Conditional: a Business Associate Agreement (BAA) is available for Google Forms on paid Google Workspace editions, where Forms is covered as part of Google Drive. It is not available for Forms used with a personal Google account. Published by Chanty, Inc., which has no relation to this entry.
Verdict: conditional
Conditional Google offers a BAA on paid Google Workspace editions and Cloud Identity. The main exclusions are personal (consumer) Google accounts and the legacy free edition. Last verified 2026-10-19.
Short answer
Google makes a BAA available on paid Workspace editions, and Google Forms falls under it as part of Google Drive in Google's HIPAA Included Functionality. Forms used with a personal Google account or the legacy free edition has no BAA.
There is no separate Forms BAA. Forms is covered automatically once a super administrator accepts the Workspace BAA for the organization. For other tools, see All vendor HIPAA checks.
Which plans include a BAA
Google publishes one BAA for Workspace. It is accepted once per organization, not per product.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Business Starter | Available | Super administrator accepts the BAA in Admin console, Account settings > Legal and compliance | None stated; included in the Workspace BAA |
| Business Standard | Available | Same | None stated; included in the Workspace BAA |
| Business Plus | Available | Same | None stated; included in the Workspace BAA |
| Enterprise | Available | Same | None stated; included in the Workspace BAA |
| Essentials | Available | Same | None stated; included in the Workspace BAA |
| Frontline | Available | Same | None stated; included in the Workspace BAA |
| Education | Available | Same | None stated; included in the Workspace BAA |
| Nonprofits | Available | Same | None stated; included in the Workspace BAA |
| Cloud Identity | Available | Same | None stated; included in the Workspace BAA |
| Personal / consumer Google account | Not available | No Admin console, so the BAA cannot be accepted | Not applicable |
| Legacy free edition (Google Apps Standard Edition) | Not available | Excluded from the BAA | Not applicable |
Minimum seat count: Not published by the vendor. Business Starter pricing starts at €6.80 per user per month with an annual commitment. The page displayed EUR for this region and did not show USD.
For the wider product suite, see Is Google Workspace HIPAA compliant?
What the BAA covers and what it excludes
Covered:
- Google Forms, listed as part of Google Drive in the HIPAA Included Functionality
- Google Drive
- Google Sheets, where form responses are stored
Excluded:
- Third-party applications and add-ons, including Forms add-ons
- Additional Google Services outside the Included Functionality
In practice, a patient intake form built in Forms and answered into a linked Sheet stays within covered services. A Forms add-on that sends responses to a scheduling or CRM tool does not, and neither does an outside Google service connected to the form. Each of those needs its own review and, where it touches PHI, its own BAA.
Related checks: Google Drive HIPAA status and Is Google Docs HIPAA compliant?
Security controls the vendor publishes
On the pages checked, Google does not publish Forms-specific control details. Controls of Google Workspace in general are not attributed to Forms here.
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
How to use Google Forms with PHI
- Use a paid Workspace or Cloud Identity account, never a personal Google account. A front-desk staffer's personal Gmail is out of scope.
- Have a super administrator accept the BAA in Admin console (Account settings > Legal and compliance) before any form collects PHI.
- Keep form responses in Sheets and Drive, which are within covered services.
- Do not install Forms add-ons or connect outside Google services to forms that collect PHI unless that tool is separately covered by its own BAA.
- Manage user access and offboarding. When a staff member leaves, remove their access to forms and response sheets.
- Train staff and set written policies on what may be entered into forms.
Compliance depends on the signed BAA, your configuration and your policies, not on the product alone. See the HIPAA glossary: BAA, PHI for terms and HIPAA guides for implementation help.
Alternatives with a BAA
Verdicts below are conditional; each depends on the plan or add-on shown.
- Formstack: conditional; BAA from the Forms HIPAA add-on
- Hushmail for Healthcare: conditional; Healthcare Basic plan
- Jotform: conditional; Gold plan
- Microsoft Forms: conditional; Office 365 / Microsoft 365 commercial subscriptions
- Qualtrics: conditional; plan not published
Compare them in HIPAA-compliant software by category.
Sources
- HIPAA compliance on Google Cloud and Google Workspace — Trust center, checked 2026-10-19. "Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides, and Google Vids)"
- HIPAA Compliance with Google Workspace and Cloud Identity — Help article, checked 2026-10-19. "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services. Administrators must review and accept a BAA before using PHI in Google services."
- Privacy compliance and records for Google Workspace and Cloud Identity — Help article, checked 2026-10-19. "To review and accept this BAA, you must be signed in to an administrator account for your organization's Google Workspace or Cloud Identity account. Non-administrator Google Workspace or Cloud Identity users or users of the legacy free edition of Google Workspace (sometimes referred to as "Google Apps Standard Edition") cannot review and accept a BAA from Google at this time."
- Compare Flexible Pricing Plan Options | Google Workspace — Pricing page, checked 2026-10-19. "Annual (Save 16% with 1 year commitment) All plans billed monthly, all prices €EUR Starter 30% off for 3 months help €4.76€6.80** / user per month"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.