Is Google Gemini HIPAA compliant?
Yes inside Google Workspace once an administrator has accepted the agreement: Google names the Gemini app, the Gemini Mac app and Gemini in Workspace as included functionality, and excludes Gemini in Chrome by name.
Applies to Gemini in Google Workspace. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- A super administrator must accept the agreement in the Admin console, under Account settings then Legal and compliance.
- Stay inside the named functionality: the Gemini app, the Gemini Mac app, and Gemini in Workspace. Google covers the help-me-write, contextual smart reply and side-panel features as part of Workspace with Gemini.
- Use organisational Workspace accounts. A personal Google account is not your tenant and carries none of this.
- Re-read Google's included-functionality list on a schedule. It is explicitly dated and Google revises it.
- Treat prompts as disclosures of patient information, subject to the same minimum-necessary judgement as anything else.
Does Google Gemini sign a business associate agreement?
Yes. Google offers one. Google Workspace under an accepted agreement. The included-functionality list does not enumerate eligible editions: confirm yours in the Admin console before relying on it. Super administrator → Admin console → Account settings → Legal and compliance → review and accept the agreement.
What this means in practice
Gemini is covered as part of Workspace rather than as a product you buy separately, which means the question is really whether your administrator has accepted the Workspace agreement at all. That happens once, in the Admin console under Account settings and Legal and compliance, and it covers the named Gemini functionality along with the rest of the suite.
Google is unusually specific about which Gemini is which, and the carve-out is easy to miss: the Gemini app, the Gemini Mac app and Gemini in Workspace are included functionality, and Gemini in Chrome is excluded by name. Someone using the assistant in their browser sidebar rather than inside Workspace has stepped outside it without doing anything that felt different.
The list is dated, the current one is stamped 14 May 2026, and Google revises it as features ship. That date is the useful habit: check it on a schedule rather than assuming a position established last year still holds.
How organizations get this wrong
- Using Gemini in Chrome for something clinical, which Google excludes by name while the identical-looking in-Workspace features are covered.
- Assuming the agreement was accepted because Workspace is paid for: acceptance is a separate act by a super administrator.
- Reading a Workspace agreement as covering Gemini Enterprise or Vertex AI, which sit under the separate Google Cloud agreement.
- Connecting third-party add-ons to Workspace and expecting the agreement to follow, when Google states add-ons are not included.
What the agreement does not cover
- Gemini in Chrome, which Google excludes by name from included functionality.
- Third-party applications and add-ons, which Google states are not included.
- Additional Google Services, which the agreement does not extend to.
Alternatives
The equivalent assistant inside Microsoft 365, covered by default through the Product Terms
The other mainstream assistant with a published position on patient data
Keep a record of your Google Gemini agreement
Sources
- HIPAA Included Functionality: Google. Published May 14, 2026. Read August 10, 2026.
- HIPAA compliance with Google Workspace and Cloud Identity: Google. Read August 10, 2026.
Google can change these terms at any time. If something here no longer matches what Google tells you, tell us.