Last verified: October 2026, against Jotform's HIPAA, pricing and help pages. General information, not legal advice — confirm with your compliance officer or attorney.
Is Jotform HIPAA compliant? Jotform can be used for patient information, but only on its Gold or Enterprise plans, with HIPAA features switched on and a signed business associate agreement (BAA). The settings you choose and where notifications go then decide whether a particular form is actually safe.
Short answer: is Jotform HIPAA compliant?
Short answer (verified October 2026): Jotform's HIPAA page (opens in a new tab) says HIPAA features come with its Gold or Enterprise plan, and that covered entity customers who enable HIPAA compliance features in their account "will also receive a signed Business Associate Agreement (BAA)." Jotform's pricing page (opens in a new tab) lists "HIPAA features: Not available" on the free Starter plan, Bronze and Silver. So: yes on Gold or Enterprise once configured, no on anything below.
It's the most-searched form-builder question we track: "jotform hipaa" gets about 320 searches a month, "jotform hipaa compliant" 260 and "is jotform hipaa compliant" 210 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What HIPAA requires of an online form tool
A form that collects a patient's name with a reason for a visit, symptoms, insurance details or a medical history collects protected health information (PHI). The company that stores those submissions for you is a business associate under HHS's definition (HHS business associate guidance (opens in a new tab)), so you need:
- A signed BAA before the first real submission.
- Encryption in transit and at rest, which the Security Rule treats as an addressable safeguard (45 CFR 164.312 (opens in a new tab)).
- Access limited to the staff who need submissions, with an audit trail.
- A plan for everywhere a submission travels after it's stored: email, PDFs, spreadsheets.
Our business associate agreements guide explains what the BAA itself must say.
Jotform's BAA: which plans include it
| Plan (Jotform pricing, Oct 2026) | Listed price | HIPAA features |
|---|---|---|
| Starter | Free | Not available |
| Bronze | $39/month | Not available |
| Silver | $49/month | Not available |
| Gold | $129/month, or $1,188 a year | Available |
| Enterprise | Custom | Included |
The BAA is tied to switching on HIPAA features in a Gold or Enterprise account. Jotform's HIPAA page lists what those features add: "end-to-end encrypted data," "audit-ready activity logs," secure e-signatures and "protected workflows."
Keep the signed BAA with your other vendor agreements, and re-check the plan whenever someone downgrades to save money. A downgrade can quietly remove the HIPAA features.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Setting up Jotform for HIPAA: the settings that matter
Jotform's form encryption guide (opens in a new tab) describes the main control, set per form:
- Open the form in the Form Builder and go to Settings.
- Toggle Encrypt Form Data to Yes.
- Turn off any features the form uses that encryption doesn't support.
- Verify your account, then create an access code of up to 16 characters for that form.
- Click Enable Encryption.
What changes once it's on:
- Autoresponder emails become unavailable.
- Customizable notification emails become unavailable; you still receive a notification for each new submission.
- All integrations are unavailable except payment gateways.
- Staff enter the access code to read submissions. Jotform says a forgotten code means the data is effectively lost, so store it in your password manager.
Treat those limits as features: they stop answers from leaking into inboxes and third-party apps.
Safe and unsafe uses in a medical practice
| Use | Verdict |
|---|---|
| Staff survey about the new phone system, any plan | Safe; no PHI |
| New-patient appointment request, Gold with HIPAA features and encryption | Appropriate |
| Full medical-history intake, Gold or Enterprise with BAA | Appropriate; see online intake forms |
| Same intake form on a Silver plan | Unsafe: no HIPAA features, no BAA |
| HIPAA form with a Google Sheets integration added | Unsafe unless that destination is covered too |
Jotform's BAA covers Jotform's handling of your data. Your practice still controls who receives notifications, who knows the access code, and where downloaded PDFs end up. A PDF of an intake form saved to an unsecured shared drive is your practice's problem, not Jotform's.
Embedding Jotform on your website and email notifications
Two risks sit outside Jotform itself.
The page around the form. If your website runs advertising pixels or analytics scripts on the page where the form is embedded, those scripts may see what visitors type. HHS's tracking guidance (opens in a new tab) gives the example of a tracking technology collecting an email address or "reason for seeking health care" while someone makes an appointment. Keep pixels off form pages.
The notification email. HHS says the Security Rule doesn't prohibit email for PHI, but it must be "adequately protected" in transit (HHS FAQ (opens in a new tab)). The simple fix: send staff a "new submission" alert with no answers in it, and read submissions inside Jotform.
Alternatives, including forms built into your website
If you only need contact and appointment-request forms, a separate form subscription may be more tool than you need. Compare options in form builders compared, and if your practice runs on Google Workspace, read is Google Forms HIPAA compliant first.
Alternative: forms built into your website. Medfy's base plan includes HIPAA-compliant forms on your own website. Submissions go to the patient CRM and inbox, patient information is stored in separate, encrypted databases in the US or Canada, and Medfy signs a BAA with each practice. See Medfy and patient data.
For the full picture, start with the HIPAA compliant forms guide, or run a free marketing audit to check whether ad pixels sit on your current form pages.
Frequently asked questions
Is Jotform HIPAA compliant on the free plan?
No. As of October 2026, Jotform's pricing page lists HIPAA features as not available on the free Starter plan, and on Bronze and Silver too. Only Gold and Enterprise include them. Even on those plans, the HIPAA features have to be switched on and configured before a form collects patient information. Confirm your plan and setup with your compliance officer or attorney.
Does Jotform sign a BAA?
Yes, on the plans that include HIPAA features. Jotform says covered entity customers who enable HIPAA compliance features in their account will also receive a signed business associate agreement. That means a Gold or Enterprise plan as of October 2026. Download and file the signed copy, check that it matches how you use Jotform, and have your attorney review it.
Can I send Jotform submissions to my email under HIPAA?
It is risky. A notification email that repeats form answers puts patient information in your inbox, so your email provider needs its own BAA and safeguards. With Jotform's form encryption on, customizable notification emails are unavailable, but you still get an alert for each new submission, and staff read the answers inside Jotform. Confirm your email setup with your compliance officer.