Azure OpenAI vs Google Cloud Vertex AI: which signs a HIPAA BAA?
Only Google Cloud Vertex AI offers a BAA. We couldn't confirm a BAA for Azure OpenAI from Microsoft's own pages. Google Cloud signs a BAA for Google Cloud Vertex AI on every plan we list.
- Business associate
- Microsoft
- Tool
- Azure OpenAI / Microsoft Foundry (Azure AI Foundry)
- Plans with a BAA
- Not stated
- Checked
- Business associate
- Google Cloud
- Tool
- Google Cloud Vertex AI (Gemini Enterprise Agent Platform)
- Plans with a BAA
- Google Cloud customers (Agent Platform / Vertex AI, GA services)
- Checked
Side by side
| Azure OpenAIMicrosoft | Google Cloud Vertex AIGoogle Cloud | |
|---|---|---|
| BAA | Not confirmed | Signs a BAA |
| Plans with a BAA | Not stated | Google Cloud customers (Agent Platform / Vertex AI, GA services) |
| How to get it | — | Accept or sign online |
| AI features outside the BAA partly covered excluded | None listed |
|
| Sources | 8 sources | 5 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
Azure OpenAI
- Azure subscription (EA / MCA / CSP), Models sold by Azure incl. Azure OpenAIThe Microsoft BAA comes by default through the Product Terms and DPA, with no separate signature, but only for in-scope Azure services. Whether Azure OpenAI / Foundry Models sold by Azure are in scope could not be confirmed from an official page. Microsoft Q&A moderators (not official documentation) give conflicting answers.Not confirmed
- Foundry Models from partners and community (serverless / Marketplace)Microsoft treats these as Non-Microsoft Products governed by each provider's terms and billed through Azure Marketplace. No official HIPAA statement for them was found.Not confirmed
Google Cloud Vertex AI
- Google Cloud customers (Agent Platform / Vertex AI, GA services)Accept the BAA on the IAM & Admin privacy page of any one project. You need an existing Services Agreement. The click-through BAA does not apply to purchases through an unaffiliated reseller or to offline agreement variants. Use only listed Covered Services with PHI.Signs a BAA
If you handle patient data
Use Google Cloud Vertex AI on a plan listed above, and sign the BAA before anyone enters protected health information. Don't put PHI into Azure OpenAI unless Microsoft gives you a BAA in writing. Other Azure OpenAI alternatives that sign a BAA
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.