Set Up Secure Electronic Patient Forms with Google Workspace

1. Sign in to admin.google.com as a super admin.
2. Navigate to Account → Account settings → Legal & compliance and review/accept the HIPAA Business Associate Amendment (BAA).
3. Download or screenshot the executed terms for your compliance binder.

Resources: Google Admin Help and Google HIPAA overview [Google Help].

Confirm which Google services are covered under the BAA. As of September 30, 2025, Google lists Gmail, Drive (Docs, Sheets, Slides, Forms), Calendar, Chat, Meet, Sites, Keep, Vault, Voice (managed), Cloud Search, Admin, Apps Script, AppSheet, Gemini in Workspace, and more.

Action: Keep PHI inside covered services only. Do not copy PHI into tools that are not on Google’s HIPAA list.

Reference: Google Workspace HIPAA Included Functionality.

1. In the Admin console go to Apps → Google Workspace → Drive and Docs. Create a Shared Drive named PHI – Intake.
2. Add only essential team members (e.g., office manager, doctor). Apply least-privilege membership.
3. Configure sharing settings:
   • Disable external sharing for the Shared Drive.
   • Disable link sharing (“Anyone with the link”).
   • Prevent download/print/copy for viewers when appropriate.
4. Apply a “PHI” Drive label and enable Drive DLP to block external sharing when identifiers (SSNs, insurance IDs) are detected.
5. Ensure Drive audit logs are retained (tie into Vault in Step 5).

Implementation guidance: Google Workspace HIPAA Implementation Guide.

• Require 2-Step Verification for any staff with PHI access.
• Use Context-Aware Access (if your edition supports it) to limit PHI access to managed devices or trusted networks.
• Mandate strong passwords and enable suspicious login alerts.
• Use least-privilege admin roles; nobody should operate daily work as a super admin.

General Workspace HIPAA security practices: Spin.AI HIPAA guidance.

• Enable Google Vault (included in Business Plus and Enterprise plans).
• Create retention rules covering the PHI – Intake Shared Drive and relevant user accounts based on your record-retention policy.
• Set up matters/holds to support audits, legal requests, or disputes.

Reference: Google Workspace HIPAA Included Functionality.

1. Create the form from a Workspace account; name it “New Patient Intake” and structure sections such as Contact, Medical History, Medications, Allergies, and Consent.
2. In Settings → Responses, link responses to a new Google Sheet stored inside the PHI – Intake Shared Drive.
3. Notifications: if you rely on add-ons for alerts, only send a “new submission received” email. Do not include PHI in the message. Link back to the secure Sheet instead.
4. Settings → Presentation & Defaults:
   • Avoid collecting patient email addresses unless disclosed and necessary.
   • Do not “Limit to 1 response”; that forces Google sign-in and blocks most patients.
   • Ensure the form is accessible to anyone with the link (patients are external) and not restricted to your domain.

Domain access guidance: Google Forms sharing help.

• Keep the response Sheet inside the PHI – Intake Shared Drive.
• Share only with the intake group; disable link sharing entirely.
• Protect sensitive ranges (e.g., calculated fields, internal notes) with sheet protections.
• Review File activity to confirm auditing captures viewers/editors (retained via Vault).

Refer back to Google’s HIPAA implementation whitepaper for Drive configuration patterns.

• Never email PHI in plaintext.
• Submission alerts should be PHI-free (“new intake received, open the Sheet”).
• Enforce TLS for outbound mail; if you ever send PHI, configure S/MIME and document exceptions (safer approach: don’t email PHI).

Email posture recommendations: Google HIPAA implementation guide.

• Create Drive DLP rules that flag PHI identifiers (SSN, insurance IDs, DOB) and block external sharing from the Shared Drive.
• Enable Alert Center notifications for mass downloads, sharing attempts, or DLP violations.

More detail: Google HIPAA implementation guide.

• Submit multiple dummy entries and confirm they land in the correct Sheet inside the Shared Drive.
• Attempt to access responses with a non-authorized account. Access should be denied.
• Export audit logs and confirm activity appears in Admin reports and Vault.

• Staff access PHI only inside the locked Shared Drive and Sheet.
• No copy/paste of PHI into email, chat, or non-covered tools.
• When patients request the intake form, send the secure form link, not a PDF attachment.