Is Google Forms HIPAA compliant?

Yes, for a Google Workspace account under a signed BAA. Google's HIPAA page lists Google Forms, inside its Google Drive entry, among the Google Workspace services included in the Google Cloud BAA. A free or consumer Google account is not shown as covered.

Does Google sign a BAA that covers Google Forms?

Google offers a Workspace BAA that covers Google Forms, because Google's HIPAA page lists Google Forms inside its Google Drive entry among the Google Workspace services included in the Google Cloud BAA.

Google calls the document a Business Associate Amendment. It amends the customer's services agreement solely with respect to Covered Services, which are the Google products listed at the URLs in Attachment 1. For Google Workspace products, Attachment 1 points to a Google page that redirects to Google's HIPAA page for Google Cloud and Google Workspace, and that page holds the product list.

The table sets a Google Workspace account beside a free or consumer Google account.

Where does Google's HIPAA page list Google Forms?

Google's HIPAA page for Google Cloud and Google Workspace lists Google Forms inside its Google Drive entry, which also names Google Docs, Google Photos, Google Sheets, Google Slides and Google Vids. The page introduces that list as the Google Workspace services included in the Google Cloud BAA. Google Forms has no entry of its own, so its place on the list depends on the Google Drive entry.

A practice can follow Attachment 1 to that page and read the list itself. For the wider suite, see whether Google Workspace is HIPAA compliant.

What does Google's BAA leave out?

Google's BAA leaves out every Google product that is not a Covered Service. A customer acting as neither a Covered Entity nor a Business Associate is also outside it, because the BAA applies only to the extent the customer acts as one.

Google must give at least 12 months' prior notice before it takes a Covered Service off the Attachment 1 URLs. Google Forms stays covered only while the Google Drive entry stays on that list, so a removal of that entry would give a practice at least 12 months to plan.

Gmail is a different Google product with its own answer, in whether Gmail is HIPAA compliant.

Can a practice use the free version of Google Forms for patient information?

No coverage is shown for the free version of Google Forms, so a practice should not put patient information in it. Google's BAA amends the customer's services agreement, which means the account in use has to sit under that agreement. Neither the BAA nor Google's HIPAA page names a free or consumer account as covered. A practice that wants Google Forms for patient information therefore needs a Google Workspace account under a signed BAA.

What must a practice set up before using Google Forms for patient information?

A practice sets up Google Forms for patient information by confirming its role, choosing a signer with authority, and entering into a Google Cloud BAA.

• Confirm that the practice acts as a Covered Entity or a Business Associate, because the BAA applies only to that extent.
• Choose a signer with full legal authority to bind the practice. That signer represents the authority and agrees to the BAA's terms on the practice's behalf.
• Enter into a Google Cloud BAA, then review and accept it, as Google's HIPAA page directs.

Does Fax Pigeon sign a BAA for faxed patient documents?

Yes, Fax Pigeon signs a BAA at signup on every plan, and every delivered fax gets delivery proof. Patient consent is a separate question, covered in what consent a practice needs before faxing medical records.

* Google's HIPAA and BAA terms were read on its own site on October 13, 2026. Fax Pigeon is not affiliated with Google.