Does Gemini app (personal Google account) sign a BAA?
Not confirmed
Google publishes no BAA route for the Gemini app used with a personal Google account, and it asks users not to enter confidential information that a human reviewer might see. The same app is a HIPAA-covered service only when used with a Google Workspace account under the organization's BAA (see Gemini for Google Workspace).
- Business associate
- Tool
- Gemini app (personal Google account)
- Plans with a BAA
- Not stated
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Personal Google account (free or paid Google AI subscription) | Not confirmed | Not stated | Google's HIPAA pages describe BAA coverage only for Google Workspace and Google Cloud customers. They list the Gemini App as a Workspace service but say nothing about personal accounts. The Gemini Apps Privacy Hub says a subset of chats is reviewed by humans and asks users not to enter confidential information. Google never says outright that it won't sign a BAA here, so the verdict is unknown rather than no.[1],[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Google says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Gemini app chats (web, mobile) | Not stated | With a personal account, a subset of chats goes to human reviewers after being disconnected from the account. Licensed Workspace users instead get enterprise data protections, with no human review and no model training.[1],[3] |
AI chat assistants that offer a BAA
- ChatGPTBAA on: ChatGPT FedRAMP, ChatGPT for Clinicians, ChatGPT for Healthcare, Edu, EnterpriseSome plans only
- Claude apps (Claude.ai)BAA on: Enterprise (self-serve or sales-assisted)Some plans only
- GrokBAA on: API (ZDR-enabled)Some plans only
- PerplexityBAA on: API (Sonar), Enterprise Pro / Enterprise MaxSome plans only
- BastionGPTBAA on: API, Professional, Professional Plus, Ultra (Enterprise)Signs a BAA
- CompliantChatGPTBAA on: Enterprise, Starter / Pro / FullSigns a BAA
All BAA-ready alternatives to Gemini app (personal Google account)
Sources
- Gemini Apps Privacy Hub
- HIPAA compliance on Google Cloud and Google Workspace
- Google Workspace with Gemini FAQ for Business
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.