Is Google Forms HIPAA compliant?
Google's form builder, part of Google Workspace. Covered by Google's BAA as part of Google Drive when a Workspace administrator has accepted it.
Signs a BAAYes
Google Forms signs a Business Associate Agreement. Google lists Google Forms under Google Drive among the Workspace services in its BAA; a super administrator accepts the BAA in the Admin console.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: Google Cloud — HIPAA compliance (included Workspace services) · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
What you still have to configure
- Accept the BAA in the Admin console (Account settings > Legal and compliance) before collecting PHI. source
- Restrict editor access to the form and access to response sheets to authorized staff, and configure respondent access separately. Keep "View results summary" off for forms collecting PHI: it can show answers to other respondents. source
Limitations
- Third-party add-ons are not covered by Google's BAA. source
- Applies to Google Workspace accounts with the BAA accepted — not to forms made in a personal Google account. source
Against our criteria
| BAA without a sales process | Yes — Accepted by a super administrator in the Admin console. | Google — HIPAA compliance with Google Workspace |
|---|---|---|
| BAA on entry-level team plans | Not verified | Not verified yet |
Alternatives
- Cognito Forms →BAA: conditional
- Formstack Forms →BAA: conditional
- IntakeQ →BAA: yes
- Jotform →BAA: conditional
- Microsoft Forms →BAA: yes
- Typeform →BAA: conditional