Does Google Cloud Vertex AI (Gemini Enterprise Agent Platform) sign a BAA?
Yes, it signs a BAA
Google Cloud's BAA covers 'Gemini Enterprise Agent Platform' and 'Generative AI on Gemini Enterprise Agent Platform', the platform Vertex AI became part of in April 2026. Customers accept the BAA themselves in the Cloud console. Pre-GA offerings must not be used with PHI.
Not fully covered by the BAA: Conversational Agents; Pre-GA (preview) models and features.
- Business associate
- Google Cloud
- Tool
- Google Cloud Vertex AI (Gemini Enterprise Agent Platform)
- Plans with a BAA
- Google Cloud customers (Agent Platform / Vertex AI, GA services)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Google Cloud customers (Agent Platform / Vertex AI, GA services) | Signs a BAA | Accept or sign online | Accept the BAA on the IAM & Admin privacy page of any one project. You need an existing Services Agreement. The click-through BAA does not apply to purchases through an unaffiliated reseller or to offline agreement variants. Use only listed Covered Services with PHI.[1],[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Google Cloud says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Generative AI on Gemini Enterprise Agent Platform (Gemini models) | Covered | Named on the HIPAA covered-products list.[1],[4] |
| Agent Search on Gemini Enterprise Agent Platform | Covered | Covered. Google says to use regional APIs and resource locations for PHI.[1] |
| Conversational Agents | Partly covered | Covered, but PHI must be kept out of agent definitions (intents, training phrases, entities).[1] |
| Vertex AI Workbench instances, Colab Enterprise, Model Armor | Covered | Named on the covered-products list.[1] |
| Pre-GA (preview) models and features | Excluded | Google says not to use Pre-GA offerings with PHI unless the offering's terms expressly allow it.[1] |
| Third-party / partner models (e.g., Anthropic Claude, open models in Model Garden) | Not stated | Google's HIPAA page does not address partner models. Anthropic says its own BAA does not cover Claude via Google Cloud's Agent Platform and points to Google's compliance docs.[1],[5] |
| Grounding with Google Search | Not stated | Not mentioned on the HIPAA page or the covered-products list.[1] |
Compare Google Cloud Vertex AI (Gemini Enterprise Agent Platform)
- Amazon Bedrock vs Google Cloud Vertex AIAmazon Bedrock: signs a BAA
- Azure OpenAI vs Google Cloud Vertex AIAzure OpenAI: not confirmed
Sources
- HIPAA Compliance on Google Cloud
- Privacy compliance and records for Google Cloud
- Google Cloud Platform HIPAA Business Associate Amendment
- Gemini Enterprise Agent Platform release notes
- API and data retention
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.