The Appeal of Gemini in Healthcare
For small healthcare practices, functional medicine educators, and wellness coaches, Google Workspace is often the operational hub. You use Gmail for communication and Google Drive for file storage. Worth saying up front: neither of those is HIPAA compliant out of the box. They become eligible to hold PHI only after a super administrator accepts Google's Business Associate Addendum and configures the services the way Google's implementation guide describes.
When Google integrated Gemini directly into Workspace, the appeal was obvious: an AI assistant that can read your emails and summarize your patient notes.
What Gemini CAN Do (Safely)
On non-PHI data (Lane 1 operations), Gemini works well for:
1. Administrative Drafting: You can use Gemini to draft standard operating procedures, employee onboarding documents, and marketing copy.
2. Educational Content: You can prompt Gemini to help structure a 30-day wellness curriculum or outline a workshop presentation.
3. Non-Clinical Email Triage: You can use Gemini to summarize vendor emails, software subscription notices, and general business correspondence.
What Gemini CANNOT Do (Without Strict Setup)
You cannot use Gemini to summarize patient notes, analyze lab results, or draft clinical emails *unless* you have met very specific criteria.
If you type a patient's name and their symptoms into a consumer-tier Gemini prompt and you are a covered entity or a business associate, you have made a disclosure of PHI that your BAA does not cover. Whether that disclosure is a reportable breach is a fact-specific call under the Breach Notification Rule, which turns on a four-factor risk assessment, so route it to your privacy officer rather than deciding it yourself. The safer habit is to strip the case down first. Under 45 CFR 164.514(b) the Safe Harbor method removes eighteen categories of identifiers. A de-identified clinical question is not PHI, and you can ask it anywhere. This article is general information about how these tools are configured, not legal advice about your practice. On the consumer tier, Google's own Gemini Apps Privacy Hub tells you plainly not to do this. It says human reviewers, including trained reviewers from Google's service providers, review some of the data collected, and it asks users not to enter confidential information they would not want a reviewer to see. Here is the part clinicians miss: chats already picked up for human review are not deleted when you delete your activity. Google retains them for up to three years. Deleting the chat afterward does not undo the disclosure.
The Google Workspace BAA Exception
There is a safe way to use Gemini for clinical data, and it is not limited to the Enterprise tier. Google makes the HIPAA Business Associate Addendum available to Google Workspace and Cloud Identity customers generally, and a super administrator accepts it in the Admin console under Account settings, then Legal and compliance. Since January 2025 Google has bundled Gemini features into Workspace Business and Enterprise plans, so the question is not which tier you bought. The question is whether you have accepted the BAA and whether the specific feature you are about to use sits on Google's HIPAA Included Functionality list.
1. You must have a paid Google Workspace or Cloud Identity subscription. Any edition can qualify. There is no Enterprise-only requirement. Note also that the Gemini app is covered only when provisioned as a core Workspace service: Google states that access to the Gemini app as an Additional Product is not HIPAA compliant.
2. You must sign the Business Associate Agreement (BAA) in the Google Admin Console.
3. You must confirm that the specific Gemini surface you are using appears on Google's HIPAA Included Functionality list, because the carve-outs are surface by surface, not product by product. As of the August 31, 2026 version of that list, the Gemini app, the Gemini Mac App and Gemini in Workspace are included, but Gemini in Chrome is excluded by name. Google's own implementation guide states that access to the Gemini app via Gemini in Chrome is not HIPAA compliant. That matters more than it sounds. Gemini in Chrome is the browser sidebar that can read whatever page you have open, and for a lot of clinicians the page they have open is a chart in a web-based EHR. Turn it off for clinical workstations. NotebookLM does not appear on the list either, so do not assume it is covered.
When you are using Gemini through a qualifying edition of Google Workspace, Google states in its generative AI privacy hub that Workspace does not use customer data for training models without the customer's prior permission or instruction, and that your chats and uploaded files in the Gemini app will not be reviewed by human reviewers or used to train generative AI models without your permission. Note the product name carefully. That commitment covers Gemini in Workspace. Gemini Enterprise is a separate Google Cloud agent platform with its own terms, so do not read one product's promises onto the other. In that configuration you can use the covered Gemini surfaces to synthesize clinical notes stored in your Workspace Drive, provided you have also followed Google's HIPAA implementation guide for the underlying services. Signing the BAA is the floor, not the finish line. The minimum necessary standard still applies, so feed the model the smallest slice of the record that answers your question.
The Rule of Thumb
If you are a solo practitioner and do not want the administrative work of managing BAA-covered Gemini settings, stick to the two-layer architecture. Use Gemini for your marketing, your admin, and your education. Keep it entirely away from your clinical records.