Typeform will sign a BAA for forms on its Enterprise and Growth Custom plans only. Every other plan is listed as not eligible, and AI-assisted features are not covered. A clinic can collect PHI in a Typeform form only on an eligible plan with a signed BAA in place.
Is Typeform HIPAA compliant? Verdict
Conditional A BAA is available on the Enterprise and Growth Custom plans for Typeform forms. The main exclusions are AI-assisted features and all other plans.
- Verdict date: 2026-10-19
- Next check: 2027-01-19
See All vendor HIPAA checks for other vendors.
Short answer
Typeform provides a BAA on request from Sales to customers on Enterprise or Growth Custom. Basic, Plus, Business, Talent and Growth Flow are not eligible. AI-assisted features are not covered under Typeform's HIPAA compliance.
This page states the position as "BAA available on plan X for services Y." It does not describe Typeform as certified, and it does not treat "HIPAA compliant" as a property of the product.
Which plans include a BAA
A BAA (see HIPAA glossary: BAA) is the signed agreement that allows a vendor to handle PHI for a covered entity or business associate.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Enterprise | Available | Request from Sales through the help-center link, giving your organization name and the Typeform account email | Not published by the vendor |
| Growth Custom | Available | Same route as Enterprise | Not published by the vendor |
| Free | Not available | No BAA | Not published by the vendor |
| Basic | Not eligible | Typeform names the Request HIPAA Pricing form as its route, but lists the plan as not eligible | Not published by the vendor |
| Plus | Not eligible | Same as Basic | Not published by the vendor |
| Business | Not eligible | Same as Basic | Not published by the vendor |
| Talent | Not eligible | Same as Basic | Not published by the vendor |
| Growth Flow | Not eligible | Same as Basic | Not published by the vendor |
Minimum seats for the BAA: Not published by the vendor.
Practical consequence: a practice on Business that wants to collect patient intake data cannot get a BAA on that plan. It has to move to an eligible plan first.
What the BAA covers and what it excludes
Covered
- Typeform forms on Enterprise and Growth Custom accounts.
Excluded
- AI-assisted features. Typeform states they are not covered under its HIPAA compliance.
Free, Basic, Plus, Business, Talent and Growth Flow accounts have no BAA. Do not collect PHI on them.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | AWS, main servers in Virginia, USA; Enterprise offers choice of US or EU data center |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
Data residency: Typeform runs on AWS, with main servers in Virginia, USA. Enterprise offers a choice of a US or EU data center.
How to use Typeform with PHI
A signed BAA is only the first step. The organization still owns configuration and policy:
- Sign the BAA before any form collects PHI.
- Confirm the account is on Enterprise or Growth Custom, not on a lower plan with the same form copied across.
- Keep AI-assisted features off any form that collects PHI, such as a new-patient intake or symptom questionnaire.
- Manage user access and use SSO, so staff who leave the practice lose access to responses.
- Choose the data center (US or EU) that fits your policies.
- Set internal policies on who may view and export responses, and train staff on them.
Compliance depends on the signed BAA, how the account is configured and the organization's own policies. For other options, see HIPAA-compliant forms software.
Alternatives with a BAA
These forms tools also offer a BAA under specific conditions. They are listed alphabetically, not ranked.
- Formstack (conditional): BAA with the Forms HIPAA add-on. Is Formstack HIPAA compliant?
- Google Forms (conditional): BAA on paid Google Workspace editions. Is Google Forms HIPAA compliant?
- Hushmail for Healthcare (conditional): BAA on the Healthcare Basic plan.
- Jotform (conditional): BAA on the Gold plan. Is Jotform HIPAA compliant?
- Microsoft Forms (conditional): BAA with Office 365 / Microsoft 365 commercial subscriptions. Is Microsoft Forms HIPAA compliant?
Sources
- Business Associate Agreement (BAA) – Help Center — Help article, checked 2026-10-19. "Typeform’s data protection standards are HIPAA compliant and we can currently provide a BAA for customers on our Enterprise or Growth Custom plans."
- Plans & Pricing — Pricing page, checked 2026-10-19. "SSO, HIPAA, GDPR compliance, and your choice of US or EU data center."
- Medical Patient Intake Form — Vendor page, checked 2026-10-19. "but only for customers on the Growth Custom or Enterprise plans, not Growth Flow or lower tiers."
- Security at Typeform – Help Center — Trust center, checked 2026-10-19. "At the moment, the organization successfully passed the first compliance assessment, and as a result, the final report allows the company to sign a BUSINESS ASSOCIATE AGREEMENT with its clients."
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-19. See Recent changes in vendor HIPAA status.
Does Typeform sign a BAA?
Yes, for customers on Enterprise or Growth Custom. The BAA is provided on request from Sales.
Which Typeform plans include a BAA?
Enterprise and Growth Custom. Basic, Plus, Business, Talent and Growth Flow are listed as not eligible, and the Free plan has no BAA.
Are Typeform's AI-assisted features covered by the BAA?
No. Typeform states that AI-assisted features are not covered under its HIPAA compliance, so keep them off forms that collect PHI.
How do I request a Typeform BAA?
Use the Sales link in Typeform's help-center BAA article. Provide your organization name and the email address of your Typeform account.