G
On some plansIs Google Forms HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
Google lists Forms within Drive as covered functionality under its Workspace BAA, so coverage depends on a Workspace account whose super admin has accepted the BAA. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Accounts without a signed BAA, per Google’s statement that they must not use PHI | Not covered |
| Forms in a Google Workspace account with an accepted BAA | Covered |
What the BAA leaves out
- Third-party add-ons
How to get the BAA
From a super administrator account, open the Admin console and go to Account settings, then Legal and compliance, to review and accept the BAA.
What the vendor says to do
- A super admin accepts the BAA in the Admin console
- Apply the Drive sharing recommendations in Google’s HIPAA guide; it gives no separate Forms steps
- Keep PHI out of file names
Proof from the vendor
- HIPAA compliance on Google Cloud and Google WorkspaceForms listed under Drive as covered
- Google Workspace and Cloud Identity HIPAA Implementation GuideForms listed in Included Functionality; no separate Forms steps
- HIPAA Compliance with Google Workspace and Cloud IdentityBAA acceptance steps
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.