Conditional. Formstack offers a BAA through its standard agreement for Forms, Documents and Sign. On Forms and Suite plans the HIPAA option is a paid add-on, so a base plan alone is not enough to collect PHI. Verified 2026-10-20.
Verdict: conditional
Conditional Verified 2026-10-20.
A BAA is available through Formstack's standard agreement for Formstack Forms, Documents and Sign. HIPAA is an add-on on Forms and Suite plans and is included in Salesforce Solutions and Enterprise. HIPAA features are not part of base Forms and Suite pricing, and Formstack publishes no list of excluded features on the pages checked.
HIPAA Compliant Wiki is published by Chanty, Inc. Chanty has no relationship with Formstack, and placement in our tables is never influenced by payment. See all vendor HIPAA checks for the same format applied to other tools.
Short answer
Formstack provides a standard BAA for accounts and reviews custom BAAs case by case. The accurate wording is "BAA available on the Forms and Suite plans with the HIPAA add-on, and included in Salesforce Solutions and Enterprise, for Forms, Documents and Sign." It is not accurate to call Formstack "HIPAA certified" or to describe Formstack as "HIPAA compliant" as if that were a product property.
Sign the BAA and enable the HIPAA option before any PHI enters a form. A clinic that publishes a patient intake form on a base plan and signs the BAA later has already collected PHI without coverage. For the terms BAA and PHI, see the HIPAA glossary.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Forms | Available with the HIPAA add-on | Formstack's standard BAA | Add-on price: Not published by the vendor |
| Suite | Available with the HIPAA add-on | Formstack's standard BAA | Add-on price: Not published by the vendor |
| Salesforce Solutions | HIPAA included | Not published by the vendor | Included |
| Enterprise | HIPAA included | Not published by the vendor | Included |
For context, Forms starts from $83/month billed annually, before the HIPAA add-on. Minimum seats and the process for obtaining the BAA on Salesforce Solutions and Enterprise are Not published by the vendor.
What the BAA covers and what it excludes
Covered:
- Formstack Forms
- Formstack Documents
- Formstack Sign
Excluded: Formstack publishes no excluded features on the pages checked. Nothing beyond Forms, Documents and Sign is described as covered either.
Third-party tools connected to your forms are outside the facts this check covers. If a form sends submissions to a spreadsheet, CRM or email inbox, each destination needs its own BAA and review before it receives PHI.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
These are controls the vendor states, not certifications. We do not report algorithm or key-management details because Formstack does not publish them in the sources checked.
How to use Formstack with PHI
Compliance depends on the signed BAA, your configuration and your policies. Using Formstack does not make an organization HIPAA compliant by itself. A practical checklist:
- Sign the BAA first. Do this before building or publishing any form that asks for patient information.
- Confirm the HIPAA add-on or plan is active. On Forms and Suite, check that the add-on is on the account. On Salesforce Solutions and Enterprise, confirm that HIPAA is part of your agreement.
- Limit form and submission access. Give access only to staff who need it, for example front-desk staff for intake forms but not for billing forms.
- Review audit logs. Check them on a schedule and after staff changes.
- Collect only necessary PHI. An appointment-request form rarely needs a full date of birth plus insurance ID.
- Train staff and set policies. Cover who may export submissions and where they may be stored.
- Review every connected tool separately.
More implementation guidance is in the HIPAA guides.
Alternatives with a BAA
These vendors offer a BAA for forms or e-signature use. Each needs its own check of plan and covered services.
- Adobe Acrobat
- Adobe Acrobat Sign
- DocHub
- DocuSign
- Dropbox Sign
For a free-form alternative from a large vendor, see Is Google Forms HIPAA compliant?. Browse the full category tables for HIPAA-compliant form tools and HIPAA-compliant e-signature tools. Listing order reflects no paid placement.
Sources
- HIPAA Data Security for Patient Information — Vendor page, checked 2026-10-20. "We provide a standard BAA for all accounts and evaluate custom BAA requests on a case-by-case basis."
- Secure Online Forms for HIPAA — Vendor page, checked 2026-10-20. "Obtain consent with Formstack's Standard BAA, or let us evaluate your custom BAA requests."
- Formstack Pricing — Pricing page, checked 2026-10-20. "Match HIPAA and compliance requirements"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status for updates across the directory.
FAQ
Does Formstack sign a BAA?
Yes. Formstack offers a standard BAA for accounts, covering Forms, Documents and Sign. Sign it, and enable the HIPAA option where it is an add-on, before collecting PHI.
Is the HIPAA option included in every Formstack plan?
No. HIPAA is an add-on on Forms and Suite plans, and the add-on price is Not published by the vendor. It is included in Salesforce Solutions and Enterprise.
Which Formstack products does the BAA cover?
Formstack Forms, Formstack Documents and Formstack Sign. Formstack publishes no excluded features on the pages checked, and third-party tools connected to your forms are not covered by this check.
Can I ask Formstack for a custom BAA?
Yes. Formstack reviews custom BAAs case by case, according to its published wording. Terms, timelines and conditions are Not published by the vendor.