BAA guide
Is Gemini HIPAA compliant?
Plan by plan, from Gemini's own pages.
Only on a plan where the vendor signs a BAA. Gemini is not HIPAA compliant on its own. Gemini in Google Workspace: Only for a Google Workspace organization whose administrator has reviewed and accepted the Google Workspace BAA. Gemini app with a Google Workspace work or school account: Only for a Google Workspace organization whose administrator has accepted the Google Workspace BAA, and Gemini in Google Chrome is excluded. Gemini in Chrome: no BAA. Gemini Enterprise (Google Cloud): Only after the customer reviews and accepts a Google Cloud BAA.
Checked against Gemini's own pages, linked in the table.
Which Gemini plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| Gemini in Google Workspace | BAA only if the condition is met | Only for a Google Workspace organization whose administrator has reviewed and accepted the Google Workspace BAA. | The following Google Workspace services are included in the Google Cloud BAA: AppSheet Cloud Identity Management Gemini App (excluding Gemini in Google Chrome) Gemini in Google Workspace Gemini Mac Appdocs.cloud.google.com |
| Gemini app with a Google Workspace work or school account | BAA only if the condition is met | Only for a Google Workspace organization whose administrator has accepted the Google Workspace BAA, and Gemini in Google Chrome is excluded. | The following Google Workspace services are included in the Google Cloud BAA: AppSheet Cloud Identity Management Gemini App (excluding Gemini in Google Chrome) Gemini in Google Workspace Gemini Mac Appdocs.cloud.google.com |
| Gemini in Chrome | No BAA | None | Gemini in Chrome is pending HIPAA, SOC, ISO and other compliance certificationssupport.google.com |
| Gemini Enterprise (Google Cloud) | BAA only if the condition is met | Only after the customer reviews and accepts a Google Cloud BAA. | The Google Cloud BAA includes Google Cloud's entire infrastructure (all regions, all zones, all network paths, all points of presence), and the following products: ... Gemini Enterprisedocs.cloud.google.com |
Training, retention, and access logs
- Model training
- Per Google, Google Workspace does not use customer data, including Gemini prompts, to train models without the customer's prior permission or instruction.
- Retention
- Per Google, Workspace administrators control Gemini conversation history and can set automated retention periods or retain conversations indefinitely.
- Access logs
- Per Google, Google Workspace gives admins audit logs that track user activity and interactions with Gemini in the Gemini app and Workspace apps.
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Does Google sign a BAA for Gemini?
Yes, for Gemini used through Google Workspace. Google lists Gemini in Google Workspace and the Gemini app, excluding Gemini in Google Chrome, among the Google Workspace services included in the BAA. Gemini Enterprise is covered under a Google Cloud BAA.
Is Gemini in Chrome covered?
No. Google excludes Gemini in Google Chrome from the Gemini app entry on its HIPAA list and says Gemini in Chrome is pending HIPAA and other compliance certifications.
Which Gemini should a healthcare team use with patient data?
Gemini in Google Workspace or the Gemini app signed in with a Google Workspace work account, in an organization whose administrator has accepted the Google Workspace BAA. Rivvi is an AI workspace for healthcare teams. Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA.
Free to start. Most teams are using it the same day.
Get started for free