Conditional Verified 2026-10-19. A BAA is available on the Gold and Enterprise plans for HIPAA-enabled Jotform forms. The main exclusions are the Starter (free), Bronze and Silver plans, and any widget or integration that does not support HIPAA. See the full vendor list at Is it HIPAA compliant? All vendors.
Disclosure: this directory is published by Chanty, Inc. Chanty has no relationship with Jotform, and placement on this card does not depend on payment.
Short answer
Jotform offers a business associate agreement (see HIPAA glossary: BAA) on Gold and Enterprise. An account admin enables HIPAA compliance in account settings, then signs the BAA from the account's Data page. Starter (free), Bronze and Silver have no HIPAA features.
Gold starts at $99/month billed annually or $129/month billed monthly, per the pricing page. HIPAA is included with no additional fee.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Starter (free) | Not available | Not available | Not available |
| Bronze | Not available | Not available | Not available |
| Silver | Not available | Not available | Not available |
| Gold | Available | Enable HIPAA in account settings, then Sign BAA on the Data page | No additional fee stated |
| Enterprise | Available | Enable HIPAA in account settings, then Sign BAA on the Data page | Not published by the vendor |
Enterprise pricing and any minimum seat count: Not published by the vendor.
What the BAA covers and what it excludes
Covered
- Jotform forms in a HIPAA-enabled account.
Excluded
- Widgets and integrations that do not support HIPAA. Only HIPAA-friendly ones are allowed in HIPAA accounts.
- Third-party tools connected to forms. The BAA does not extend to them. A clinic that routes submissions into a scheduling system, spreadsheet or email inbox needs a separate BAA with that vendor, and must confirm the connection is permitted in a HIPAA account.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Isolated HIPAA system of local data residency centers (per Jotform FAQ) |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
An evaluator who needs an audit log or a SOC 2 report for the vendor inventory should request it from Jotform directly, because neither is published on the pages cited here.
How to use Jotform with PHI
- Use Gold or Enterprise. Do not collect PHI on Starter, Bronze or Silver.
- Complete the HIPAA enablement wizard: email verification, a strong password, consent to data transfer, and review and migration of existing forms to the isolated HIPAA system.
- Sign the BAA from the Data page before the first intake form goes live.
- Rebuild or review each patient-intake form so it uses only HIPAA-friendly widgets and integrations.
- Decide who in the practice can create, edit and view forms and submissions, and remove access when staff leave.
- Keep a written policy for where submissions go after collection, such as downloads, exports and email notifications.
- Train front-desk and clinical staff on that policy.
Compliance depends on the signed BAA, the account configuration and the organization's own policies. The BAA alone does not make an organization HIPAA compliant. For wider procedures, see HIPAA guides.
Alternatives with a BAA
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Formstack | Conditional | Forms (HIPAA add-on) |
| Google Forms | Conditional | Google Workspace paid editions administered in the Admin console (Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits) |
| Hushmail for Healthcare | Conditional | Healthcare Basic |
| Microsoft Forms | Conditional | Office 365 / Microsoft 365 commercial subscriptions |
| Qualtrics | Conditional | — |
Browse comparable tools in HIPAA-compliant software by category. Guidance on forms tooling is published at chanty.health/tools/forms/.
Sources
- HIPAA Frequently Asked Questions for Web Forms — Help article, checked 2026-10-19. "To enable Jotform’s HIPAA compliance features, you need to have a Jotform Gold or Enterprise plan."
- HIPAA Frequently Asked Questions for Web Forms — Help article, checked 2026-10-19. "HIPAA is included in this cost and there is no additional fee."
- How to Enable HIPAA Compliance? — Help article, checked 2026-10-19. "We are offering HIPAA compliance features on the Gold subscription and on Jotform Enterprise."
- Jotform Features and Pricing — Pricing page, checked 2026-10-19. "HIPAA features: Not available"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Is Jotform HIPAA compliant on the free plan?
No. Starter (free), Bronze and Silver have no HIPAA features and no BAA. Do not collect PHI on them.
Which Jotform plans include a BAA?
Gold and Enterprise. The BAA covers Jotform forms in a HIPAA-enabled account, not widgets or integrations that do not support HIPAA.
How do I sign a BAA with Jotform?
On Gold or Enterprise, enable HIPAA compliance in account settings and complete the enablement wizard. Then select Sign BAA on the account's Data page. Sign it before collecting PHI.
Does Jotform charge extra for HIPAA features?
No additional fee is stated for Gold, where HIPAA is included. Enterprise pricing is not published by the vendor.