Is Google Gemini HIPAA compliant?
Yes inside Google Workspace once an administrator has accepted the agreement — Google names the Gemini app, the Gemini Mac app and Gemini in Workspace as included functionality, and excludes Gemini in Chrome by name.
Applies to Gemini in Google Workspace. Last reviewed against Google's own documentation. Next review November 4, 2026.
Reviewed by Lisa Tran, CISSP — Healthcare Information Security Executive.
What you must do
- A super administrator must accept the agreement in the Admin console, under Account settings then Legal and compliance.
- Stay inside the named functionality: the Gemini app, the Gemini Mac app, and Gemini in Workspace. Google covers the help-me-write, contextual smart reply and side-panel features as part of Workspace with Gemini.
- Use organisational Workspace accounts. A personal Google account is not your tenant and carries none of this.
- Re-read Google's included-functionality list on a schedule. It is explicitly dated and Google revises it.
- Treat prompts as disclosures of patient information, subject to the same minimum-necessary judgement as anything else.
Does Google Gemini sign a business associate agreement?
Yes. Google offers one. Google Workspace under an accepted agreement. The included-functionality list does not enumerate eligible editions — confirm yours in the Admin console before relying on it. Super administrator → Admin console → Account settings → Legal and compliance → review and accept the agreement.
What this means in practice
Gemini is covered as part of Workspace rather than as a product you buy separately, which means the question is really whether your administrator has accepted the Workspace agreement at all. That happens once, in the Admin console under Account settings and Legal and compliance, and it covers the named Gemini functionality along with the rest of the suite.
Google is unusually specific about which Gemini is which, and the carve-out is easy to miss: the Gemini app, the Gemini Mac app and Gemini in Workspace are included functionality, and Gemini in Chrome is excluded by name. Someone using the assistant in their browser sidebar rather than inside Workspace has stepped outside it without doing anything that felt different.
The list is dated — the current one is stamped 14 May 2026 — and Google revises it as features ship. That date is the useful habit: check it on a schedule rather than assuming a position established last year still holds.
How organizations get this wrong
The specific mistakes we see with Google Gemini, not generic advice.
- Using Gemini in Chrome for something clinical, which Google excludes by name while the identical-looking in-Workspace features are covered.
- Assuming the agreement was accepted because Workspace is paid for — acceptance is a separate act by a super administrator.
- Reading a Workspace agreement as covering Gemini Enterprise or Vertex AI, which sit under the separate Google Cloud agreement.
- Connecting third-party add-ons to Workspace and expecting the agreement to follow, when Google states add-ons are not included.
What the agreement does not cover
- Gemini in Chrome, which Google excludes by name from included functionality.
- Third-party applications and add-ons, which Google states are not included.
- Additional Google Services, which the agreement does not extend to.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
The equivalent assistant inside Microsoft 365, covered by default through the Product Terms
The other mainstream assistant with a published position on patient data
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Google Gemini, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Google’s own published documentation, read on the date shown.
- HIPAA Included Functionality — Google. Published May 14, 2026. Read August 10, 2026.
- HIPAA compliance with Google Workspace and Cloud Identity — Google. No publication date given. Read August 10, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Google’s published documentation as read on August 10, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.