The PHQ-9 and GAD-7 Are Free. Here's How to Run Them Without an EHR Module.

The PHQ-9 and GAD-7 are fully in the public domain, yet clinics spend thousands a year on software subscriptions just to put them in front of patients.

Paying for an automated module makes sense at a massive scale, but a smaller practice can administer these same standard screens securely without the premium price tag.

The friction comes down to workflow, not the clinical instruments themselves.

If you know how to configure a secure digital form and map the scoring logic, you can bypass the EHR add-on entirely.

Why do clinics pay for EHR modules to run free clinical screens?

Software vendors do not charge you for the clinical instruments.

The PHQ-9 (Patient Health Questionnaire) and GAD-7 (Generalized Anxiety Disorder) are freely available for clinical use.

Instead, an Electronic Health Record (EHR) vendor charges for the plumbing - the automated delivery, the instant scoring, and the direct write-back to the patient's chart.

Historically, clinics handed patients a paper clipboard in the waiting room.

The patient circled their answers with a pen, and the clinician tallied the score by hand before walking into the session.

As telehealth expanded, that paper workflow broke down.

Patients could no longer fill out forms in a physical waiting room, forcing clinics to digitize their intake process rapidly.

EHR vendors capitalized on this shift by building integrated digital modules that replicate the clipboard experience online.

When a practice pays for a mental health screening module today, they are essentially buying administrative time.

Without that module, clinic staff must manually send the digital form, tally the points, and type the final score into the progress note.

For a solo practitioner or a small clinic, the cost of that software module often outweighs the manual effort required to score a few screens a week.

Here is a breakdown of what you actually get when you pay for the automated route versus building it yourself.

Running a manual workflow does not mean reverting to paper forms and physical clipboards.

You can replicate the digital experience patients expect using form builders you already have access to, provided you configure them correctly.

Is it safe to run a PHQ-9 or GAD-7 online without an EHR?

Safety in clinical data collection means fulfilling two strict requirements: legal compliance and technical security.

You cannot use a basic, free consumer account to collect Protected Health Information (PHI).

Standard free versions of Google Forms or basic survey tools do not meet healthcare privacy standards out of the box because the vendor assumes no legal liability for the data.

However, you can safely run these screens if you use an enterprise-grade workspace environment that supports a Business Associate Agreement (BAA).

A BAA is a legally binding contract where the technology provider accepts responsibility for safeguarding PHI according to HIPAA rules.

Major enterprise platforms like Google Workspace and Microsoft 365 offer BAAs for their paid business tiers.

Once that agreement is signed and active in your admin console, tools like Google Forms or Microsoft Forms become legally viable for patient data.

Expert tip: Signing a BAA is only the first step. You must also configure the platform settings to disable third-party add-ons, prevent external sharing of the results spreadsheet, and enforce two-factor authentication for all staff accounts.

Beyond the software infrastructure, you must also manage clinical consent.

A standalone form does not have the built-in patient portal agreements that an EHR provides.

You need to explicitly state how the data will be used, who will see it, and what the patient should do if they are in immediate distress.

• The emergency disclaimer: Always include a mandatory checkbox acknowledging that the form is not monitored 24/7 and directing patients to emergency services if they are in crisis.
• The consent to treat: Clarify that submitting the form does not automatically establish a provider-patient relationship if it is being used as a pre-intake tool.
• The data handling notice: Briefly explain that the responses will be reviewed by clinical staff and transferred to their official medical record.

Particularly in the mental health space, patients need reassurance that a random digital link is actually a secure channel to their provider.

Adding a clear, professional header with your clinic logo and contact information helps bridge that trust gap and ensures high completion rates.

How do you build a free digital screening form?

Creating the form requires translating a paper layout into a digital flow that prevents user error.

The PHQ-9 and GAD-7 both rely on a Likert scale where patients rate the frequency of their symptoms over a specific timeframe.

If you build this as nine separate drop-down questions, the form becomes tedious to fill out on a mobile phone and difficult to read on the back end.

The most effective format is a multiple-choice grid, which mimics the familiar column structure of the original paper instruments.

When setting up the form, you also need to consider how the data will look when it exports.

Keep the row descriptions concise so the column headers in your destination spreadsheet remain readable.

When writing the introductory text for your form, be clear about the timeframe.

Both instruments require the patient to consider the last two weeks, not their entire life history.

• ❌ Weak: Please rate how often you feel the following symptoms.
• ✅ Strong: Over the last 2 weeks, how often have you been bothered by any of the following problems?

Here is how to configure the build step by step.

1. Set up the multiple-choice grid Create a new form within your secure workspace and add a Multiple choice grid question type. This creates a matrix where the symptoms are listed down the left side, and the frequencies run across the top. Turn on the setting to Require a response in each row so patients cannot accidentally skip a symptom and invalidate the final score.

2. Define the columns and point values The columns must exactly match the validated phrasing of the clinical instruments. Do not alter the standard wording, or you risk changing the sensitivity of the test. Label your four columns exactly like this:

• Not at all
• Several days
• More than half the days
• Nearly every day

To make manual scoring faster later, include the point value directly in the column label. Instead of just Several days, write Several days (1).

3. Populate the rows with the clinical questions Copy the symptom statements for the PHQ-9 or GAD-7 into the row fields. Keep the phrasing identical to the official instrument. For example, row one of the PHQ-9 should read: Little interest or pleasure in doing things.

4. Add the functional impairment question Both the PHQ-9 and GAD-7 include a final, un-scored question asking how difficult these problems have made it to do work, take care of things at home, or get along with other people. Add this as a separate Multiple choice question below the grid. The options should be: Not difficult at all, Somewhat difficult, Very difficult, and Extremely difficult.

5. Isolate the self-harm indicator Question 9 on the PHQ-9 asks about thoughts of being better off dead or hurting oneself. Because this specific question triggers immediate clinical risk protocols, it needs to stand out. If your form builder supports it, you can pull Question 9 out of the grid and make it a standalone required question. This ensures the provider sees the response immediately, rather than letting it blend into a dense block of grid answers.

How do you score PHQ-9 and GAD-7 responses without automated software?

When a patient submits the form, their answers populate a secure spreadsheet.

Without an EHR module to automatically calculate the total, your administrative staff or the clinician must tally the points manually before the session begins.

Both instruments use a simple 0 to 3 scoring system for each question.

• Not at all = 0 points
• Several days = 1 point
• More than half the days = 2 points
• Nearly every day = 3 points

The total score determines the severity bucket, which guides the clinical intervention and treatment planning.

For the PHQ-9, the total score out of 27 maps directly to five clinical severity brackets:

• 0 to 4 points: Minimal or no depression.
• 5 to 9 points: Mild depression.
• 10 to 14 points: Moderate depression.
• 15 to 19 points: Moderately severe depression.
• 20 to 27 points: Severe depression.

For the GAD-7, the total score out of 21 maps to four clinical severity brackets:

• 0 to 4 points: Minimal anxiety.
• 5 to 9 points: Mild anxiety.
• 10 to 14 points: Moderate anxiety.
• 15 to 21 points: Severe anxiety.

Here are two clinical examples demonstrating how to calculate and interpret the results manually from a spreadsheet output.

Clinical example 1: Scoring the PHQ-9 A 34-year-old patient submits their initial intake PHQ-9 prior to their first appointment. Looking at the spreadsheet row, the clinician tallies the specific responses. The patient marked Nearly every day (3 points) for low energy and poor sleep. They marked More than half the days (2 points) for feeling down, poor appetite, and trouble concentrating. They marked Several days (1 point) for little interest in doing things and feeling bad about themselves. They marked Not at all (0 points) for moving slowly and thoughts of self-harm.

The calculation is: (2 x 3) + (3 x 2) + (2 x 1) + (2 x 0) = 6 + 6 + 2 + 0 = 14.

A total score of 14 places the patient at the very top of the "Moderate depression" severity threshold. Because Question 9 was scored as a 0, no immediate crisis protocol is triggered. The clinician notes the score of 14 in the patient's chart and plans to focus the initial assessment on sleep hygiene and energy levels.

Clinical example 2: Tracking the GAD-7 over time A patient returning for their fourth session completes a follow-up GAD-7 to measure treatment progress. The clinician opens the secure spreadsheet and looks at the newest form submission. The patient scored 2 points on three questions and 1 point on the remaining four questions. The calculation is: (3 x 2) + (4 x 1) = 6 + 4 = 10.

A score of 10 lands exactly on the threshold for "Moderate anxiety". However, the true clinical value comes from tracking the change over time. The clinician checks the patient's chart and sees their baseline intake score was 16 (Severe anxiety). A drop from 16 to 10 indicates a clinically significant response to the ongoing treatment. The manual workflow requires the clinician to physically look up that past score, whereas an EHR would typically graph this trajectory automatically.

What are the privacy limits of using free tools for patient data?

Even with a signed BAA, a digital form is only as secure as the human processes surrounding it.

Free or standard workspace tools lack the automated guardrails and audit logs that healthcare-specific software provides.

You have to build your own fences around the data to prevent accidental exposure or unauthorized access.

If a spreadsheet containing PHQ-9 results is left open to the entire clinic staff, you have a HIPAA violation, regardless of whether your vendor signed a BAA.

Use this security checklist to audit your manual screening workflow.

• Restrict spreadsheet access: The destination spreadsheet should only be shared with specific, named email addresses. Never use a "anyone with the link" sharing setting.
• Disable downloading and printing: In your workspace settings, remove the ability for viewers or editors to download the raw spreadsheet locally, print the data, or copy it to personal drives.
• Separate the identifiers: If possible, ask for the patient's initials and date of birth rather than their full legal name, limiting the amount of identifiable PHI sitting in the spreadsheet if a breach occurs.
• Control staff turnover: When an administrator or clinician leaves the practice, their access to the workspace must be revoked immediately. EHRs handle this via role-based access; DIY tools require diligent manual account deletion.
• Enforce a data retention policy: The spreadsheet should act as a temporary transit hub, not a permanent medical record.

This last point is the most common failure point for clinics using DIY tools.

Data retention requires active, disciplined management.

Letting hundreds of patient responses pile up in an external spreadsheet creates a massive liability if that account is ever compromised.

When you store PHI in a secondary location longer than necessary, you unnecessarily increase your attack surface.

Clear out the responses weekly or monthly to minimize your data footprint.

A good practice is to make spreadsheet purging a standard Friday afternoon administrative task.

Once the clinician calculates the score and writes it into the official EHR progress note, the raw form submission has served its purpose and should be deleted permanently.

When should a clinic upgrade from manual screening to EHR software?

There is a distinct inflection point where a manual workflow stops saving money and starts costing you administrative capacity.

When you run a handful of screens a week, the five minutes it takes to tally a score and type it into a chart is negligible.

When you are running dozens of screens a day across multiple providers, those five-minute increments compound into hours of lost clinical time.

You have to weigh the hard cost of the software subscription against the soft cost of human friction and error.

Here is how to evaluate whether your clinic is ready to upgrade to an automated EHR module.

Upgrading makes the most sense when you move from a solo practice to a group model.

More providers mean more points of failure for manual data entry, link sharing, and spreadsheet management.

At that scale, the monthly fee for an EHR screening module becomes an investment in operational stability rather than an unnecessary luxury.

FAQ

Are the PHQ-9 and GAD-7 copyrighted?

The PHQ-9 was developed by Drs. Robert L. Spitzer, Janet B.W. Williams, Kurt Kroenke, and colleagues with an educational grant from Pfizer Inc. Pfizer has since placed the instrument in the public domain, meaning it is free for clinicians to use, reproduce, and translate without paying royalties. The GAD-7 shares a similar open-use status for clinical practice. You do not need a license to administer either screen.

Can I email PHQ-9 forms directly to patients?

You can email a link to a secure digital form, but you should never ask a patient to fill out a PDF and email it back as an attachment. Standard email is unencrypted and highly vulnerable to interception, making it unsuitable for transmitting sensitive mental health data. Always direct the patient to a secure, BAA-covered web environment where their responses are encrypted in transit and at rest.

How long does it take to score a GAD-7 manually?

For an experienced clinician or administrator, manually tallying the seven questions on a GAD-7 takes less than a minute. The time-consuming part is not the math, but rather the workflow surrounding it - locating the correct spreadsheet row, performing the calculation, opening the patient's chart, and typing in the final score. When batched efficiently, manual scoring is a minor administrative task.

Do free form builders offer BAA agreements for HIPAA compliance?

The free, consumer-grade versions of tools like Google Forms, Microsoft Forms, or SurveyMonkey do not offer Business Associate Agreements. To get a BAA, you must upgrade to their paid enterprise or healthcare tiers. Once you are on a compliant tier and have signed the agreement, you can legally configure those form builders to collect patient health information.

Running clinical screens without an EHR module is entirely viable if you respect the technical boundaries. It requires a bit of initial setup and a disciplined approach to data management, but the financial savings for a small practice are substantial. If you are currently dealing with messy paper intakes or unformatted documents, turning a PDF into a Google Form using a tool like Doc2Form can help you digitize those workflows quickly while keeping the data firmly inside your own secure workspace.