Last verified: October 2026, against Google's HIPAA documentation and Workspace Help. General information, not legal advice — confirm with your compliance officer or attorney.
Is Gemini HIPAA compliant? It depends on which Gemini you mean. Gemini inside a Google Workspace account that has accepted Google's business associate agreement (BAA) can be used with patient information. The free Gemini app on a personal Google account cannot, and a few in-between versions are easy to miss.
Short answer (dated) from Google's HIPAA documentation
Short answer (verified October 2026): Google's HIPAA included functionality list (opens in a new tab) names "Gemini App (excluding Gemini in Google Chrome)" and "Gemini in Google Workspace" among the Workspace services in its BAA. Google's Workspace HIPAA help page (opens in a new tab) says administrators "must review and accept a BAA before using PHI in Google services." The implementation guide (opens in a new tab) adds that the Gemini app offered as an Additional Product "is not HIPAA compliant." Personal Google accounts have no BAA.
So: Gemini in a Workspace account under a BAA is usable with protected health information (PHI), once configured. Gemini in Chrome, Gemini for users without a qualifying license, and any personal account are not.
Gemini app, Gemini in Workspace and Gemini on Google Cloud
| Version | Where staff see it | Under Google's BAA? |
|---|---|---|
| Gemini app on a personal Google account | gemini.google.com, phone app | No |
| Gemini app as a Workspace core service | gemini.google.com signed in with a practice account | Yes, once configured |
| Gemini app as an additional service | Same, for users without a qualifying edition | No |
| Gemini in Workspace | Side panel and "Help me write" in Gmail, Docs, Drive | Yes, once configured |
| Gemini in Chrome | Browser assistant | No |
| Gemini on Google Cloud | Developer services | Separate Cloud list |
The consumer app is a different product with different rules. Google's Gemini Apps Privacy Hub (opens in a new tab) says "a subset of chats are reviewed by human reviewers," keeps reviewed chats for up to three years, and asks people not to enter confidential information they wouldn't want a reviewer to see.
On Google Cloud, the list includes Gemini Enterprise and Generative AI on Agent Platform. That matters only if a developer is building something custom for you.
How to check Google's HIPAA included functionality list
The list is the contract, not the marketing page. Three things to look for:
- The exact product name. "Gemini App (excluding Gemini in Google Chrome)", "Gemini in Google Workspace" and "Gemini Mac App" appear. NotebookLM does not.
- The parentheses. Exclusions hide there, such as the Chrome exclusion, or Google Voice for managed users only.
- The date. The Workspace section of the list was last updated August 31, 2025. Re-check it when Google ships a new AI feature.
Google's BAA itself says it does not apply to "any other Google product, service, or feature that is not a Covered Service" (BAA text (opens in a new tab)). Third-party add-ons are also outside it. For the acceptance steps, follow our Google Workspace BAA setup guide; the BAA basics are in business associate agreements.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Admin settings to review before staff use Gemini
Google's Gemini app admin article (opens in a new tab) puts the controls under Generative AI > Gemini app in the Admin console. They require the Gemini settings administrator privilege.
- Service status. On or off for everyone, or by organizational unit or group. Group settings override organizational units.
- The license checkbox. "Allow all users to access the Gemini app, regardless of license" lets unlicensed users in as an additional service. Google says those chats "may be reviewed by human reviewers," so leave it unchecked in a practice.
- Gemini in Chrome. Google says it "is automatically blocked for customers who've signed a BAA." Confirm it is blocked in your console.
- Conversation history. Admins set retention for Gemini prompts and responses, from 90 days to indefinite, per Google's Workspace privacy hub (opens in a new tab).
Run a free marketing audit if you want a separate check on the public side of your practice: website, listings and ad tracking.
Gemini inside Gmail, Docs and Drive: where PHI already lives
Gemini in Workspace works on content that already exists. Google says Gemini "only retrieves relevant content in Workspace that the user has access to," across Gmail, Drive, Calendar and Chat. It also says that content is not human reviewed or used to train models outside your domain without permission.
That makes permissions the real risk. If the front-desk account can open a shared folder of scanned referrals, Gemini can summarize them for whoever is signed in. Before switching Gemini on:
- Review who can open shared drives with intake scans, EOBs (explanation of benefits forms) or referral letters.
- Keep PHI out of file and folder names, as Google's implementation guide recommends.
- Confirm the inboxes that receive patient email are covered; see Gmail and HIPAA.
Safe and unsafe uses in a practice
| Use | Verdict |
|---|---|
| Summarizing your internal HIPAA policy doc in Workspace under a BAA | Safe |
| Drafting a job post for a medical assistant | Safe on any account |
| "Help me write" a reply to a patient email, Workspace under a BAA | Allowed; send only after staff review |
| Summarizing a patient email thread in an account without a BAA | Unsafe |
| Pasting lab results into the Gemini app on a personal phone | Unsafe |
| Asking Gemini in Chrome about a patient portal page | Unsafe |
For comparison, see ChatGPT and HIPAA, Copilot and HIPAA and the vendor-neutral checks in HIPAA-compliant AI. Patient data that comes in through Medfy's website forms stays in separate, encrypted regional databases under the practice's BAA; see how Medfy handles patient data.
Frequently asked questions
Is Gemini covered by the Google Workspace BAA?
Partly. Gemini in Workspace and the Gemini app used as a Workspace core service are on Google's HIPAA included functionality list, so they are covered once your organization has accepted the BAA and configured them. Gemini in Chrome and the Gemini app offered as an additional service are not covered, and NotebookLM isn't on the list. Confirm your setup with your compliance officer or attorney.
Can I use the free Gemini app with patient information?
No. A personal Google account has no BAA with Google. Google's own privacy hub says a subset of chats are read by human reviewers, asks users not to enter confidential information they wouldn't want a reviewer to see, and keeps reviewed chats for up to three years. Keep personal accounts away from all practice work, not only from patient details.
Does Gemini read my practice's Gmail?
Only when a user asks it to, and only what that user can already open. Google says Gemini retrieves relevant Workspace content the user has access to, and that the content isn't human reviewed or used to train models outside your domain without permission. Admins can turn Gemini features in Gmail and Drive on or off for the whole practice or for specific groups.
Who in the practice should turn Gemini on or off?
A Google Workspace administrator with the Gemini settings privilege. In a small practice that is usually the owner, the office manager or an outside IT contractor. Make the decision with your privacy officer, document which staff groups get access, and confirm the BAA was accepted in the Admin console before anyone uses Gemini with patient information.