Coaches love Google Forms for intake questionnaires: it is free, familiar, and takes five minutes to set up. But intake forms are usually the most sensitive tool in a coaching practice, because they ask health questions directly. So, is Google Forms HIPAA compliant?
The Direct Answer
Google Forms can be part of a HIPAA-compliant setup, but only under specific conditions: you must be on a paid Google Workspace plan, and your organization must have accepted Google’s Business Associate Addendum (BAA) in the Workspace Admin console. Google’s official HIPAA Included Functionality list explicitly covers Google Forms as part of Google Drive.
The condition almost every coach fails: free personal Google accounts do not qualify. If your intake form lives under a regular @gmail.com account, there is no BAA, and collecting health information through it is not compliant. That is the setup most solo coaches actually have.
You may read elsewhere that Google Forms is excluded from Google’s BAA. That is outdated or wrong: Google’s own Included Functionality list (updated May 2026) names Forms under Drive. But being covered on paper is only step one.
What “Compliant” Actually Requires Here
- Paid Google Workspace. Business or Enterprise, tied to your own domain. Not a personal Gmail account.
- Accepted BAA. A Workspace admin must review and accept Google’s BAA in the Admin console before any PHI touches Google services.
- Configuration. Non-covered services need to be disabled for users handling PHI, sharing settings need to be locked down, and third-party add-ons are not covered by the BAA at all.
- Your own practices. Where responses land, who has access to the spreadsheet, and what notification emails contain are all your responsibility.
| Requirement | Google Forms (free account) | Google Forms (paid Workspace + BAA) | Vibly Forms |
|---|---|---|---|
| BAA | Not available | Yes, via Admin console | Yes, for all clients on every plan |
| Compliant for intake forms | No | Yes, with configuration | Yes, built-in |
| Built for coaching intake | No | No | Yes |
| Connected to scheduling, notes, and client records | No | No | Yes, all-in-one |
The Practical Question for Coaches
Setting up a Workspace domain, accepting the BAA, and maintaining the configuration is very doable for a company with an IT admin. For a solo coach, it means becoming your own compliance administrator for a form builder.
The alternative is using intake forms that are compliant by default and already connected to the rest of your practice. Vibly Forms collects client information, reflections, and feedback with HIPAA-compliant handling and a BAA on every plan, and responses flow straight into your client records, alongside scheduling, payments, video sessions, and secure messaging, from $20/month (see plans).
For the full tool-by-tool audit of your practice, read our HIPAA guide for coaches.
Frequently Asked Questions
Is Google Forms HIPAA compliant?
Conditionally. Google Forms is covered by Google’s BAA as part of Google Drive, but only for paid Google Workspace customers whose admin has accepted the BAA in the Admin console. Free personal Google accounts have no BAA and are not compliant for health information.
Can I use a free Gmail account’s Google Forms for client intake?
Not if the form collects health information. Free personal accounts cannot sign a BAA with Google, so protected health information collected through them is not covered.
Does Google sign a BAA for Google Workspace?
Yes. Paid Google Workspace customers can review and accept Google’s Business Associate Addendum electronically in the Admin console. The BAA covers listed core services, including Gmail, Drive, Meet, Calendar, and Forms.
Are Google Forms add-ons covered by the BAA?
No. Google states that third-party applications and add-ons are not part of the Included Functionality covered by the BAA. If an add-on touches form responses containing PHI, it breaks the compliance chain.
