Is Google Forms HIPAA Compliant?

What Google Says

Google's HIPAA guidance for Workspace says administrators must review and accept a BAA before using protected health information in Google services. The BAA is accepted electronically in the Admin console, under Account settings, then Legal and compliance.

Google also publishes a list of the services its BAA covers. Google Forms appears on that list as part of Google Drive, alongside Docs, Sheets and Slides.

Google states that customers who have not signed a BAA with Google must not use protected health information in Workspace services.

What the BAA Does Not Cover

• Third-party applications, including add-ons, are not covered by the BAA
• Sharing settings are yours to manage, including who can open the form responses and the linked spreadsheet
• A form link sent to the wrong audience or a response sheet shared too widely is still your responsibility

How to Set It Up Carefully

• Use a paid Google Workspace account for your practice, not a personal Google account
• Have a super administrator accept the BAA before you collect any patient information
• Restrict who can view responses and turn off link sharing on the response spreadsheet
• Avoid add-ons unless that vendor has signed its own BAA with you
• Turn on two-step verification for every user

Where Google Forms Falls Short for a Practice

Google Forms is a general survey tool. Responses land in a spreadsheet, so connecting an intake form to a client record, a booking or a follow-up message takes extra manual work.

On the Aspire Builder Pro HIPAA plan, intake forms save straight to the client record in your CRM and can start a follow-up workflow, all under one signed BAA. See the HIPAA compliant form builder.