Skip to main content
BAA Directory

Is Gemini HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, for the Gemini app and Gemini in Workspace used through a Google Workspace account, under Google's Workspace BAA. Google says Gemini in Chrome and Gemini Notebook are not covered, and the Gemini app as an Additional Product is not HIPAA compliant.

AI assistants. Checked on the vendor's own pages on .

Using Gemini on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Google says

“When using the Gemini app as a Google Workspace Core Service via gemini.google.com or mobile application with PHI within the applicable HIPAA Included Functionality, the same recommendations provided in this guide will apply.”

Source: Google Workspace and Cloud Identity HIPAA Implementation Guide (PDF), checked .

“Access to Gemini app as an Additional Product is not HIPAA compliant and customers should not upload PHI into the Gemini app in this scenario.”

Source: Google Workspace and Cloud Identity HIPAA Implementation Guide (PDF), checked .

“Gemini can support HIPAA workloads.”

Source: Google Workspace Admin Help, Generative AI in Google Workspace Privacy Hub, checked .

What the BAA covers and excludes

Covers, in Google's words:

Excludes or limits, in Google's words:

  • "No. At this stage Gemini Notebook does not support ISO, SOC, or FedRAMP compliance and is not covered by the Google Business Associate Agreement (BAA) for HIPAA compliance." (Google Workspace Admin Help, Generative AI in Google Workspace Privacy Hub)
  • "No. At this stage Gemini in Chrome does not support ISO, SOC, or FedRAMP compliance and is not covered by the Google Business Associate Agreement (BAA) for HIPAA compliance." (Google Workspace Admin Help, Generative AI in Google Workspace Privacy Hub)
  • For personal accounts, Google's Gemini Apps Privacy Hub says: "Please don’t enter confidential information that you wouldn’t want a reviewer to see or Google to use to improve our services, including machine-learning technologies." It adds: "If you have a work or school Google Account, your use of Gemini Apps may be subject to different data handling terms." (Gemini Apps Privacy Hub)

What this means for ad tracking

Marketing teams use Gemini to summarize campaign exports, call notes and lead lists. Whatever goes into a prompt is shared with Google.

Under a Workspace BAA, the Gemini app as a Workspace Core Service and Gemini in Workspace are covered. On a personal Google account, in Gemini in Chrome or in Gemini Notebook, keep patient details out. Campaign and conversion data that carries no health information is the safer input either way.

Curve Compliance gives your team conversion data to work from that has been checked for PHI-like patterns and sent server-side under a BAA Curve signs on every plan. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve checks every conversion event for PHI-like patterns before it goes out, so the conversion data your team works from is not a set of patient records.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • A fixed field list per platform, so each ad platform receives only the fields set for it.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • When identifiers are enabled, Curve hashes them with SHA-256.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Gemini HIPAA compliant?

Yes, for the Gemini app and Gemini in Workspace used through a Google Workspace account, under Google's Workspace BAA. Google says Gemini in Chrome and Gemini Notebook are not covered, and the Gemini app as an Additional Product is not HIPAA compliant. With a signed BAA, Gemini can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Gemini sign a BAA?

Yes, for the Gemini app and Gemini in Workspace used through a Google Workspace account, under Google's Workspace BAA. Google says Gemini in Chrome and Gemini Notebook are not covered, and the Gemini app as an Additional Product is not HIPAA compliant. In Google's words: “When using the Gemini app as a Google Workspace Core Service via gemini.google.com or mobile application with PHI within the applicable HIPAA Included Functionality, the same recommendations provided in this guide will apply.” We checked Google's own pages on October 5, 2026.

Is the Gemini app on a personal Google account covered by a BAA?

No. Google's BAA covers the Gemini app as a Google Workspace Core Service, used through a Workspace account whose administrator has accepted the BAA. Google says access to the Gemini app as an Additional Product is not HIPAA compliant, and its Gemini Apps Privacy Hub asks people not to enter confidential information they would not want a reviewer to see. Keep PHI out of Gemini on a personal Google account.

Should I paste patient data into Gemini to analyze campaigns?

Only under a Google Workspace BAA, in the Gemini app as a Workspace Core Service or Gemini in Workspace. Otherwise, work from conversion data without health information. Curve checks every conversion event for PHI-like patterns before it goes to your ad platforms.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Google before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call