Last verified: October 22, 2026, against SurveyMonkey's HIPAA page, its HIPAA help article and its pricing page. General information, not legal advice.
SurveyMonkey can be used for patient surveys, but only on its Enterprise plan, with a HIPAA-enabled account and a signed business associate agreement (BAA). Every other plan, including the free one, is off-limits for protected health information. That's the short version of "is SurveyMonkey HIPAA compliant," a question US searchers type about 70 times a month, with advertisers paying around $20.23 per click (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
Short answer from SurveyMonkey's own documentation
Short answer (verified October 2026): SurveyMonkey's HIPAA page (opens in a new tab) says "HIPAA-enabled accounts are only available with SurveyMonkey Enterprise" and "SurveyMonkey offers a business associate agreement (BAA) to Enterprise customers." Its help article (opens in a new tab) adds: "we do not permit users to store PHI in regular accounts," and "Once an account is HIPAA-enabled, it cannot be reverted to a non-HIPAA account."
The help article also lists what changes once HIPAA is on:
- Session timeout. "We timeout user sessions after 30 minutes of inactivity."
- Logging. Access logs exist, but "there isn't a way to access these logs within your account."
- Collectors. For PHI, SurveyMonkey recommends a Web Link Collector and says "We do not recommend the use of an Email Invitation Collector."
- Exit. If the BAA ends, "your HIPAA-enabled account or team will be closed."
What HIPAA requires before patient information goes in
A survey vendor that stores your patients' answers is holding protected health information (PHI) for your practice. HIPAA allows that only after you get documented "satisfactory assurance" that the vendor will safeguard it (45 CFR 164.502(e) (opens in a new tab)), in a written contract that meets 45 CFR 164.504(e) (opens in a new tab). Our guide to business associate agreements covers what that contract must say.
The BAA covers SurveyMonkey's handling. Your side covers who sees results, where exports go and what you ask. SurveyMonkey's own help article puts several of those on you: encrypt downloaded files, share surveys only with authorized staff, and "Only disclose results to authorized recipients."
Before you send another patient survey, check the page it links from. The free marketing audit flags privacy risks such as ad pixels on pages that collect patient information.
Which SurveyMonkey plans a BAA can cover
| Plan (as named on SurveyMonkey's pricing page) | HIPAA-enabled account and BAA? |
|---|---|
| Basic (free) | No |
| Standard and other individual plans | No |
| Team Advantage | No |
| Team Premier | No |
| Enterprise (5-user minimum, priced through sales) | Yes |
Getting set up takes a conversation, not a toggle. New customers contact sales; existing Enterprise customers contact their Customer Success Manager. Enabling HIPAA is permanent for that account, so practices that also run non-patient surveys may want a separate, regular account for those.
Patient surveys: when answers become PHI
Under 45 CFR 160.103 (opens in a new tab), health information is individually identifiable when it is created or received by a health care provider, relates to a person's health, care or payment for care, and "identifies the individual" or could reasonably be used to. A survey can cross that line in two ways: the questions or the delivery.
Illustrative example: Lakeview Orthopedics emails a survey to last week's patients: "How was your recovery after your knee injection?" The respondent's email address identifies them, being on the list shows they're a patient, and the question names a treatment. Those responses are PHI.
Things that tend to make survey data PHI:
- Sending through an email invitation tied to your patient list
- Asking about symptoms, treatments, providers seen or visit reasons
- Free-text boxes where patients describe their care, whatever you asked
- Collecting name, phone, date of birth or appointment date alongside answers
A truly anonymous web link with no identifying fields and no health questions, such as "Was parking easy to find?", is lower risk. Free-text answers still need watching: patients volunteer details.
Safe uses and unsafe uses for a practice
| Use | Account | Verdict |
|---|---|---|
| Staff engagement or scheduling-preference poll | Any | Safe: no PHI |
| Feedback from referring offices about your referral process | Any | Safe if no patient is discussed |
| Post-visit satisfaction survey emailed to patients | Regular account | Unsafe: PHI with no BAA |
| The same survey through a web link | HIPAA-enabled Enterprise, BAA signed | Appropriate |
| Symptom or intake screener before a first visit | HIPAA-enabled Enterprise | Possible, but an intake tool may fit better |
| Exporting responses to a shared spreadsheet | Any | Unsafe unless the destination is covered and encrypted |
Safer setup or alternatives
If you're on Enterprise and need patient surveys:
- Sign the BAA and confirm the account shows as HIPAA-enabled.
- Use web link collectors, not email invitations.
- Ask only what you'll act on, and avoid free-text boxes where you can.
- Limit survey sharing to named staff and encrypt any export.
- Keep a separate regular account for staff and community polls, since HIPAA mode can't be reversed.
If Enterprise is more than you need, compare HIPAA options among form builders, and if your practice runs on Google Workspace, read our Google Forms verdict first. Every tool we've checked is in the HIPAA and marketing software hub.
Medfy doesn't sell SurveyMonkey or run patient surveys. The overlap is your website's own forms: Medfy's HIPAA-compliant forms put each submission in separate, encrypted HIPAA databases in the US or Canada, and Medfy signs a BAA with each practice for its own services. See how Medfy handles patient data.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Will SurveyMonkey sign a BAA?
Yes, for Enterprise customers. SurveyMonkey says it "offers a business associate agreement (BAA) to Enterprise customers" and that its standard form BAA meets HIPAA's requirements. New customers go through sales; existing Enterprise customers ask their Customer Success Manager. The BAA comes with a HIPAA-enabled account, which can't later be switched back to a regular account. Verified October 2026.
Is the free version of SurveyMonkey HIPAA compliant?
No. HIPAA-enabled accounts are only available on SurveyMonkey Enterprise, and SurveyMonkey says it does not permit users to store PHI in regular accounts. The free Basic plan is a regular account. Use it only for surveys that collect no patient information, such as staff polls or questions to other practices, never for anything sent to patients that asks about their care.
Can a practice use SurveyMonkey without patient information?
Yes, on any plan, as long as no response can be tied to a patient's health or care. Staff engagement surveys, vendor feedback and anonymous community polls that never ask about treatment qualify. A satisfaction survey emailed to your patient list is different: the email address plus the visit details make responses PHI, so it needs a HIPAA-enabled account and a BAA.
What is a HIPAA-compliant alternative to SurveyMonkey?
Several form and survey tools sign BAAs on higher plans, and some EHR and patient-messaging platforms include satisfaction surveys under the BAA you already have. Compare them on the same test: a signed BAA for your exact plan, secure delivery that avoids emailing answers, and access limited to staff who need it. Check what your EHR offers before buying another tool.