thank you for all this great info on making Google forms! I am going to try it this year for my therapy data.

The answer is: It Depends on following some important rules-

1) You MUST have a Business Associates Agreement with Google (you can ONLY get this if you are a Google Apps user–monthly fee of at least $5/mo)–so without this, you are automatically NOT HIPAA compliant.

2) How you send data is really important. For instance, regular ol’ email even with Google Apps — NOT HIPPA compliant when you send PHI. You will need to encrypt the email. There are some ways to do that using 3rd party extensions, but Google does not offer this by default.

3) How you transmit data is also very important. It’s your responsibility to ensure your connection is secure. Using the Free Public Wifi at the Airport—very risky, MAY NOT be HIPAA compliant.

4) How you store data and protect that data with TWO layers of security is also key. HIPAA says “Two layers” of protection are needed. So one MAY interpret that as meaning a single password to get to the data is not enough. 2-step verification is a good antidote for this problem. Highly recommended. IN ADDITION, you must ensure those files on G-Drive are stored in such a way that they are not discoverable. So using “unique links” that anyone who has can see…that may not be HIPAA compliant–see “two layer” rule.

5) Where you save data to from G-Drive is probably the area that exposes you to being most at risk for not being HIPAA compliant. Lots of people click on a doc in G-Drive and it downloads it to whatever computer they’re on. Is this computer the covered entity’s? If it is a personal computer and this is for your work-place…you may have just broken HIPAA. Same goes for your phone. Again you need TWO layers of security AND your device needs to be encrypted. Google Apps for Business is encrypted but the second you “save the document” by downloading it (versus viewing it in the browser where it stays on Google servers), you have made an unencrypted copy on a local device. If that device is not encrypted the second you download the document you have violated HIPAA. The SECOND YOU DOWNLOAD IT. Erasing it doesn’t count. So to be safe, encrypt all your devices (you can turn this setting on quite easily for your computer–and is a MUST for laptops), and you should use a password (ALWAYS). AND you should ensure there is an additional layer of security somewhere in there (locking your laptop away at all times counts as a layer of security).