General information, not legal advice — confirm with your compliance officer or attorney.
HIPAA compliant forms aren't a feature you switch on. A form is only as safe as every place its answers travel: the page it sits on, the connection, the database, the notification email and the people who can open it. This guide follows a submission from end to end, then links to dated, source-checked reviews of the form tools practices use most.
The question comes up constantly. "hipaa compliant forms" is searched about 880 times a month (average CPC $33.55). "hipaa compliant web forms," "online forms" and "website forms," which Google groups together, add 390 more (CPC $47.79), and "hipaa compliant form builder" another 390 (CPC $62.56) (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
When a website form is covered by HIPAA
HIPAA applies to health care providers that transmit health information electronically in connection with standard transactions such as insurance claims, and to their business associates (HHS (opens in a new tab)). If your practice bills insurance electronically, assume HIPAA applies to the information your website forms collect.
What makes a submission protected health information (PHI) is the combination: an identifier, such as a name, email or phone number, plus anything about the person's health, care or payment for care. HHS's online tracking bulletin (opens in a new tab) uses a website example: when someone makes an appointment and enters their email address or "reason for seeking health care," that information is individually identifiable health information.
In practice:
- Newsletter sign-up with only an email address: generally not PHI.
- Contact form with name, phone and "How can we help?": PHI the moment someone types "I need help with my back pain."
- Appointment request with a reason for visit: PHI.
- Intake form with history and medications: PHI, and lots of it.
What makes a form HIPAA compliant, end to end
| Stage | What can go wrong | What good looks like |
|---|---|---|
| The page | Ad pixels or analytics read what's typed | No third-party tracking on form pages |
| Transport | Data intercepted in transit | HTTPS everywhere |
| Storage | Unencrypted entries on an uncovered server | Encrypted at rest, with a vendor that signs a BAA |
| Notification | Full answers emailed to a shared inbox | An alert only; answers read in the secure system |
| Access | Everyone can see everything | Named staff, individual logins, an audit log |
| Retention | Submissions kept forever, in several places | A set retention period, then deletion |
The rules behind those rows come from the Security Rule. It requires technical safeguards for access control, audit controls, authentication and transmission security, and lists encryption both at rest and in transit as addressable specifications (45 CFR 164.312 (opens in a new tab)). HHS explains that "addressable" does not mean optional: you implement it when reasonable and appropriate, or document an equivalent alternative (HHS Security Rule summary (opens in a new tab)).
Any vendor that stores submissions for you is a business associate and needs a BAA, even if it only holds encrypted data it can't read (HHS cloud guidance (opens in a new tab)). The form is one part of a wider setup covered in HIPAA compliant websites.
Finally, ask less. The minimum necessary rule asks practices to limit PHI to what a purpose needs (HHS (opens in a new tab)). A contact form needs a name, a way to reply and a short message. It doesn't need a date of birth.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Tracking scripts on form pages
Advertising pixels and analytics tags on a form page can capture what visitors type, or the fact that they submitted. HHS's online tracking bulletin (opens in a new tab) says tracking technologies on pages where people make appointments or enter symptoms "may have access to PHI," that disclosing PHI to a tracking vendor requires a BAA or the patient's authorization, and that cookie banners "do not constitute a valid HIPAA authorization."
Legal status, checked October 2026: On June 20, 2024, a federal court in Texas (American Hospital Association v. Becerra) vacated part of the bulletin: its position that HIPAA is triggered when tracking connects an IP address to a visit to a public page about a health condition or provider. HHS says it "is evaluating its next steps." The rest of the bulletin, including the appointment and symptom-entry examples, remains published on HHS's site, last reviewed June 26, 2024.
What that means for forms: whatever happens to the public-page question, a form where someone types their name and reason for a visit is not a public page someone merely viewed. Keep pixels off form pages. A free marketing audit checks for privacy risks such as pixels on patient forms.
Contact, appointment request and intake forms compared
| Item | Contact form | Appointment request | Intake form |
|---|---|---|---|
| Purpose | General questions | Get a visit scheduled | Prepare the chart |
| Fields | Name, email or phone, short message | Name, contact, preferred times, short reason | Demographics, insurance, history, medications, consents |
| PHI risk | Moderate: people overshare | Yes | High |
| Where it belongs | Website, BAA-covered tool | Website, BAA-covered tool | Patient portal, EHR or intake software |
| Key control | "Please don't include medical details" | Short, optional reason field | Authentication and signatures |
A field-by-field version of the middle column is in the appointment request form template. For the right-hand column, see patient intake form templates.
Form builders and BAAs
If you use a third-party builder, the BAA, the plan tier and the settings decide whether it's suitable. Each check below was verified on the vendor's own pages and is dated:
- HIPAA compliant form builders compared: BAA availability, required plans and data location for six builders, side by side.
- Is Jotform HIPAA compliant: which plans include HIPAA features, the encryption setting and its effect on notifications.
- Is Google Forms HIPAA compliant: what the Google Workspace BAA covers, and personal accounts versus Workspace.
- Is Microsoft Forms HIPAA compliant: Microsoft's BAA, the external-sharing settings and internal versus patient-facing use.
- HIPAA compliant WordPress forms: plugins, the site database, backups, hosting BAAs and email.
How Medfy's HIPAA-compliant forms work
Medfy builds HIPAA-compliant forms into the practice's own website, included in the base plan.
- Submissions go to the patient CRM and inbox, where access is controlled by role, with an audit log of who saw what.
- Patient information from forms, chat and the CRM is stored in separate, encrypted databases in the US or Canada, and is encrypted in transit and at rest.
- Medfy signs a BAA with every practice before any patient data flows.
- Ad platforms never receive patient data. Marketing reports use aggregate numbers only.
No official certification for HIPAA exists, for Medfy or any other vendor; compliance depends on how a practice and its vendors handle PHI. See how Medfy protects patient data and Medfy pricing.
Frequently asked questions
Are online forms HIPAA compliant?
A form isn't compliant or non-compliant on its own; the setup is. An online form can collect patient information when the vendor that stores submissions signs a BAA, data is encrypted in transit and at rest, notifications don't spread the answers, access is limited to the right staff and no tracking scripts run on the page. Confirm your setup with your compliance officer or attorney.
Does a contact form on a medical website need to be HIPAA compliant?
Plan as if it does. Even a simple 'How can we help?' box invites people to type symptoms, conditions and medications next to their name and phone number. Use a form tool that signs a BAA, ask only for what you need to reply, and add a line asking visitors not to include medical details. Confirm the approach with your compliance officer or attorney.
Can form submissions be sent by email under HIPAA?
HHS says the Security Rule doesn't prohibit sending patient information by email, but it must be adequately protected in transit, and your email provider needs a BAA if messages contain it. The safer pattern is an alert that says a new submission arrived, with staff reading the answers inside the secure system. Check your email setup with your compliance officer.
What makes a form builder HIPAA compliant?
No builder is compliant by itself, but the right one makes compliance possible. Look for a signed BAA on the plan you buy, encryption in transit and at rest, individual logins with an audit log, notification settings that keep answers out of email, retention you control, and limits on integrations. Our comparison lists what each major builder publishes about these.
Is a free HIPAA compliant form builder safe to use?
Check whether the free plan includes a signed BAA before anything else. In our October 2026 checks, none of the free tiers we compared did; HIPAA features sat on paid plans or add-ons. A free tool is fine for forms that never collect health information, such as a staff survey. Confirm any tool with your compliance officer before patients use it.