On this page
Both can be used with PHI, but only on the right account: Jotform through its HIPAA environment on Gold or Enterprise, and Google Forms only inside Google Workspace after an administrator accepts Google's BAA (Jotform; Google). Neither BAA reaches an ad pixel on the page that hosts the form, and HHS gives a patient typing their reason for an appointment as an example of what tracking code can collect (HHS). Curve Compliance, which also offers Curve Forms for HIPAA intake, checked both vendors' pages on November 9, 2026.
Book a call. Running ads to a patient form? Curve Compliance hosts your intake forms under the BAA it signs on every plan, attaches the ad and campaign to every lead, and never sends form answers to ad platforms. Curve's team does the setup, typically live in about a week. Book a call with Curve.
Jotform vs Google Forms at a glance
| Jotform | Google Forms | |
|---|---|---|
| BAA route | Enable HIPAA features, then sign: “If you’re a Covered Entity that has enabled the HIPAA compliance features in your account, the last step would be to sign the Business Associate Agreement (BAA)” (Jotform) | “Administrators must review and accept a BAA before using PHI in Google services” (Google) |
| Plan or account | “The dedicated HIPAA environment is available as an upgrade for eligible customers on the Gold subscription and on Jotform Enterprise” (Jotform) | Google Workspace and Cloud Identity customers (Google) |
| Where the data lives | “Jotform HIPAA accounts are hosted in a dedicated HIPAA system” (Jotform) | Google Drive, “including Google Docs, Google Forms,” is among the Workspace services included in the BAA (Google Cloud) |
| Add-ons and integrations | Jotform “will only allow certain widgets and integrations” in the HIPAA environment (Jotform) | “Third-party applications including add-ons are not included in the Included Functionality covered by the BAA” (Google) |
| Ad pixel on the page around the form | Reports to the ad platform that made it, which isn't a party to your Jotform BAA | Reports to the ad platform that made it, which isn't a party to your Google BAA |
Directory entries: Jotform and Google Forms. For more builders, see Jotform alternatives for healthcare.
Google Forms and the Workspace BAA
Google says Workspace and Cloud Identity customers “who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google,” and that “Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services” (Google). Google Forms is covered through Google Drive on Google's list of Workspace services in the BAA (Google Cloud).
Two limits matter for clinics. First, Google says “Google Cloud and Google Workspace support HIPAA compliance within the scope of a Business Associate Agreement, but ultimately you are responsible for evaluating your own HIPAA compliance” (Google Cloud). Second, add-ons fall outside the BAA, so a form add-on that emails or syncs responses needs its own review (Google). Google's HIPAA page describes the BAA for Google Workspace and Cloud Identity customers, accepted by an administrator, which is why a personal account is a different situation.
Jotform's HIPAA environment
Jotform says “When you enable the HIPAA environment, all your data is migrated to the dedicated environment to help support HIPAA guidelines.” Its upgrade wizard first checks your subscription, then reviews your forms: “To help avoid HIPAA compliance issues, Jotform will only allow certain widgets and integrations,” and it lists any elements it determines unsuitable (Jotform).
The last step is the BAA. A Covered Entity customer that has enabled the HIPAA features “can request a BAA signed by Jotform” from the account's Data page (Jotform), and afterwards “The HIPAA Compliance badge is automatically added to your account and forms” (Jotform). See our Jotform verdict for the risks that remain.
The page around the form: pixels and thank-you pages
Many form setups put the form on a page of your own site, embedded or linked, and send people to a thank-you page after they submit. Both pages can carry tags. Meta describes its pixel as “a piece of code that you put on your website” and says it “will log when someone takes an action, also called an event, on your website” (Meta). HHS gives the risk in one line: “tracking technologies might collect an individual's email address, or reason for seeking health care typed or selected by an individual” when someone makes an appointment (HHS).
- Check the hosting page. List every tag that loads on the page with the form, including tags loaded by a tag manager.
- Check the thank-you page. Its address often names the service, and a conversion pixel there sends that address with the event.
- Keep answers out of redirects. If the form passes answers to the next page in its address, any tag on that page can read them.
Whether a form page collects PHI depends on what it asks, so talk to your counsel about your own pages. For the wider picture, see what website tracking sends from a health site.
A third option built for ads: Curve Forms
If the form exists to turn ad clicks into patients, Curve Forms were built for that job. Every form is hosted by Curve under the BAA Curve signs on every plan, so a submission never passes through a third-party form tool. The visitor's ad and campaign are attached to each lead automatically, and the submission fires a form event that reaches Meta, Google Ads and your other destinations through your event mappings, while form answers, page titles and free text are never sent.
Curve Forms can screen people out by age, service area or insurance with their own end screens, and screened-out submissions send no conversion, so the platforms learn from eligible leads. Logic shows or hides fields based on earlier answers, and after submit you can redirect people to your booking page.
How Curve Compliance helps
Curve Forms give clinics HIPAA-hosted intake and lead forms with ad attribution attached. Each lead arrives in the Leads inbox with its answers, UTMs and ad click ID, plus your team's notes. Notification emails reach your team with Reply-to set to the respondent, separate checkboxes capture privacy consent and marketing consent, and every view or export of submissions is logged.
Beyond forms, Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, with a fixed list of fields for each platform, and strips PHI before data reaches an ad platform. Curve is SOC 2 Type II, signs a BAA on every plan, and its team does the setup, typically live in about a week. Book a call to see a form like yours tracked from ad click to lead.
Sources, checked November 9, 2026: Jotform How to Enable the HIPAA Environment and How to Receive a BAA; Google HIPAA Compliance with Google Workspace and Cloud Identity and HIPAA compliance on Google Cloud and Google Workspace; Meta, About Meta Pixel; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
Frequently Asked Questions
Is Jotform or Google Forms better for HIPAA?
Both work under a signed BAA: Jotform on its Gold or Enterprise plan with the HIPAA environment turned on, and Google Forms inside Google Workspace once an administrator accepts Google's BAA (Jotform; Google). Pick the one that matches the account you already run, then keep ad pixels off the form and thank-you pages.
Is Google Forms HIPAA compliant?
It can be used with PHI inside Google Workspace after an administrator accepts Google's BAA, since Google Forms is covered through Google Drive (Google; Google Cloud). See Google Forms in the BAA Directory.
Is Jotform HIPAA compliant?
On Gold or Enterprise, with the HIPAA environment enabled and a BAA requested from Jotform (Jotform; Jotform). See Jotform in the BAA Directory.
Can I use a personal Gmail account for patient forms?
Google describes its BAA for Google Workspace and Cloud Identity customers, accepted by an administrator, and says customers who have not signed one “must not use PHI” in its services (Google). Plan on a Workspace account with the BAA accepted before any patient form goes live.
Which is better for patient intake?
For simple internal forms, the one that fits the account you already run. For intake that comes from ads, Curve Forms attach the ad and campaign to every lead and send only neutral form events to ad platforms.
Does the form tool's BAA cover my Meta pixel?
No. A pixel on your page reports to Meta, which isn't a party to your BAA with Jotform or Google, and Google says even third-party add-ons inside Workspace fall outside its BAA (Google).
Does enabling HIPAA move my existing Jotform forms?
Yes. Jotform says all your data is migrated to the dedicated HIPAA environment, and its wizard flags widgets and integrations it determines unsuitable (Jotform).
Talk to Curve Compliance
Book a call. Want patient forms that credit every lead to its ad without sending answers to Meta or Google? Curve Forms are hosted by Curve under the BAA it signs on every plan, and Curve sends only neutral form events server-side. Curve's team does the setup, typically live in about a week. Book a call with Curve.