Microsoft 365 Copilot vs Gemini for Google Workspace: which signs a HIPAA BAA?
Both can be covered by a BAA, on different terms. Microsoft signs a BAA for Microsoft 365 Copilot on every plan we list. Google signs a BAA for Gemini for Google Workspace on every plan we list.
- Business associate
- Microsoft
- Tool
- Microsoft 365 Copilot
- Plans with a BAA
- Microsoft 365 commercial (Microsoft 365 Copilot license); Microsoft 365 Copilot Chat (free with eligible work/school Entra accounts); Office 365 GCC
- Checked
- Business associate
- Tool
- Gemini for Google Workspace
- Plans with a BAA
- Google Workspace (editions that include Gemini), BAA accepted by admin
- Checked
Gemini for Google Workspace: plan-by-plan breakdown and sources
Side by side
| Microsoft 365 CopilotMicrosoft | Gemini for Google WorkspaceGoogle | |
|---|---|---|
| BAA | Signs a BAA | Signs a BAA |
| Plans with a BAA | Microsoft 365 commercial (Microsoft 365 Copilot license); Microsoft 365 Copilot Chat (free with eligible work/school Entra accounts); Office 365 GCC | Google Workspace (editions that include Gemini), BAA accepted by admin |
| How to get it | Included in the terms | Accept or sign online |
| AI features outside the BAA partly covered excluded |
|
|
| Sources | 5 sources | 4 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
Microsoft 365 Copilot
- Microsoft 365 commercial (Microsoft 365 Copilot license)The BAA comes by default through the Microsoft Online Services DPA for customers that are covered entities or business associates. The Commercial in-scope table lists 'Microsoft Copilot' and 'Microsoft Copilot Chat'. The HIPAA page does not use the exact name 'Microsoft 365 Copilot', but Microsoft's EDP page says Microsoft Copilot and Copilot Chat support HIPAA compliance when properly configured.Signs a BAA
- Microsoft 365 Copilot Chat (free with eligible work/school Entra accounts)Copilot Chat is named in the Commercial and GCC in-scope lists. Enterprise data protection under the DPA and Product Terms applies to prompts and responses for eligible work and school accounts.Signs a BAA
- Office 365 GCCThe GCC in-scope table lists Microsoft Copilot and Microsoft Copilot Chat. The HIPAA page gives no in-scope service table for GCC High or DoD.Signs a BAA
Gemini for Google Workspace
- Google Workspace (editions that include Gemini), BAA accepted by adminA super admin reviews and accepts the BAA under Admin console > Account settings > Legal and compliance. Only services on the HIPAA Included Functionality list are covered. The pages checked do not say which editions are eligible.Signs a BAA
- Personal Google account / consumer Google AI plansGoogle describes BAA acceptance only for Workspace admins in the Admin console. The pages checked describe no BAA route for personal accounts.Not confirmed
If you handle patient data
Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information. Keep PHI out of the AI features listed as outside the BAA.
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.