Skip to content
Talk to us

InsightsHealthcare

How to get ready for Gemini for healthcare while it is in preview

Gemini for healthcare is in US preview for Gemini Enterprise Standard and Plus. Here is what the BAA and Pre-GA terms mean for PHI, and what to do in 90 days.

Written by
CloudMagic engineering team
Published
Reading time
10 minutes

The short answer

Gemini for healthcare is Google's agentic AI for health systems and health plans, in US preview since November 10, 2026 for Gemini Enterprise Standard and Plus customers. Google says it is built to support HIPAA compliance, but previews run under Pre-GA terms that tell customers not to process regulated data unless Google's documentation says otherwise, so get written confirmation that PHI is allowed under your BAA first. Use the preview months to pick one workflow, line up EHR access and privacy review, and build the test set you will judge it by.

As of November 11, 2026. This is engineering guidance, not legal advice; check current rules with your counsel and compliance team.

Google's launch material explains what Gemini for healthcare does. Before anyone signs anything, a CIO or a utilization management lead also needs to know whether patient data can go in yet, who can buy it, what it touches in the chart, and what to do during the preview. This post answers those from Google's own pages and the federal rules, and says where we could not find an answer.

What is Gemini for healthcare?

Gemini for healthcare is Google's agentic AI product for health systems, medical groups and health plans, announced on November 10, 2026. It adds healthcare skills and connectors to the Gemini agent that Google introduced at Gemini at Work in October, and Google's FAQ says it is not a standalone application, so staff use it inside Gemini Enterprise.

Google's product page groups the work into five skills, and each one cites the source for what it finds.

SkillWhat Google says it doesSystems Google lists
Record synthesisReads outside records alongside the EHR and flags new allergies, diagnoses or medicationsEpic and Oracle Health (read-only), InterSystems FHIR, Verato, IMO Health
Appointment prepFlags medications and checks that required labs, clearances and consents are completeEpic, Oracle Health, RxNorm
Prior authAssembles chart evidence against plan criteria, flags gaps before submission, drafts appealsEpic, Oracle Health, CMS Coverage, Optum, ICD-10, NPPES
Utilization reviewFinds the documentation that meets plan medical policy and organizes it for clinical reviewersCMS Coverage, Optum, UiPath
Benefits and coverageCombines benefit booklets with eligibility and deductibles to estimate member costsOptum, TriZetto Provider Solutions, Salesforce

Finished packets and letters land in Microsoft 365 or Google Workspace, and teams can build custom skills for their own procedures. The launch customers Google names are Blue Cross Blue Shield of Massachusetts, Hartford HealthCare, HCA Healthcare, Highmark Health, Northwell Health, Optum and Stanford School of Medicine.

Who can use it today, and what does it cost?

Organizations in the US with Gemini Enterprise Standard or Plus can use it in preview now. Google has published no prices; it says customers will choose between per-user seats and pay-as-you-go, so your figure comes from your Google Cloud account team.

Check your edition first, because the Business edition is not on Google's list. Google's suggested next step is a conversation with one of its healthcare specialists about which provider or payer workflows to start with.

Is Gemini for healthcare HIPAA compliant, and can we put patient data into it during the preview?

Google says Gemini for healthcare is built to support HIPAA compliance, and whether your use complies depends on your BAA, your configuration and your policies. Do not put PHI into the preview until Google confirms in writing that it is allowed under your business associate agreement (BAA). Two sets of Google terms apply at once, and both have to allow it.

The first is the BAA. Google's HIPAA guidance says Google Cloud supports HIPAA compliance within the scope of a BAA, that compliance is a shared responsibility between you and Google, and that HHS has no certification program for HIPAA. Gemini Enterprise, Gemini Enterprise Agent Platform and the Cloud Healthcare API are on Google's list of covered products. That list does not name Gemini for healthcare, and neither the launch release nor Google's blog post mentions a BAA. Google's own wording is that the product is "built to support HIPAA compliance," which describes its design. Whether your use complies depends on your BAA, your configuration and your policies.

The second is the Pre-GA terms, which cover every Google Cloud product in preview. Section 5 of Google's Service Specific Terms says that unless a written notice or Google documentation says otherwise, customers "should not use Pre-GA Offerings to process personal data or other data subject to legal or regulatory compliance requirements." Google's HIPAA page repeats the point for PHI. The same terms say preview products have no SLA, can change or be discontinued without notice, and cap Google's liability at $25,000 or your agreement's limit, whichever is lower.

We could not find a written notice or Google documentation that allows PHI in the Gemini for healthcare preview. Ask your account team whether one applies to your account, and have counsel read it before any patient record goes in.

What does it connect to, and what will it never change in the chart?

It reads Epic and Oracle Health and does not write back to either. Google's FAQ says chart entries, orders and sign-off stay with clinicians.

Epic access runs through open.epic APIs with read-only FHIR R4 access to conditions, medications, labs and notes, and Oracle Health access runs through its Ignite APIs for FHIR. Google says a NextGen Healthcare connector is in development. Connectors inherit each user's existing permissions, so people can query only records they can already see, and Cloud Audit Logs record the activity. Other connectors cover patient identity, terminology and coding, CMS coverage data, eligibility and revenue cycle systems such as Optum, TriZetto and Waystar, and clinical evidence from BMJ and ASCO.

Check one gap early. Google's own Cloud Healthcare API is not in the connector list on the product page. If you already keep FHIR data in a Cloud Healthcare API store, ask your account team how Gemini for healthcare would reach it before you plan a workflow around that data.

Can it handle prior authorization, and how does that fit the CMS rules?

It can prepare the work on both sides, and people make the decisions. For providers, Google says it builds an audit-ready packet aligned with payer policy, flags documentation gaps before submission, and drafts an appeal when the record supports one. For health plans, it checks requests against medical policy and organizes the findings for the clinical reviewers who decide.

The CMS prior authorization final rule (CMS-0057-F) sets the clock. Since January 1, 2026, Medicare Advantage, Medicaid and CHIP payers must decide urgent requests within 72 hours and standard ones within seven calendar days, for medical items and services but not drugs, and must give a specific reason for every denial. From January 1, 2027, payers must also run a Prior Authorization API. In Medicare Advantage, a decision expected to be adverse on medical necessity "must be reviewed by a physician or other appropriate health care professional with expertise" before it is issued.

A complete packet is easier to decide inside those timeframes. Our post on building a prior authorization agent for the CMS rules covers the dates, the APIs and who must review a denial.

Where do clinicians and reviewers stay in charge?

Clinicians and reviewers stay in charge at every step that changes the chart or decides coverage. The EHR connectors are read-only, and Google's product page says decisions stay with experts while the agent organizes the evidence. In Fortune's launch coverage, Highmark Health's president said a clinician reviews every case before Highmark issues a denial.

Your organization still has to name the person for each output. Before go-live, write down who reviews each thing the agent prepares and where their approval is recorded: the nurse who sends an authorization packet, the physician who signs an appeal, the clinical reviewer at the plan. Google's audit logs record what the agent did, and your workflow needs its own record of who approved each output.

What should a health system or health plan do in the next 90 days?

Pick one workflow, settle the paperwork, line up EHR access and privacy review, and build the test set you will judge the product by. You can do all of it before any PHI goes into the preview.

WhenWhat to doWho owns it
Weeks 1 to 2Choose one workflow from Google's five skills in one service line, and record today's volume, turnaround and reworkOperations lead, clinical lead
Weeks 1 to 4Ask Google in writing whether PHI is allowed in the preview under your BAA, and which edition, location and pricing applyCIO, compliance, counsel
Weeks 2 to 6Arrange EHR access, decide which roles get it, and agree which records the workflow should never readEHR team, privacy officer
Weeks 4 to 10Build the test set from past cases, with outcomes written by the people who handle them, in a form your compliance team approvesClinical reviewers, an engineer
Weeks 10 to 12Agree the go-live gates and who approves each output, then run the test set once the terms allowBusiness owner, CMIO

The test set takes the most effort. Each case needs the right outcome and what a good answer must contain, written by the nurses, coders or reviewers who do the job now. Cover every outcome the workflow can produce plus the cases your team argues about, and run each one several times. Our post on testing an agent before it does real work sets out the method.

In the privacy review, remember that the agent can read whatever its user can read, so decide early whether behavioral health and substance use records belong in this workflow. How to keep protected records out of an AI agent's reach covers the controls.

Bring two details from Google's Gemini Enterprise documentation to your security team. Customer-managed encryption keys (CMEK) and Access Transparency are not supported in the global location, and VPC Service Controls, CMEK and Access Transparency do not apply when grounding with Google Search is on. If you need those controls, plan for the US location and decide whether Search grounding stays off.

If the records a workflow needs are scattered across systems, bringing them together usually comes first. In our clinical data platform migration, a healthcare analytics provider moved its live clinical pipelines off a vendor data center in eight weeks with no downtime.

When does it make sense to build on Gemini Enterprise Agent Platform instead?

Build your own agent when Google ships no skill for the workflow, when your data sits where the connectors do not reach, or when you need a control you can prove in code. The two can run side by side, and a custom skill in Gemini for healthcare is worth checking before you build.

Gemini Enterprise Agent Platform (formerly Vertex AI) is Google's platform for building and running your own agents. It and the Cloud Healthcare API are both on Google's HIPAA covered-products list, so a build on them can run under your BAA today, as long as every feature you use is generally available and set up the way Google's HIPAA guidance describes, including regional APIs and resource locations for PHI. That route suits a workflow whose data lives in a Cloud Healthcare API FHIR store, or one where an auditor wants to see the code that keeps protected records out of the agent's reach.

One example from our own work: we built a prior authorization agent on Gemini Enterprise for a made-up health system, Wrenfield Health, using a FHIR store of synthetic patients on the Cloud Healthcare API. The agent prepares each packet, behavioral health and substance use records are filtered out inside the store's query, and a utilization management nurse approves every packet before it goes anywhere. It does not use Gemini for healthcare, and no real patient data was involved. You can watch it run on our healthcare page as one example workflow on fictional data, or talk to one of our engineers about your own.

Update log

  • November 11, 2026: first published.

Frequently asked questions

Is Gemini for healthcare the same as Gemini Enterprise?

No. It is a set of healthcare skills and connectors that runs inside Gemini Enterprise, and the preview needs the Standard or Plus edition. Google's marketing pages now call Gemini Enterprise "Gemini for business."

Is it the same as MedLM, Med-Gemini or MedGemma?

No. MedLM was a model family based on Med-PaLM 2, and Google deprecated it, with access ending on or after September 29, 2025. Med-Gemini is a family of research models that Google says is not a product for commercial use. MedGemma is a set of open models for medical text and images that developers adapt and must validate. Gemini for healthcare is a product your staff use.

Does it replace our EHR's own AI features?

Nothing in Google's launch material says so. It reads from your EHR, never writes to it, and Google says nothing migrates, so the EHR stays your system of record. Any overlap with your EHR vendor's AI features is worth settling workflow by workflow with your EHR team.

Does Google use our data to train its models?

Google says no. Its product page says protected health information and prompts stay isolated to your tenant and are never used to train or fine-tune Google's foundation models.

Which locations does it run in?

The preview is available in the US, and Google says the healthcare connectors support the global and US locations. CMEK and Access Transparency are not supported in the global location, so settle the choice with your Google Cloud account team.

Sources

More from Insights

Bring us the question you are working on.

A senior engineer reads every message and replies within one business day.

Send us the brief