No. Gravity Forms does not offer a business associate agreement (BAA) on any plan, so a clinic cannot rely on the vendor to cover PHI collected through its forms. The vendor says it does not host or store form data, and any PHI use depends on your own host, storage and add-ons.
Is Gravity Forms HIPAA compliant? BAA by plan, covered services and exclusions
No (last verified 2026-10-20) No BAA is available on any plan (Basic, Pro, Elite, Nonprofit). The main exclusion is that the vendor does not host or store form data and will not sign a BAA.
This page reports the vendor's published wording. It does not audit the product and is not legal advice. For vendors that do offer a BAA, see HIPAA-compliant forms by category. The full vendor list is at Is it HIPAA compliant? All vendors.
Short answer
Gravity Forms is a self-hosted WordPress plugin. The vendor states that it does not host or store form data, and it will not sign a BAA. A BAA is the written agreement a HIPAA-regulated organization needs with any vendor that handles PHI on its behalf.
Because the vendor is not in the data path, compliance depends on your web host, your database storage and every add-on that touches entries. Per vendor documentation, form data at rest is not encrypted by default.
Take a physical therapy practice with a new-patient intake form on its WordPress site. Gravity Forms builds the form, but the submitted answers live wherever your site stores them. That makes your host and your configuration the question, not the plugin vendor.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Basic | No | Not offered. The vendor directs customers to their website host or data services provider. | Not published by the vendor |
| Pro | No | Not offered. The vendor directs customers to their website host or data services provider. | Not published by the vendor |
| Elite | No | Not offered. The vendor directs customers to their website host or data services provider. | Not published by the vendor |
| Nonprofit | No | Not offered. The vendor directs customers to their website host or data services provider. | Not published by the vendor |
A higher plan does not unlock a BAA.
What the BAA covers and what it excludes
Covered: nothing, because the vendor offers no BAA.
Excluded: the vendor publishes no feature-level exclusions. The whole product falls outside any BAA from the vendor.
A BAA with your web host or data services provider is a separate agreement. It is not covered by this page's verdict, and this page does not assess it.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | No |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Controlled by the website administrator (self-hosted) |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" means the vendor's HIPAA documentation does not state it. It does not mean the control is absent.
How to use Gravity Forms with PHI
Using a compliant host does not make Gravity Forms compliant on its own. Compliance depends on the signed BAAs, your configuration and your policies, not on the plugin alone. If your forms run on WordPress, read Is WordPress HIPAA compliant? for the platform and host side. Use this checklist as the minimum before any form collects PHI:
- Decide whether the form should collect PHI at all. A "request a callback" form with name and phone number is a different risk than a symptom questionnaire.
- Confirm your web host will sign a BAA and that it covers the server and database where entries are stored.
- Check the storage chain. If entries sit in a database, backup or file store managed by another provider, that provider needs its own BAA.
- Enable and verify encryption of stored data yourself. The vendor documents that it is not on by default.
- Review every add-on or integration that receives entries, such as email notifications, CRMs or automation tools. Each one needs its own BAA before PHI passes through it.
- Restrict who can view entries. Front-desk staff who only schedule visits should not have access to intake answers they don't need.
- Document policies and staff training for who handles form submissions and how they are retained or deleted.
Alternatives with a BAA
These forms tools publish BAA availability on specific plans. Each verdict is conditional, and the linked page has the sources and exclusions.
- Formstack: conditional. BAA from the Forms with HIPAA add-on.
- Google Forms: conditional. Paid Google Workspace editions administered in the Admin console.
- Hushmail for Healthcare: conditional. Healthcare Basic plan.
- Jotform: conditional. Gold plan.
- Microsoft Forms: conditional. Office 365 / Microsoft 365 commercial subscriptions.
A BAA is necessary but not sufficient. Using any of these tools does not by itself make an organization compliant.
Sources
- HIPAA and Gravity Forms – Gravity Forms Documentation — Help article, checked 2026-10-20. "As we do not host or store your collected form data on your behalf, we will not sign any such agreements. This is a conversation to be had with your website host or data services provider."
- HIPAA and Gravity Forms – Gravity Forms Documentation — Help article, checked 2026-10-20. "Where your data is sent, and where it is stored is controlled by the website administrator."
- HIPAA and Gravity Forms – Gravity Forms Documentation — Help article, checked 2026-10-20. "By default, The data collected by Gravity Forms is not encrypted during storage."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
Changes: No changes recorded since first verification on 2026-10-20. Recent vendor changes across the directory are listed at /changes/.
Does Gravity Forms sign a BAA?
No. The vendor's documentation says it does not host or store form data and will not sign a BAA, on any plan.
Is Gravity Forms data encrypted at rest by default?
No. Per the vendor's documentation, form data is not encrypted during storage by default. Any encryption of stored entries has to be set up and verified by the site owner.
Who controls where Gravity Forms entries are stored?
The website administrator. Gravity Forms is self-hosted, so storage location follows your hosting and database choices.
Who should I ask for a BAA if I use Gravity Forms on WordPress?
Ask your website host or data services provider, as the vendor directs. Also ask the provider of any add-on or integration that receives form entries.
HIPAA Compliant Wiki is published by Chanty, Inc. Chanty has no relationship to Gravity Forms and is not a forms tool.