Is Google Forms HIPAA compliant for patient forms?
Google Forms can hold PHI only on a Google Workspace account whose administrator has accepted Google's BAA. Google says customers without a BAA must not use PHI in Google Workspace or Cloud Identity services. Software alone does not make a practice HIPAA compliant; the agreement, account setup and daily use decide how patient information is handled. Start with what a BAA is.
Last updated
- BAA needed Yes
- Who accepts it Workspace administrator
- Forms question types 12
- Signature question None
- Add-ons under BAA Not covered
When can Google Forms hold PHI?
Google Forms is among the services covered by Google's BAA, but acceptance happens at the Workspace account level. A Workspace administrator reviews and accepts the agreement; a super administrator can see the acceptance in the Admin console under Account settings, Legal and compliance.
Google's HIPAA statement says customers who have not entered into a BAA with Google must not use PHI in Google Workspace or Cloud Identity services. The practice needs a Workspace account whose administrator has accepted the BAA before putting protected health information in a form.
Confirm eligibility with Google for the practice's account. For background, see the intake and HIPAA guides and the guide to intake forms.
This information is general. Confirm how it applies to your practice with your own counsel or compliance lead.
What does Google's BAA cover for Google Forms?
The covered services list includes Google Forms. The BAA stops at third-party applications, including add-ons, and Additional Google Services.
| Item | Covered by Google's BAA? | What Google says |
|---|---|---|
| Google Forms | Yes | Google Forms is on the covered services list. |
| Third-party applications including add-ons | No | Third-party applications including add-ons are not included. |
| Additional Google Services | No | The BAA does not extend to products outside the core Workspace services. |
Why does a BAA not settle Google Forms HIPAA compliance?
A BAA is a contract that documents a business associate's promise to safeguard PHI. It is one part of the practice's setup and use of Google Forms.
Under 45 CFR 164.502(e), a covered entity may allow a business associate to create, receive, maintain or transmit PHI only after obtaining satisfactory assurance that it will safeguard the information. Paragraph (e)(2) documents that assurance through a written contract or other written agreement, the BAA.
The HHS cloud computing guidance treats a cloud service provider handling electronic PHI for a covered entity as a business associate, even when it stores only encrypted data and has no decryption key. HHS says a covered entity that uses a cloud service to hold electronic PHI without a BAA is in violation of the HIPAA Rules.
The technical safeguards in 45 CFR 164.312 are checks for any tool: access control, (a)(1); audit controls, (b); integrity, (c)(1); person or entity authentication, (d); and transmission security, (e)(1). They address authorized access, activity records, improper alteration or destruction, identity verification and network transmission. There is no official HIPAA certification for software. See HIPAA-compliant forms for the broader setup.
What does Google Forms list for patient intake tasks?
Google describes 12 question types, sections and branching, sending, responses and quiz scoring. The rows compare those listed features with Intake Pro.
| Intake task | Google Forms | Intake Pro |
|---|---|---|
| Signature | None of its 12 question types is a signature. | Typed or drawn; patient, representative, staff member or witness can sign. |
| Conditional questions | Go to section based on answer works for Multiple choice and Dropdown only. | Questions show or hide based on earlier answers. |
| Sending | Email, link, pre-filled link or website embed; one-response and domain limits. | Private link by text or email, QR code or website embed. |
| Reminders | Not listed on their page | Reminders by text and email. |
| Kiosk and offline filling | Not listed on their page | Paired tablet kiosk; offline forms send on reconnection; screen clears 60 seconds after submission. |
| Signed PDF and audit trail | Not listed on their page | Signed PDF, audit trail, signer and signing time per submission. |
| Form versions | Not listed on their page | Published versions never change; editing makes a new version. |
| Translations | Not listed on their page | 18 languages; incomplete translations cannot publish. |
| Scoring | Quiz answer keys and point values; score bands are not listed on their page. | Weighted and reverse-scored items, subscales and labelled score bands. |
| EHR connection | Not listed on their page | Not yet |
What does a practice check if it keeps Google Forms?
These are practical steps for a practice that keeps patient forms in Google Forms, not legal requirements. The practice manager, Workspace administrator and compliance lead divide the work.
-
Confirm BAA acceptance
The practice manager confirms with the Workspace administrator that the BAA has been accepted for the account used to collect PHI.
-
Keep add-ons off PHI forms
The form builder keeps third-party applications, including add-ons, off forms that collect PHI because Google's BAA does not cover them.
-
Require 2-Step Verification
The Workspace administrator requires 2-Step Verification for the organization's accounts.
-
Restrict the response spreadsheet
The administrator limits who can open the linked Google Sheets spreadsheet. The review also covers recipients of downloaded CSV files and response notification emails.
-
Plan signature collection
The practice decides how signatures are collected because none of the 12 Google Forms question types is a signature. Intake Pro e-signatures can be typed or drawn.
-
Review the finished setup
Counsel or the practice's compliance lead reviews the account, form access and response handling before real patient data is collected.
When does a purpose-built intake tool fit better than Google Forms?
A purpose-built intake tool fits when a practice needs signatures, a signed PDF per response, fixed form versions or a kiosk. Those needs shape the patient record and front-desk workflow.
Intake Pro vs Google Forms compares the two approaches, while Google Forms alternatives looks at other options. Patient intake software explains the broader workflow. Intake Pro is built for protected health information and signs a BAA before you collect real patient data.
Sources
- Google Workspace and Cloud Identity HIPAA statement
- Google Workspace HIPAA covered services
- Google Forms question types
- Google Forms sections and branching
- Google Forms sending options
- Google Forms responses
- Google Forms quiz scoring
- Google Workspace 2-Step Verification
- 45 CFR 164.502
- HHS cloud computing guidance
- 45 CFR 164.312
Checked on
Questions
Can Google Forms collect a patient's signature?
None of the 12 Google Forms question types is a signature. A practice keeping Google Forms needs a separate decision about how a patient or representative signs. Intake Pro supports typed or drawn signatures from a patient, representative, staff member or witness.
Does Google's BAA cover add-ons used with Google Forms?
No. Google says third-party applications, including add-ons, are not included in its BAA. Keep them off forms that collect PHI. Additional Google Services also sit outside the BAA, even though Google Forms itself is on the covered services list.
How does conditional branching work in Google Forms?
Go to section based on answer works only with Multiple choice and Dropdown questions. It sends a respondent to a section according to the selected answer. Intake Pro shows or hides questions based on earlier answers.
Does Google Forms send reminders for patient intake forms?
For Google Forms, reminders to people who have not responded are not listed on their page. Google Forms can be sent by email, link, pre-filled link or website embed. Intake Pro sends private links and reminders by text and email.