When is Google Forms covered by HIPAA?
When three things are true: your practice is on a paid Google Workspace plan, an administrator has accepted Google's BAA in the Admin console, and the form doesn't depend on add-ons. Google's documentation lists Forms, as part of Google Drive, in the functionality its BAA covers, and says customers who haven't signed the BAA must not use Google services with protected health information. For what HIPAA requires of any online form tool, see HIPAA-compliant online forms.
How do you accept Google's BAA?
A Workspace administrator reviews and accepts it in the Admin console, where Google also keeps the accepted copy. Do it before anyone collects patient data. It's also wise to switch off Google services the BAA doesn't cover, so staff can't put patient data into them by accident.
What isn't covered?
- Free and personal Google accounts, including personal Gmail.
- Third-party add-ons, which Google says sit outside its BAA.
- Google services that aren't on Google's covered list.
The BAA doesn't decide who can open the response spreadsheet or how form links are shared. Those settings are still up to your practice.
What can't Google Forms do for intake paperwork?
Google Forms has no signature question type, so consent forms need another tool.
When does a dedicated tool make more sense?
When you need signatures, forms rebuilt from your existing paperwork, or completed PDFs to file in your EHR. Dedicated HIPAA form tools sign a BAA covering their own service, and most handle those jobs out of the box. Therapy practices that also renew physician orders and insurance authorizations can use a GetDocsSigned healthcare account, set up by hand with a signed BAA, which turns your existing blank PDF forms into online forms and tracks renewals with built-in fax. Compare six HIPAA intake tools for therapy practices.
Sources: Google Workspace Admin Help on HIPAA and Google Cloud HIPAA documentation. Checked October 2026.