Conditional A BAA is available on request under contract, negotiated with covered entities or business associates, and Qualtrics does not publish which products or plan tiers it covers. Verdict date: 2026-10-20. See all checks in Is it HIPAA compliant? All vendors.
Short answer
Qualtrics signs a business associate agreement (BAA) with covered-entity customers under enterprise contracts. It publishes no product-by-product or tier-by-tier coverage list and no pricing for BAA customers.
A Qualtrics help article says Qualtrics complies with HIPAA only to the extent HIPAA imposes obligations on Qualtrics as a business associate. That is a limit on scope, not a blanket statement about the platform. A clinic that wants a patient-experience survey with PHI in it needs the contract to name the products in scope.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Not published by the vendor | Available on request | Negotiated with the customer contract; only for covered entities or business associates | Not published by the vendor |
Minimum seats and pricing: Not published by the vendor. No plan names or tiers are listed in the sources checked, so none appear here.
What the BAA covers and what it excludes
Covered services
- None published by the vendor.
- The cited help article is about Digital Experience Analytics and says Qualtrics signs BAAs that allow it to process PHI. That is the only scope language on the pages checked.
- This page does not infer that the survey tool, XM products or anything else is covered. Whether the help article's scope extends beyond Digital Experience Analytics is not stated.
Excluded features
- None published by the vendor.
- Request a written list of in-scope products and features in the contract itself. If a feature you plan to use, such as a patient follow-up survey with free-text answers, is not on that list, treat it as out of scope until Qualtrics confirms otherwise in writing.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Yes |
| ISO 27001 | Yes |
SOC 2, HITRUST and ISO 27001 are security attestations and certifications. None of them is a HIPAA certification, and none makes an organization HIPAA compliant. Report dates, scope, and whether HITRUST covers the products you would use are not published on the pages checked.
How to use Qualtrics with PHI
HIPAA compliance of a deployment depends on the signed BAA, your configuration and your policies. Before any PHI enters a survey, work through this checklist (more in HIPAA guides):
- Sign the BAA first. No PHI goes into any Qualtrics project until the agreement is executed.
- Get the covered products in writing. The BAA or an order form should name each product and feature in scope.
- Confirm you qualify. Qualtrics's sources limit BAAs to covered entities and business associates. Check where your organization falls before you start negotiating.
- Limit identifiers in survey design. Do not ask for names, dates of birth or MRNs unless the use case requires them. Keep free-text fields from inviting clinical detail.
- Manage user access and offboarding. Remove departed staff and vendors from projects and distribution lists promptly.
- Ask Qualtrics about gaps. Encryption at rest, audit logging and data residency are not published, so get them confirmed in writing.
- Set staff policies and training. Staff need to know which surveys may contain PHI and which may not.
Alternatives with a BAA
These form and survey tools offer a BAA under stated conditions. Each is conditional, and none is ranked or preferred here. Compare them in HIPAA-compliant software by category.
- Formstack: conditional, Forms HIPAA add-on.
- Google Forms: conditional, Google Workspace paid editions.
- Hushmail for Healthcare: conditional, Healthcare Basic.
- Jotform: conditional, Gold.
- Microsoft Forms: conditional, Office 365 / Microsoft 365 commercial subscriptions.
Sources
- Data Security & Privacy for Digital Experience Analytics — Help article, checked 2026-10-20. "we sign BAAs with our customers that are covered entities that allow us to process PHI."
- Data Security & Privacy for Digital Experience Analytics — Help article, checked 2026-10-20. "Qualtrics complies with HIPAA to the extent it imposes obligations on Qualtrics as a business associate."
- Qualtrics Security and Privacy Accreditations — Trust center, checked 2026-10-20. "HITRUST certification ensures that Qualtrics meets the most rigorous requirements for healthcare and beyond."
- Qualtrics Security and Privacy Accreditations — Trust center, checked 2026-10-20. "we encrypt all data in transit using Hypertext Transfer Protocol Secure (HTTPS)"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Will Qualtrics sign a BAA?
Qualtrics's sources say it signs BAAs with covered entities and business associates, negotiated in the customer contract. They do not say it signs a BAA with every customer.
Which Qualtrics plans or products are covered by the BAA?
Not published by the vendor. The only scope language on the pages checked is a help article about Digital Experience Analytics. Ask for a written product list in the contract.
Does Qualtrics publish its HIPAA pricing or minimum seats?
No. Pricing, minimum seats and any extra cost for a BAA are not published by the vendor.
Does Qualtrics hold HITRUST, SOC 2 and ISO 27001?
Yes, Qualtrics lists all three. Report dates and scope are not published on the pages checked. None of them is a HIPAA certification.
Can I collect PHI in Qualtrics without a BAA?
The sources checked describe Qualtrics processing PHI under a signed BAA and give no basis for collecting PHI without one. Do not enter PHI before the agreement is signed.