Google Forms is free and everyone knows it, so it's natural to reach for it when you need to collect patient information. For Protected Health Information (PHI), it's usually the wrong choice.
The Short Answer
Free Google Forms is not HIPAA compliant: there's no Business Associate Agreement (BAA), and without a BAA you can't collect PHI with it.
Paid Google Workspace plans can be covered by Google's BAA, and Forms is among the covered services. But that only works if your practice is on Workspace, has signed the BAA, and configures sharing and access correctly. Most practices using Google Forms for intake haven't done all three.
What Google Forms Is Missing for Patient Intake
Even when it's covered, Google Forms wasn't built for healthcare:
No healthcare fields. No insurance card capture, medication or allergy lists, or proper consent and e-signature fields.
Coarse access control. Responses go to a spreadsheet anyone with access can open. There's no way to limit which staff see which patients.
Nothing around the visit. No link to appointments, no reminders when forms aren't done, no view of who is ready.
What HIPAA-Ready Intake Looks Like
- AES-256 encryption at rest and TLS 1.3 in transit
- A signed BAA as part of the standard agreement
- Role-based access so staff see only what they need
- Audit logs of every access
- US-hosted infrastructure
- Healthcare field types for medical information
The Cost Argument
Google Forms is free. But HIPAA penalties run per violation and can reach hundreds of thousands of dollars a year, before breach notification, legal fees, and reputation damage. A purpose-built platform like Formisoft includes the BAA, encryption, audit logs, and healthcare fields from the start.
If You're Using Google Forms Today
- Stop collecting PHI with it unless you're on Workspace with a signed BAA and locked-down sharing.
- Find what you've collected. Check existing responses for PHI.
- Move and delete. Move PHI to a compliant system and delete it from Forms and the linked sheets.
- Document the change in your compliance records.
Google Forms is fine for surveys, RSVPs, and feedback. Use a compliant platform for patient information.
Related: patient intake software | intake form templates | HIPAA compliance
Collect patient information on HIPAA-ready forms.
- Forms, consents, and signatures before the visit
- Your paper forms converted by AI
- BAA included