Last verified: October 2026, against each vendor's own HIPAA and pricing pages. General information, not legal advice — confirm with your compliance officer or attorney.
A HIPAA compliant form builder is one that signs a business associate agreement (BAA) on the plan you actually buy, protects submissions in transit and at rest, and lets you keep answers out of email. This comparison has no stars or rankings. It lists what each vendor publicly states, with links, so you can check the facts yourself before you choose.
"hipaa compliant form builder" is searched about 390 times a month at an average of $62.56 per click; "is typeform hipaa compliant" gets 40 searches, "free hipaa compliant forms" 30 and "is formstack hipaa compliant" 20 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What a HIPAA compliant form builder must provide
A form builder that stores patient submissions for your practice is a business associate under HHS's definition (HHS business associate guidance (opens in a new tab)). At minimum, look for:
- A signed BAA for your plan. Check it against what a BAA must contain.
- Encryption in transit and at rest.
- Access controls: individual logins, role-based permissions and an audit log.
- Notification controls, so staff are alerted without the answers being emailed.
- Retention and deletion you control.
- Integration limits, because every connected app is another place PHI lands.
BAA availability and the plan tier it requires
The pattern across vendors is consistent: HIPAA sits on higher tiers or comes as an add-on.
| Vendor | Plan needed for HIPAA (Oct 2026) | How the BAA is offered |
|---|---|---|
| Jotform | Gold ($129/month) or Enterprise | Signed BAA when HIPAA features are enabled |
| Google Forms | A Google Workspace subscription | Workspace BAA accepted by an admin in the Admin console |
| Microsoft Forms | A commercial Office 365 / Microsoft 365 subscription, or GCC | Included by default through Microsoft's Data Protection Addendum |
| Formstack | HIPAA add-on to the Forms ($83/month billed annually) or Suite plan; included in Enterprise and Salesforce Solutions | "Formstack's Standard BAA," or a custom BAA after review |
| Typeform | Enterprise only | Pricing page links a BAA article (not reviewed here) |
| Cognito Forms | Enterprise | Not stated on the pages checked |
Comparison: Jotform, Google, Microsoft, Formstack, Typeform, Cognito
| Vendor | BAA available | HIPAA-specific features (vendor's words) | Data location | Official page | Last verified |
|---|---|---|---|---|---|
| Jotform | Yes, Gold and Enterprise | "End-to-end encrypted data," "audit-ready activity logs," secure e-signatures | Not stated on HIPAA page | Jotform HIPAA (opens in a new tab) | Oct 22, 2026 |
| Google Forms | Yes, under the Workspace BAA | Covered as part of Google Drive; admin sharing controls | Not stated on HIPAA pages | Google HIPAA list (opens in a new tab) | Oct 22, 2026 |
| Microsoft Forms | Yes, under the DPA | Encrypted "both at rest and in transit"; admin external-sharing controls | Most Office 365 services let customers choose a data region | Microsoft HIPAA (opens in a new tab) | Oct 22, 2026 |
| Formstack | Yes, standard or custom | Data encryption, user-level permissions, audit logging, field and folder security | Not stated | Formstack HIPAA (opens in a new tab) | Oct 22, 2026 |
| Typeform | Enterprise only | HIPAA listed as "Enterprise only" | US or EU data center (Enterprise) | Typeform pricing (opens in a new tab) | Oct 22, 2026 |
| Cognito Forms | HIPAA listed on Enterprise; BAA not stated | Field-level data encryption, audit log | Not stated | Cognito security (opens in a new tab) | Oct 22, 2026 |
Sources for the plan details: Jotform pricing (opens in a new tab), Google's Workspace HIPAA page (opens in a new tab), Microsoft's Forms security page (opens in a new tab), Formstack pricing (opens in a new tab) and Cognito Forms pricing (opens in a new tab).
Plans and BAA terms change. For deeper, dated checks, see the Jotform HIPAA check, the Google Forms HIPAA check and the Microsoft Forms HIPAA check.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Free plans: what you give up
None of the free tiers we checked include HIPAA coverage:
- Jotform Starter (free), Bronze and Silver: "HIPAA features: Not available."
- Typeform Basic, Plus and Business: no HIPAA option; Enterprise only.
- Cognito Forms Free, Pro and Team: HIPAA listed only on Enterprise.
- Google Forms on a personal Gmail account: no Workspace agreement, so no BAA.
A free plan is fine for forms that never touch health information: a staff schedule poll, a continuing-education sign-up. The moment a form asks for a name and a reason for a visit, you need a BAA-covered plan.
Embedding a form builder on your website safely
Most comparisons stop at the BAA. Three risks sit outside the vendor:
- Tracking scripts on the page. An embedded form sits inside your page, and pixels or analytics on that page can see what's typed. HHS's tracking guidance (opens in a new tab) says a tracking technology that collects an email address or "reason for seeking health care" while someone books an appointment is receiving PHI.
- Confirmation emails that repeat answers. Autoresponders that send patients a copy of what they typed, or staff alerts with the full submission, move PHI into email. Jotform switches off autoresponders and custom notification emails when form encryption is on.
- PDFs saved to shared drives. If staff download a PDF of each submission, that copy is governed by wherever it's saved, not by the vendor's BAA.
WordPress sites add a fourth risk, the site database; see WordPress form plugins and HIPAA.
A form builder vs forms built into your website
When a dedicated builder is the better fit: long intake packets, e-signatures, conditional logic, or a website you're keeping as it is. Jotform and Formstack publish their BAA terms; choose the plan that includes them.
When Google Forms or Microsoft Forms is the better fit: internal forms for staff, in a Workspace or Microsoft 365 account you already have under a BAA.
When forms built into your website are the better fit: contact and appointment-request forms that should land in one place where staff can act on them. Medfy's base plan includes HIPAA-compliant forms on your own website, with submissions going to the patient CRM and inbox and a BAA signed with each practice. See Medfy pricing.
The HIPAA compliant forms guide covers the whole path a submission takes. A free marketing audit flags privacy risks such as pixels on your current form pages.
Frequently asked questions
What is the best HIPAA compliant form builder for a small practice?
There isn't one best tool. The right one signs a BAA on a plan you can afford, handles the forms you actually need and keeps patient answers out of email. Practices already on Google Workspace or Microsoft 365 under a BAA can start there for internal forms. Long intake packets suit a dedicated builder. Confirm your choice with your compliance officer or attorney.
Is there a free HIPAA compliant form builder?
Not among the free plans we checked in October 2026. Jotform lists HIPAA features as not available on its free plan, Typeform and Cognito Forms list HIPAA only on Enterprise, and Google Forms on a personal Gmail account has no BAA. Google Forms and Microsoft Forms are included in paid Workspace and Microsoft 365 subscriptions you may already have, under those vendors' BAAs.
Is Typeform HIPAA compliant?
Typeform offers HIPAA only on its Enterprise plan. As of October 2026, its pricing page lists HIPAA as Enterprise only, together with a choice of US or EU data center, and shows no HIPAA option on Basic, Plus or Business. Get a signed business associate agreement before any form collects patient information, and confirm the setup with your compliance officer or attorney.
Do I need a BAA with my form builder?
Yes, if your forms collect patient information and the builder stores or processes the submissions. HHS treats vendors that receive or store health information for a practice as business associates. A form that never collects health information, such as a staff lunch survey, doesn't need one. Have your attorney review the BAA and confirm it covers the plan you're on.