Last verified: October 2026, against Gravity Forms and WPForms documentation. General information, not legal advice — confirm with your compliance officer or attorney.
HIPAA compliant WordPress forms are possible, but the plugin is the smallest part of the question. A WordPress form entry can end up in your site's database, your host's backups, a notification email and any add-on you've connected, and each of those places needs safeguards and, usually, a business associate agreement (BAA).
Short answer: can WordPress forms be HIPAA compliant?
Short answer (verified October 2026): Yes, as part of a complete setup, never from a plugin alone. Gravity Forms' HIPAA article (opens in a new tab) says it doesn't host or store your form data, so "we will not sign any such agreements," and that entries aren't encrypted at rest by default. WPForms' documentation (opens in a new tab) says "Entry data is handled completely on your site," and doesn't address HIPAA. Your host, email provider and add-ons carry the HIPAA load.
Searches are small but specific: "hipaa compliant wordpress forms" about 40 a month (CPC $16.88), "gravity forms hipaa" 30 and "is gravity forms hipaa compliant" 30 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
Where WordPress form data goes: database, backups, email, add-ons
Follow one appointment request through a typical WordPress site:
| Where | What's there | Who controls it | Needs a BAA if PHI is there? |
|---|---|---|---|
| WordPress database | The stored entry | Your host's servers | Host: yes |
| Backups | Copies of the database | Host, or a backup plugin's cloud | Yes, whoever stores them |
| Notification email | Often the full answers | Your email provider | Yes |
| SMTP or email-sending service | The message in transit | That service | Yes |
| Add-ons and integrations | Copies sent to CRMs, sheets, marketing tools | Each vendor | Yes, each one |
Two settings matter before anything else. Gravity Forms says "where your data is sent, and where it is stored is controlled by the website administrator." WPForms stores entries by default, and lets you switch that off per form with "Disable storing entry information in WordPress," under Settings > General > Advanced. It can also stop storing visitors' IP addresses and user agents.
Gravity Forms, WPForms and other plugins: what to verify
For any form plugin, check these five things in its own documentation:
- Does the vendor ever receive your entries? Gravity Forms says it doesn't by default; WPForms says entry data is handled on your site.
- Will it sign a BAA? Gravity Forms says no. That's consistent with not holding your data, and it moves the obligation to whoever does.
- Encryption at rest. Gravity Forms says its data is not encrypted at rest by default and needs an add-on or custom code. It names two third-party options, "HIPAA Forms by Code Monkeys" and "Gravity Forms Encrypted Fields" by PluginOwl, and says it doesn't evaluate or support them.
- Can entry storage be turned off? WPForms documents a per-form switch.
- Which add-ons send data elsewhere? Every integration is another vendor holding PHI.
Gravity Forms' own site lists a third-party "HIPAA Web Forms" add-on that sends entries to an outside "HIPAA FORMS SaaS Service" (Gravity Forms (opens in a new tab)). If you use one, its operator is the vendor that needs the BAA.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Hosting and the BAA question
If entries sit in your WordPress database, your host is storing protected health information (PHI) for you. HHS says a cloud provider in that position is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key," and that storing PHI with one without a BAA violates the HIPAA Rules (HHS cloud guidance (opens in a new tab)). Ask your host directly; if it won't sign a BAA, don't store entries there. See HIPAA compliant hosting for what to look for, and is WordPress HIPAA compliant for the platform itself.
Your web developer or agency may also need a BAA if they can access the database. HHS lists IT contractors who maintain systems containing PHI as business associates, and any subcontractor they use needs one with them in turn (HHS business associate guidance (opens in a new tab)). The chain is covered in BAAs with subcontractors.
Encryption, retention and access on a WordPress site
- Encryption. HTTPS everywhere for transit. For stored entries, an encryption add-on or custom code, because the Security Rule lists encryption as an addressable safeguard (45 CFR 164.312 (opens in a new tab)).
- Email. HHS says email isn't prohibited for PHI, but it must be "adequately protected" (HHS FAQ (opens in a new tab)). Set notifications to "new request received" with no answers, or send through an email service that signs a BAA.
- Retention. Delete entries once they're in your practice system. Check that backups age out too.
- Access. Give WordPress admin accounts only to people who need them, with unique logins and two-step sign-in. Editor and author accounts shouldn't see form entries.
- Tracking. Remove ad pixels and analytics tags from form pages, and check again after installing any plugin or theme.
HIPAA-ready form services you can embed in WordPress
Embedding a form service that signs a BAA keeps entries off your WordPress server entirely. Your host then holds no PHI, as long as the embed sends answers straight to the service. As of October 2026:
- Jotform offers HIPAA features and a signed BAA on its Gold and Enterprise plans (Jotform (opens in a new tab)).
- Formstack offers its "Standard BAA" and will review custom BAA requests (Formstack (opens in a new tab)).
Compare more options in embeddable form builders, and read the HIPAA compliant forms guide for the full path a submission travels.
Alternative: move off WordPress forms. Medfy rebuilds your website with HIPAA-compliant forms, stores patient information in separate, encrypted regional databases in the US or Canada, and signs a BAA with your practice. See how Medfy handles patient data, or start with a free marketing audit of your current site.
Frequently asked questions
Is Gravity Forms HIPAA compliant?
Gravity Forms says the question is rarely that simple. The plugin doesn't send or store your entries on its own servers, it won't sign business associate agreements, and entries aren't encrypted at rest by default. Whether your forms are compliant depends on your host, an encryption add-on, your email setup and access controls. Confirm the full setup with your compliance officer or attorney.
Can I collect patient information with a WordPress contact form?
Only if every place the entry goes is covered: a host that signs a BAA for the database and backups, encryption at rest, notifications without answers or through a BAA-covered email service, and no tracking scripts on the page. The simpler route is to embed a form service that signs a BAA and keep entries off your WordPress server. Check the design with your compliance officer.
Does my WordPress host need to sign a BAA?
Yes, if form entries containing patient information are stored in your site's database or backups on the host's servers. HHS says a cloud provider that stores health information is a business associate even if it only holds encrypted data it can't read. If entries never touch your WordPress server, the host may not need one. Confirm with your attorney.