Conditional A BAA is available on paid Google Workspace editions where Gemini Apps is a core service and on Google Cloud Gemini services. The main exclusions are Gemini in Chrome, consumer Google accounts and the Gemini API via Google AI Studio. Verdict date: 2026-10-19; sources are listed below. See also All vendor HIPAA checks.
Short answer: Gemini is not one product with one status. A BAA is available on eligible Workspace plans for Gemini in Workspace and the Gemini app, and on Google Cloud for the Gemini services Google lists as supported. Coverage starts only after the BAA is accepted, and the covered surfaces are the ones named below.
Which plans include a BAA
Coverage follows the Workspace edition or Google Cloud account, not the Gemini brand. For the wider Workspace picture, see Is Google Workspace HIPAA compliant?
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Business Starter | Available | Super administrator accepts the Workspace BAA in the Admin console | None stated; Gemini is included in the edition |
| Business Standard | Available | Same | None stated |
| Business Plus | Available | Same | None stated |
| Enterprise Standard | Available | Same | None stated |
| Enterprise Plus | Available | Same | None stated |
| Essentials | Available | Same | None stated |
| Enterprise Essentials / Plus | Available | Same | None stated |
| Frontline Starter / Standard / Plus | Available | Same | None stated |
| Nonprofits | Available | Same | None stated |
| Education Fundamentals / Standard / Plus | Available | Same | None stated |
| Google Cloud Gemini services | Available | BAA accepted in the Google Cloud console | Google Cloud usage pricing |
| Cloud Identity | Excluded | n/a | n/a |
| Chrome Enterprise | Excluded | n/a | n/a |
| Essentials Starter | Excluded | n/a | n/a |
| G Suite (legacy) | Excluded | n/a | n/a |
| Workspace Individual | Excluded | n/a | n/a |
| Android Enterprise | Excluded | n/a | n/a |
| Consumer Google account | Excluded | No BAA offered | n/a |
| Gemini API via Google AI Studio | Excluded | Not on the Google Cloud BAA supported services list | n/a |
Entry price is from €6.80 per user per month on Business Starter with an annual commitment (EUR shown for this region).
What the BAA covers and what it excludes
Covered once the BAA is accepted:
- Gemini in Workspace: help me write, smart replies, the side panel, Docs, Sheets and Meet. A practice using Gmail's drafting help should also read Is Gmail HIPAA compliant?
- Gemini app on web and mobile, and the Gemini Mac app
- Gemini Enterprise and Gemini Enterprise Agent Platform
- Generative AI on Agent Platform
- Gemini Code Assist
- Gemini in BigQuery
- Gemini in Colab Enterprise
Excluded or restricted:
- Gemini in Chrome is automatically blocked for customers who have signed the BAA.
- Some Gemini app features may be blocked for BAA customers.
- Client-side encrypted email and files cannot be processed by Gemini.
- Third-party add-ons are outside the Google BAA.
Coverage is per product surface. A front-desk team using Gemini in Docs under a managed Workspace account is in a different position from a clinician pasting notes into Gemini on a personal Gmail login.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
"Not published" means absent from the pages listed under Sources. Controls of other Google products are not assumed to apply to Gemini.
How to use Gemini with PHI
- Confirm your edition lists Gemini Apps as a core service.
- Have a super administrator accept the BAA before any PHI enters Gemini. See the HIPAA glossary for the definition of a BAA.
- Use managed Workspace accounts only, never consumer accounts.
- Keep Gemini in Chrome off, and do not rely on features blocked for BAA customers.
- Do not send PHI to the Gemini API via Google AI Studio.
- Review third-party add-ons separately, each against its own BAA.
- Set a staff policy and train staff on it, for example on what may be pasted into prompts.
Compliance depends on the signed BAA, your configuration and your organization's policies.
Alternatives with a BAA
Browse HIPAA-compliant software by category for more options.
- Amazon Bedrock: yes, all AWS accounts
- Microsoft Azure: conditional
- OpenAI ChatGPT and API: conditional, ChatGPT for Healthcare
- Anthropic Claude: conditional, Claude Enterprise
- Doximity GPT: yes, Member free
Sources
- HIPAA compliance on Google Cloud and Google Workspace — Trust center, checked 2026-10-19. "Gemini App (excluding Gemini in Google Chrome) Gemini in Google Workspace Gemini Mac App"
- HIPAA compliance on Google Cloud and Google Workspace (Google Cloud supported services) — Trust center, checked 2026-10-19. "Gemini Code Assist Gemini Enterprise Gemini Enterprise Agent Platform Gemini Enterprise for Customer Experience Gemini in BigQuery Gemini in Colab Enterprise Gemini Notebook Enterprise Generative AI on Agent Platform"
- Google Workspace with Gemini FAQ — Help article, checked 2026-10-19. "Google Workspace with Gemini can support HIPAA workloads. The HIPAA Included Functionality and the Google Workspace and Cloud Identity HIPAA Implementation Guide have been updated to reflect the inclusion of Google Workspace with Gemini. The Gemini app also supports HIPAA workloads. However, some features might be blocked for customers who have signed the HIPAA Business Associate Amendment (BAA)."
- Turn the Gemini App on or off — Help article, checked 2026-10-19. "At this stage Gemini in Chrome does not support the following compliance certifications: HIPAA Business Associate Amendment (BAA) Gemini in Chrome is automatically blocked for customers who've signed a BAA."
- Turn the Gemini App on or off (Regulatory compliance table) — Help article, checked 2026-10-19. "Gemini Apps as an additional service with: Android Enterprise Cloud Identity Chrome Enterprise Essentials Starter G Suite Workspace Individual Gemini Apps as a core service with: Business Starter Essentials Enterprise Essentials Enterprise Essentials Plus Frontline Starter Frontline Standard Frontline Plus Nonprofits"
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-19. "The help me write, contextual smart replies, and side-panel features are covered as part of Google Workspace with Gemini in HIPAA Included Functionality."
- Compare Flexible Pricing Plan Options | Google Workspace — Pricing page, checked 2026-10-19. "Annual (Save 16% with 1 year commitment) All plans billed monthly, all prices €EUR Starter 30% off for 3 months help €4.76€6.80** / user per month"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Disclosure: HIPAA Compliant Wiki is published by Chanty, Inc. Placement never depends on payment.
FAQ
Is the Gemini app HIPAA compliant with a personal Google account?
No. Google offers no BAA for consumer accounts, so PHI should not be entered into the Gemini app on a personal account.
Is Gemini in Google Workspace covered by a BAA, and on which editions?
Yes, on editions where Gemini Apps is a core service, once a super administrator accepts the BAA in the Admin console. The editions are in the table above. Essentials Starter, Workspace Individual, Cloud Identity, Chrome Enterprise, G Suite and Android Enterprise are excluded.
Is the Gemini API HIPAA compliant if I use Google AI Studio?
No. The Gemini API via Google AI Studio is not on the Google Cloud BAA supported services list. Generative AI on Agent Platform is on the list, so developers handling PHI should build on that.
Can I use Gemini in Chrome with PHI after signing the BAA?
No. Gemini in Chrome is blocked automatically for customers who have signed the BAA.