Are Google Forms HIPAA Compliant? What a BAA Covers

Key takeaways

• Free Google Forms are never HIPAA compliant because Google only signs a BAA on paid Workspace plans.
• A signed Workspace BAA covers the tool, not your workflow, and excludes consumer services, some add-ons, and third-party Marketplace apps.
• Google Forms cannot produce per-record audit logs, role-based access controls, or valid e-signatures for HIPAA authorizations.
• Gravity Forms is not compliant out of the box; compliance depends on a BAA with your host, a paid license, and your own audit and breach controls.
• Switch to purpose-built intake tools when volume grows or intake includes clinical history, self-harm screening, or e-signed consents.

Free vs paid: when Google Forms can be HIPAA compliant

Free Google Forms are not HIPAA compliant: no BAA is available on free accounts, so any client intake data you collect there is exposed. Google Forms inside a paid Google Workspace plan can be used compliantly, but only if you sign a BAA with Google and configure the form correctly, per Google's HIPAA implementation guide. Even then, a signed BAA covers the tool, not your workflow. For how Cohessra handles intake where a BAA applies, see our BAA overview.

What does the Google Workspace BAA actually cover?

Which Workspace plans include a BAA

Google will sign a Business Associate Agreement for paid Workspace plans, not for free accounts. That means a solo cash-pay therapist on free Gmail is handling intake responses, signed authorizations, and session notes with no BAA in place, which fails the HIPAA requirement outright. If you want Google anywhere near your intake workflow, you need a paid Workspace plan and a signed BAA covering it before any client information touches a form.

Services Google excludes from its BAA

Even with a BAA signed, coverage is narrower than most therapists assume, and the exclusions are where practices get burned. Google's BAA covers core Workspace services like Gmail, Drive, Docs, and Forms on paid plans, but it does not extend to consumer services, some add-ons, or third-party apps connected through the Workspace Marketplace, and Google's own Workspace terms documentation spells out which services sit inside the agreement. A form add-on that emails responses or syncs them elsewhere can move protected health information outside the agreement without warning, because the add-on vendor never signed anything with you. The practical result is that you can be BAA-covered on paper and still non-compliant in operation, with PHI sitting in a third-party tool that has no contractual obligation to safeguard it. If your intake process depends on add-ons, shared drives, or any account you cannot confirm is under the BAA, treat it as out of scope. This is also where your authorized user policy matters: every person who touches intake data must be covered, which is simple for a solo practice but easy to get wrong as you add a biller or supervision hours.

Why a signed BAA still isn't enough for intake forms

A BAA only obligates Google to meet HIPAA safeguards on its end. The covered entity, meaning you, still has to implement its own controls, and that is where Google Forms falls short for intake and authorizations.

Audit logs and access controls

HIPAA's Security Rule expects audit trails showing who accessed PHI and when, plus minimum-necessary access limits. Google Workspace does log admin and user activity, and Google documents these capabilities in its admin reporting tools, but Forms itself was never designed as a clinical record system. There is no per-form access log tied to a client chart, no role-based scoping down to individual records, and no way to prove to an auditor that only you viewed a specific intake response. Anyone with your Workspace password sees everything in the account.

That gap matters because a BAA covers the vendor, not your workflow. If a laptop is shared, a VA has full account access, or a form response sits in a spreadsheet for three years, the BAA does nothing for you. Purpose-built platforms handle this differently; Cohessra's security page describes role-based access controls built around client records rather than generic Workspace activity.

E-signatures on HIPAA compliant authorization forms

Google Forms cannot capture a legally meaningful signature on a HIPAA authorization or informed consent. A typed name in a text field is not an e-signature under ESIGN, and there is no tamper-evident record of what the client agreed to or when. You would still need a separate signing tool, which means the authorization lives outside the form workflow entirely. Retention is the same story: Forms responses are easy to delete and hard to preserve for the six years HIPAA requires.

Side-by-side compliance checklist: Google Forms vs Workspace + BAA vs dedicated platforms

The gap between these three setups comes down to what happens after a client hits submit. Here's how they compare on the five points that matter for intake and authorizations.

Google Forms on a free account fails at the first row: no BAA means no covered PHI, period. Workspace plus a signed BAA clears that bar but leaves you without per-record audit logs or a real e-signature mechanism, so informed consent and authorization documents still need a separate tool. Even on Workspace, retention is manual, and a deleted form takes its submission history with it.

Dedicated intake tools close all five gaps, though they cost more and add another login. Purpose-built practice platforms like Cohessra fold intake into the rest of the stack, so intake documents land in the same client record instead of a form export.

How to make Google Forms HIPAA compliant (if you insist on trying)

Admin steps in Google Workspace

Only paid Workspace accounts are eligible for a BAA, so free Gmail is out before you start. Sign the BAA as the admin, then restrict the form and its responses spreadsheet to named accounts with edit access, and turn off "Collect email addresses" so Google isn't storing client contact data on your behalf. Disable sharing to anyone outside your domain, and audit who on your team can open the responses file. HHS treats anyone handling PHI on your behalf as a business associate, which is why the BAA must cover Google before any PHI touches the form; HHS outlines business associate requirements at hhs.gov.

What you still can't fix in Google Forms

You can't generate access logs that would satisfy an audit trail requirement, and you can't handle e-signature authorizations inside a form in a way that documents informed consent. Responses land in a spreadsheet that copies, exports, and version history are hard to police. There's also no client portal: intake data sits in your Drive rather than in a record the client can reach.

If that list gets long, purpose-built tools handle it for you. Our intake and billing stack, including LedgerCare, covers superbill generation (on its Practice and Clinic plans) and portal-based intake without spreadsheet workarounds.

Is Gravity Forms HIPAA compliant?

No. Gravity Forms ships with no BAA and no HIPAA-specific controls, so it is not compliant out of the box. Whether you can use it for intake depends on three things: your hosting, a BAA with that host, and the add-ons you run.

HIPAA compliant WordPress forms: what it takes

First, host the WordPress site with a company that will sign a BAA, since the web server stores every form submission. Second, buy a signed license of Gravity Forms itself, because the free version does not qualify for a BAA from the vendor. Third, encrypt submissions at rest, restrict dashboard access to named users, and never route entries through third-party SMTP or notification emails that carry PHI.

Even then, you own the audit trail, the access logs, and the breach response. For a solo cash-pay practice, that is a part-time compliance job layered on top of WordPress maintenance. It is workable if you already run your whole site there and have the appetite for it. If you only need intake and superbills handled, a purpose-built tool is less setup for the same outcome.

When a cash-pay practice should switch to purpose-built intake tools

Switch when any of these apply: you collect more than a handful of intake packets a month, you need signed practice policies or authorization-to-release forms, or you would dread explaining to a client how their intake answers were stored. Solo cash-pay clinicians with light volume can keep Google Forms behind a Workspace BAA for low-risk items like scheduling preferences. The moment intake includes clinical history, self-harm screening, or e-signed consents, the missing audit trail becomes the real exposure. The HHS Security Rule expects you to record who accessed PHI and when, which Google Forms on its own does not give you in a review-ready form.

What to look for in HIPAA compliant intake forms

Check four things: a BAA covering the intake tool, an audit log of form access, e-signature capture with a timestamp, and automatic flow of completed forms into your client records. Cohessra's Solo plan at $39/month handles intake documents, invoicing, and the client portal in one place, so intake data lands in the same system you bill from. If you are on SimplePractice or Sessions Health already, their intake features may cover this, and switching tools just for forms is rarely worth it.

Where intake forms fit in a cash-pay practice stack

Intake is the first handoff in a chain: a client submits history and consents, you review them, then billing starts and the first superbill goes out. If intake lives in Google Forms, everything after it lives somewhere else, so you're retyping demographics into an invoice and chasing signatures by text.

Cohessra connects intake, the client portal and billing on one Solo plan at $39/month ($33/mo annual): intake feeds the client portal, and portal activity feeds billing. Superbills are on its Practice and Clinic plans. No insurance claim features to pay for, since your practice is entirely private pay.

Where it falls short: Cohessra is built for cash-pay workflows, so if you need insurance billing or deep customization, SimplePractice or Sessions Health may fit better. If you're on spreadsheets and texts, or resent paying SimplePractice Starter's $49/month for features you never touch, the narrower scope is the point.

FAQ

Does Google sign a BAA on the free version of Google Forms or Gmail?

No. Business Associate Agreements are only available on paid Google Workspace plans, so free Gmail and free Forms have no BAA coverage at all. Any client information collected through a free account is PHI handled by an uncovered vendor, which fails the HIPAA requirement outright.

Can clients e-sign a HIPAA compliant authorization form through Google Forms?

No. A typed name in a text field is not a valid e-signature under ESIGN, and Forms keeps no tamper-evident record of what the client agreed to or when. Authorizations and informed consents require a separate signing tool outside the form workflow, which fragments the record.

Is Google Sheets HIPAA compliant if it's part of my paid Workspace account?

Sheets falls under the Workspace BAA on paid plans, so the vendor side is covered. The problem is your side: responses sit in a spreadsheet with no per-record audit log, no role-based access limits, and easy export, copying, and deletion. Compliant on paper, risky in operation.

What happens if I already collected intake data through non-compliant Google Forms?

First, stop collecting new intake through the free account and move future intake to a covered tool. Then assess the existing responses: deleting them removes the exposure but also the records, so decide based on your retention needs. Document the correction, since a fixed gap is a far better position than an ongoing one.