Is Google Gemini HIPAA Compliant? Workspace, Vertex AI, and the Free App

Short answer: it depends on which Gemini. The free Gemini app at gemini.google.com, signed in with a personal Gmail account, is not covered by a Business Associate Agreement and should never see patient data. Gemini inside a business Google Workspace account, and Gemini models on Google Cloud's Vertex AI, can be covered by Google's BAA when the practice has signed it and configured things correctly.

The three Geminis

• Free Gemini app (personal Google account): no BAA. Not for PHI.
• Gemini in Google Workspace (Gmail, Docs, Drive) on a business plan: Google's Workspace BAA can cover it, but only for the services Google lists as covered and only after your admin accepts the BAA. Check Google's current "HIPAA included functionality" list before relying on it.
• Gemini on Vertex AI (Google Cloud): HIPAA-eligible under Google Cloud's BAA. This is the developer route: you build your own app on top of it.

What HIPAA actually requires

Under HIPAA, a medical practice can only hand protected health information (PHI) to a vendor that has signed a Business Associate Agreement (BAA). A BAA is the contract where the vendor promises to protect PHI, report breaches, and accept HIPAA obligations. Two details trip practices up: the BAA has to cover the exact product and plan you use, and it does not make you compliant by itself. You still need the right settings, access controls, and staff habits.

Where practices get caught

The most common mistake is not the model. It is the account. A front-desk employee uses their personal Gmail on their phone, opens the Gemini app, and asks it to "summarize this patient's message." That one paste is outside any BAA. The second mistake is assuming that because the practice has Workspace, every Google AI feature is approved. Coverage is per service and per configuration.

Gemini helps you write. It does not run the front desk.

Even fully covered, Gemini in Workspace drafts emails and summarizes documents. It does not answer the phone at 9pm, book the visit in your EHR, verify insurance, send the prescription, or chase the denied claim. For that you need an agent that works inside your systems.

What PhiClaw does differently

PhiClaw is a HIPAA AI employee for medical practices. It signs a BAA with every practice on every plan, before any patient data moves. It answers patients on the phone, WhatsApp, iMessage, the web, and its iOS and Android apps, books and reschedules visits in your EHR, runs intake, scribes the SOAP note, handles e-prescribing (including controlled substances), billing, fax, and even your website and social posts. It works with 30+ major EHRs directly and 300+ more through Keragon, or ships its own HIPAA EHR and CRM.

PhiClaw is priced at $1,500 a month flat (4,320 questions/tasks included, unlimited users and locations, month-to-month), with a BAA on every plan.

Frequently asked questions

Is the Gemini app HIPAA compliant?

Not on a personal Google account. The consumer Gemini app has no BAA, so do not enter PHI. Business Workspace accounts are a different story and depend on Google's covered-services list and your BAA.

Does Google sign a BAA for Gemini?

Google offers BAAs for Google Workspace and Google Cloud. Gemini features can fall under them when they are on Google's list of covered services and your organization has accepted the BAA.

Is Gemini on Vertex AI HIPAA eligible?

Yes, Vertex AI is HIPAA-eligible under the Google Cloud BAA. You are still responsible for building and securing the application around it.

Can my staff use Gemini in Gmail for patient emails?

Only on a business Workspace account where the BAA is in place and the feature is covered. Never on personal Gmail.

Why choose PhiClaw over Gemini?

Gemini helps staff write and summarize. PhiClaw does the work: it answers calls and messages, books visits in your EHR, scribes notes, e-prescribes, and bills, with a BAA signed on every plan.