HIPAA form setup

The Formesign HIPAA setup guides you through PHI fields, BAA status and email notifications. Use it to review those specific controls for the form and account you intend to use. Keep your organization's wider privacy and security responsibilities in view when deciding how patient information moves between services.

Open the dedicated setup

From the HIPAA form page, choose Try it free. The current import entry asks for a Google Forms link or Browse, then offers Make my form compliant. It defaults to making a copy and includes Edit my existing form as an alternative.

Choose the intended source/copy behavior before proceeding. Account ownership and the Google connection affect which path is available. See copy or edit existing for the distinction.

Review the three steps

1. PHI: review detected fields, then use Select fields that contain PHI to correct the selection. Next saves the field choices.
2. BAA: inspect the account's Formesign agreement status. The Workspace branch asks Have you signed a BAA with Google? Answer for your actual organization and account.
3. Email: review how responses are emailed, then customize the notification content and recipients where the setup offers that action.

The BAA path can differ by account. It can request a Formesign BAA, recognize an active agreement, or offer Copy form into the Formesign HIPAA workspace. Follow the account-specific explanation; do not assume that choosing a form label completes an agreement.

Confirm the result with synthetic data

Submit a fictional patient example and inspect the staff email, response access, exported data and configured Drive/Sheets destinations. A protected field can still appear if you manually type its value into a subject or add a sensitive attachment. Check the complete delivered output.

Check the wider service arrangement

Google describes the agreement and included-service scope for customers using its services under HIPAA in its Workspace HIPAA guidance. HHS explains that cloud use also involves organizational safeguards and appropriate agreements in its cloud-computing guidance.

Use the wizard's result as a record of its configured checks, not an independent certification of your organization. Review PHI notifications and exports and data access when deciding who can use the submitted information.