, policies and procedures, workforce training, and vendor and business associate management. When compliance questions arise, our CORA AI Compliance Assistant helps teams locate relevant federal and state regulatory requirements, with citations to the sources.

To get started, download our AI Governance Compliance Checklist. For broader background, read our guide, Is AI HIPAA Compliant for Healthcare?, or request a demo to see how the pieces work together.