Is Google Forms HIPAA compliant?
Why the default answer is no
Out of the box, Google Forms runs on a consumer Gmail account with no BAA, stores responses on shared Google infrastructure, and offers no controls for marking fields as PHI. Free Google Workspace accounts also do not sign BAAs. Any practice collecting protected health information through a default Google Forms instance is operating outside HIPAA.
The five changes to make it compliant
- Upgrade to Google Workspace Business Associate or Enterprise
- Sign the BAA from your Workspace admin console (Account > Account Settings > Legal and Compliance)
- Ensure Forms is one of the BAA-covered services (Google publishes the list and updates it; check before you start)
- Restrict the form to require sign-in and limit access to your domain
- Disable third-party add-ons and turn off the response-collected email confirmation, which can leak PHI
What Google Forms still cannot do
Even after the five changes, Google Forms cannot capture an e-signature with audit metadata, cannot conditionally branch fields based on prior PHI answers, cannot mark individual fields as encrypted-at-rest with separate access logs, and cannot integrate with a clinical EHR API. For an intake form for a therapy or telehealth practice, those four gaps usually push practices to Jotform HIPAA, SimplePractice, or a similar form builder designed for healthcare intake.
When Google Forms is the right call anyway
Internal employee health screening with low PHI volume. Conference health attestations. Simple satisfaction surveys that do not collect PHI at all. In those cases the Workspace BAA plus the five changes is sufficient and you save the cost of a dedicated form builder.
I configured HIPAA-eligible Workspace tenants for two healthcare clients during my Jotform years and ran the side-by-side test against Jotform HIPAA for intake forms.
Need this set up for real?
This answer covers the basics. If you're wiring this into an actual workflow, a 20-minute call sorts out whether a kit fits or what a custom build takes.
- Google Workspace HIPAA implementation guideGoogle
- HHS HIPAA Security Rule overviewU.S. Department of Health and Human Services
- Jotform HIPAA features overviewJotform
Related questions
What is the cheapest way to make Google Forms HIPAA compliant?
Google Workspace Business Starter ($6/mo per user) plus signing the BAA. But you still need the five configuration changes, and you still won't have e-signature or conditional logic for PHI fields. Total cost is lower than Jotform HIPAA, but capability is too.
Is Google Forms HIPAA compliant on a free Gmail account?
No. Free Gmail accounts do not get a BAA. You must upgrade to a paid Google Workspace plan.
Can I use Google Forms for internal health screening?
Yes, with a Workspace BAA. Internal employee screening with low PHI volume is the strongest use case for Google Forms in a HIPAA context.
What about Google Sheets: is it HIPAA compliant?
Under a Workspace BAA, yes, Google Sheets is a covered service. But the same limitations apply: no per-field encryption, no e-signature, no conditional logic for PHI fields.