Is Gemini HIPAA Compliant? Workspace Yes, Free App No, and Gemini Notebook Isn't Covered (2026)

TL;DR: It depends which Gemini. As of November 2026, Gemini in Google Workspace (Gmail, Docs, Sheets, Meet) and the Gemini app used with a Workspace account are covered by Google's HIPAA Business Associate Agreement (BAA), once your admin accepts it. The free Gemini app on a personal Google account is not covered, and Google says some of those chats are read by human reviewers. Gemini Notebook (NotebookLM until July 2026) and Gemini in Chrome are outside the BAA. Developers get coverage through Google Cloud, not Google AI Studio.

Google sells at least five things called Gemini, and they don't share one answer. The person at your front desk doesn't know which one they opened. That's the actual risk for a small practice, more than the contract.

Four Geminis, four different answers

No AI model is HIPAA compliant by itself. What matters is whether the exact product you use is covered by a signed BAA. I compare the big four vendors on that in HIPAA compliant AI. Here's the Google row, broken out:

Gemini in Google Workspace: covered under the BAA you already accept

If your practice runs on Workspace, Gemini doesn't need its own contract. Google's covered list names "Gemini in Google Workspace," the "Gemini App (excluding Gemini in Google Chrome)" and the "Gemini Mac App." Google's HIPAA help page says help me write, smart replies and the side panel are covered as part of Workspace with Gemini. The BAA itself is the Workspace one, accepted in the Admin console. Editions, covered apps and the general setup are in is Google Workspace HIPAA compliant.

Google's data promises for the Workspace version are the part practice owners care about. From its Workspace privacy hub: in the Gemini app, "Your chats and uploaded files won't be reviewed by human reviewers," and "Workspace does not use customer data for training models without customer's prior permission or instruction."

One catch Google mentions in its FAQ: the Gemini app "also supports HIPAA workloads," but "some features might be blocked for customers who have signed the" BAA. Google doesn't list which ones. If a staff member says a Gemini feature disappeared after you signed, that's probably why, and it's working as intended.

The free Gemini app on a personal account: not covered

This is the one that actually gets used. Someone opens gemini.google.com on their phone, signed in to their personal Google account, and pastes in a referral letter to summarize. There's no BAA on a personal account, and Google's consumer privacy hub says:

• "A subset of chats are reviewed by human reviewers," and reviewed chats are kept for up to three years.
• With Keep Activity off, chats are still kept for 72 hours.
• If Keep Activity is on, don't "enter data that's confidential or that you wouldn't want a reviewer to see."

Paying for a personal Google AI plan doesn't change this. It's still a consumer account. What's free and what's paid on the consumer side is mapped in is Gemini free. For a practice, the rule is simple: Gemini with patient data only while signed in to the work account.

Gemini Notebook (formerly NotebookLM): Google says it isn't covered

Google renamed NotebookLM to Gemini Notebook on July 16, 2026. It's a great tool for summarizing a stack of documents, which is exactly why staff will try it on charts. Google's Workspace privacy hub is direct: Gemini Notebook "is not covered by the Google Business Associate Agreement (BAA) for HIPAA compliance." It's also missing from Google's covered list.

Google's Cloud list does include something called Gemini Notebook Enterprise, which runs under Google Cloud terms, not Workspace. Google doesn't say on that list how it relates to the Workspace product, so don't assume one covers the other. For a Workspace practice, turn Gemini Notebook off for anyone who handles PHI.

Gemini in Chrome: same assistant, different answer

Google's FAQ lists Gemini in Chrome as one of the places the Gemini app shows up. Google's HIPAA list covers the Gemini app "excluding Gemini in Google Chrome." So the same assistant is covered in a browser tab at gemini.google.com and not covered in the Chrome side panel. If your staff use Chrome on work machines, ask whoever manages those browsers to turn Gemini in Chrome off for the PHI group, and tell staff why.

The Gemini API: AI Studio isn't the HIPAA path, Google Cloud is

If you or a developer are building something with Gemini, like an intake summarizer, the terms change again. Google AI Studio's API terms don't mention HIPAA at all. On the unpaid tier they say "Do not submit sensitive, confidential, or personal information," and "human reviewers may read, annotate, and process your API input and output." The terms also say you "may not use the Services in clinical practice, to provide medical advice." Paid API traffic isn't used to improve Google's products, but that's a data promise, not a BAA. Token costs for the API are in Gemini API pricing.

The covered path for developers is Google Cloud. Google's HIPAA list for Cloud names "Gemini Enterprise," "Gemini Enterprise Agent Platform" and "Generative AI on Agent Platform." Agent Platform is what Google introduced in April 2026 as the evolution of Vertex AI, so older guides that say "use Vertex AI" are pointing at the same place under its old name. That needs a Google Cloud BAA and a project set up for it. It's not a self-serve afternoon for a 10-person practice.

Gemini settings to change in a small practice

1. Confirm the Workspace BAA is accepted. Account settings, then Legal and compliance. Without it, none of the Workspace Gemini coverage applies.
2. Decide who gets the Gemini app. Google turns it on by default as a core service. Keep it on for staff you've trained, and make sure they sign in with their work account.
3. Turn off Gemini Notebook for the PHI group. Admin console, then Generative AI, then Gemini Notebook, then Service status. Set it Off for that organizational unit or access group.
4. Turn off Gemini in Chrome on work browsers for the same group.
5. Set conversation history to auto-delete. Generative AI, then Gemini for Workspace, then Conversation history and deletion. Google offers 3, 18 or 36 months, and stores chats with no end date if you don't set it. Vault retention rules override this if you use Vault.
6. Keep Gemini away from add-ons. Third-party Workspace add-ons aren't covered by the BAA, whether or not Gemini touches them.
7. Write one rule for staff: patient details go into Gemini only in Gmail, Docs, Sheets or the Gemini app while signed in to the work account. Never a personal account, never Gemini Notebook.

This is a technology explainer, not legal advice. Take this list to your compliance counsel along with your risk analysis. If you want help setting up Gemini for a practice, choosing which tasks it should do and which it shouldn't, see my AI consulting for healthcare practices.

Sources

• Google Cloud, HIPAA compliance on Google Cloud and Google Workspace: Workspace supported services (updated October 28, 2026) and Google Cloud supported services. Read November 8, 2026.
• Generative AI in Google Workspace Privacy Hub (updated October 26, 2026): no human review or training, Gemini Notebook not covered by the BAA, Gemini app on by default, history auto-delete. Read November 8, 2026.
• Google Workspace with Gemini FAQ for Business (updated October 28, 2026): Gemini app supports HIPAA workloads, some features blocked after the BAA, Gemini in Chrome as an app surface. Read November 8, 2026.
• Google Workspace Admin Help, HIPAA Compliance with Google Workspace and Cloud Identity (updated October 26, 2026). Read November 8, 2026.
• Gemini Apps Privacy Hub (privacy notice dated October 13, 2026): human review, 3-year and 72-hour retention. Read November 8, 2026.
• Gemini API Additional Terms of Service (effective March 23, 2026). Read November 8, 2026.
• Google, Gemini Enterprise Agent Platform (April 22, 2026). Read November 8, 2026.
• Google Workspace Updates, NotebookLM is now Gemini Notebook (July 16, 2026). Read November 8, 2026.
• Turn Gemini Notebook on or off for users and Manage Gemini in Workspace conversation history settings. Read November 8, 2026.