Gemini Code Assist vs GitHub Copilot: which signs a HIPAA BAA?
Only Gemini Code Assist offers a BAA. Google Cloud signs one for Gemini Code Assist only on Standard / Enterprise (Google Cloud). GitHub doesn't offer a BAA for GitHub Copilot.
- Business associate
- Google Cloud
- Tool
- Gemini Code Assist
- Plans with a BAA
- Standard / Enterprise (Google Cloud)
- Checked
Some plans only
- Business associate
- GitHub
- Tool
- GitHub Copilot
- Plans with a BAA
- None
- Checked
No BAA
Side by side
| Gemini Code AssistGoogle Cloud | GitHub CopilotGitHub | |
|---|---|---|
| BAA | Some plans only | No BAA |
| Plans with a BAA | Standard / Enterprise (Google Cloud) | None |
| How to get it | Accept or sign online | — |
| AI features outside the BAA partly covered excluded |
| None listed |
| Sources | 6 sources | 5 sources |
| Last checked | Oct 13, 2026 | Oct 11, 2026 |
Plan by plan
Gemini Code Assist
- Standard / Enterprise (Google Cloud)Gemini Code Assist is on Google Cloud's HIPAA supported-services list with no footnote. The Google Cloud BAA takes effect when the customer clicks to accept it, requires an existing Google Cloud services agreement, and covers only listed services. Google's certifications page marks the product HIPAA compliant.Signs a BAA
- Gemini Code Assist on GitHubGoogle's certifications page says the certifications, HIPAA included, do not apply to Gemini Code Assist on GitHub. The consumer version of the GitHub app is deprecated.No BAA
- Gemini Code Assist for individuals (discontinued)Google stopped serving IDE requests for the free individual tier and Google AI Pro and Ultra on June 18, 2026. Google published no BAA route for these consumer tiers.Not confirmed
GitHub Copilot
- Copilot Business / Copilot Enterprise (governed by the GitHub DPA)Section 12 of the GitHub DPA (October 2025) bars customers from giving GitHub HIPAA protected health information unless GitHub gives prior, written, specific consent. GitHub publishes no BAA or way to request one. Microsoft's HIPAA BAA in-scope service list does not include GitHub, so Microsoft's BAA does not cover Copilot.No BAA
- Copilot Free / Pro / Pro+ (individual accounts)The GitHub Terms of Service do not mention HIPAA, PHI or BAAs, and no BAA offering for individual plans was found. GitHub does not say whether the DPA's PHI restriction applies to these plans.Not confirmed
If you handle patient data
Use Gemini Code Assist on a plan listed above, and sign the BAA before anyone enters protected health information. Don't put PHI into GitHub Copilot. Other GitHub Copilot alternatives that sign a BAA
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.