HIPAA-Compliant Forms and Form Builders: BAA by Plan, Compared

A form collects PHI the moment a patient types it, so the question is which plan carries the BAA, not whether a tool is "HIPAA compliant." Of the ten form vendors listed here, nine are conditional on a BAA, a specific plan or an admin setting, and one (Gravity Forms) offers no BAA. This page compares them by BAA plan, how to get the BAA and starting price. It sits within HIPAA-compliant software by category.

Disclosure: this directory is published by Chanty, Inc. Chanty does not offer forms, and no placement on this page depends on payment or on Chanty's interest. The broader "hipaa compliant forms" topic is covered separately on chanty.health.

Which form builders will sign a BAA? The short answer

No vendor on this page gets a blanket "compliant." The rule is the same for all of them: a BAA must be signed on a specific plan, and set up as the vendor requires, before any PHI is collected. Most builders put the BAA on a mid or top tier, and some popular tools never sign one.

• Conditional (9): Formstack, Google Forms, Hushmail for Healthcare, Jotform, Microsoft Forms, Qualtrics, SurveyMonkey, Typeform, Wix.
• No (1): Gravity Forms.

For what the agreement does and does not cover, see what a business associate agreement covers. For other tools, see all vendor HIPAA checks.

Comparison table: BAA by plan, how to get it, exclusions

Order is by verdict, then alphabetical. Placement is not paid for and is not influenced by Chanty. "Not published by the vendor" means the vendor does not publish an answer; it does not mean the feature is absent. Prices are as the vendor lists them. Sources and the verification date are in the sources section at the end.

Vendor	Verdict	BAA from plan	How the BAA is obtained	Starting price	Encryption at rest	Audit log
Formstack	Conditional	Forms (HIPAA add-on)	Standard BAA from Formstack; custom BAA requests evaluated case by case; HIPAA is an add-on on Forms and Suite plans. Formstack's own pages also describe HIPAA as a Forms for Healthcare plan or a custom-made account activated through Support	$83/month (Forms, billed annually) plus HIPAA add-on	Yes	Yes
Google Forms	Conditional	Google Workspace paid editions administered in the Admin console (Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits)	Covered once a super administrator accepts the Google Workspace/Cloud Identity HIPAA Business Associate Amendment (Admin console > Account settings > Legal and compliance); no separate Forms BAA	$7/user/month (Business Starter, USD, excluding tax, 1-year annual commitment); €6.80/user/month on the EU-region page	Not published by the vendor	Not published by the vendor
Hushmail for Healthcare	Conditional	Healthcare Basic	Signed BAA provided with Hushmail for Healthcare plans	$11.99/month (solo healthcare practice)	Not published by the vendor	Not published by the vendor
Jotform	Conditional	Gold	Enable HIPAA compliance in account settings, then click Sign BAA on the Data page; a copy is emailed and viewable as View BAA	$99/month (Gold, billed annually; $129/month billed monthly)	Yes	Not published by the vendor
Microsoft Forms	Conditional	Office 365 / Microsoft 365 commercial subscriptions	Included by default via the Microsoft Online Services Data Protection Addendum for covered entities or business associates	Not published by the vendor	Not published by the vendor	Not published by the vendor
Qualtrics	Conditional	Not published by the vendor	Negotiated with the customer contract; only considered when the customer is a covered entity or business associate	Not published by the vendor	Not published by the vendor	Not published by the vendor
SurveyMonkey	Conditional	Enterprise	Contact sales (prospects) or the Customer Success Manager (existing Enterprise customers); HIPAA add-on purchased separately	Not published by the vendor	Yes	Yes
Typeform	Conditional	Enterprise	Enterprise or Growth Custom customers request a BAA from Sales via the help-center link, giving organization name and Typeform account email; other plans use the Request HIPAA Pricing form	Not published by the vendor	Not published by the vendor	Not published by the vendor
Wix	Conditional	Business	On a supported Premium or Studio plan, activate PHI protection in the desktop dashboard, then sign the BAA under Compliance, Privacy & Cookies	$39.77/month (Business, yearly subscription; prices vary by location)	Yes	Yes
Gravity Forms	No	Not offered	Vendor directs customers to their website host or data services provider	Not published by the vendor	No	Not published by the vendor

See recent changes in vendor HIPAA status for updates to any row.

HIPAA-compliant consent forms and e-signatures

What is the best HIPAA consent form? No single form is compliant. The vendor's BAA and your own configuration decide whether a consent form can hold PHI. A signed BAA does not make the consent valid or satisfy HIPAA authorization requirements; that is a content question. HHS explains that the Privacy Rule permits but does not require consent for treatment, payment and health care operations, which is separate from a HIPAA authorization (HHS FAQ 264).

WordPress consent forms. Gravity Forms offers no BAA and directs customers to their website host or data services provider. A WordPress consent form therefore depends on the host's BAA and your setup. Because it is self-hosted, data residency is controlled by the website administrator. Gravity Forms does not name any hosts that sign BAAs, so confirm the BAA directly with your host. If you build the site on a platform instead, Wix is the site-builder route, with a BAA from the Business plan after PHI protection is activated. See HIPAA-compliant website vendors.

Consent that needs a signature. This page does not claim that any form builder listed here provides legally valid e-signatures. A signing tool needs its own BAA; compare options in HIPAA-compliant e-signature tools.

Dynamic consent. Only features the vendor documents count.

HIPAA-compliant data collection, including GDPR and research use

Typical use differs. Survey and research tools (Qualtrics, SurveyMonkey, Typeform) usually serve studies and patient-experience surveys. Jotform, Formstack and Hushmail for Healthcare are more often considered for intake-style collection. The BAA terms are what matter:

• Qualtrics: the BAA is negotiated with the customer contract, and only for a covered entity or business associate. Qualtrics's own article says only that it will execute BAAs upon request with customers who are covered entities; it does not mention business associates, contract negotiation or eligible license tiers.
• SurveyMonkey: BAA on Enterprise, with the HIPAA add-on purchased separately. SOC 2 and SSO are listed as present.
• Typeform: BAA via Sales for Enterprise or Growth Custom customers. SSO and SOC 2 are listed as present.

Data residency by vendor:

• Typeform: AWS, main servers in Virginia, USA; Enterprise offers a US or EU data center.
• SurveyMonkey: Enterprise users can select the physical location for storage of some of their data.
• Jotform: an isolated HIPAA system of local data residency centers, per Jotform's FAQ.
• Microsoft Forms: most Office 365 services let customers specify the region of their data.

GDPR. A BAA does not equal GDPR compliance. Check each vendor's own data processing terms.

ABA and behavioral data. No vendor on this page is tested for ABA workflows. Check that the BAA scope covers the data types you store, such as session notes or behavior-tracking entries, before you build the form.

HIPAA-compliant QR code generators

A QR code only points to a URL. The PHI risk lies in where the code leads and in any scan tracking the generator stores. No QR generator is verified on this page, so the verdict is unknown until a vendor BAA is sourced.

The practical pattern: generate the code in a tool that never sees PHI, and point it at a form on a BAA-covered plan. A waiting-room poster that leads to an intake form works this way. Keep patient names and IDs out of the URL itself.

What a BAA on a form builder usually excludes

The typical exclusions are free and starter plans, and third-party integrations. If answers are pushed to email, spreadsheets, CRMs or payment tools, those copies leave the form vendor's BAA. A clinic that sends each intake submission into a shared inbox has moved PHI outside the agreement.

Setup steps also decide whether the BAA applies:

• Jotform: enable HIPAA compliance in account settings, which migrates forms to the isolated HIPAA system, then sign the BAA before use.
• Wix: activate PHI protection and sign the BAA on a supported Premium or Studio plan.
• Google Workspace: a super administrator must accept the amendment in the Admin console.
• Formstack: HIPAA is a paid add-on on Forms and Suite plans.

Notification emails that contain submitted answers are a common leak path. Prefer a "new submission" alert with no content. HHS says the Privacy Rule does not prohibit unencrypted email for treatment-related communications with patients, but advises safeguards such as limiting the information in the email, and the Security Rule still applies to ePHI transmissions.

How to check a form vendor yourself

Use this checklist:

1. A BAA is signed on your exact plan, not a different tier.
2. The vendor's HIPAA setting is enabled, where one exists.
3. Encryption at rest is confirmed, or "not published" is treated as a question for the vendor.
4. An audit log is available.
5. Access controls restrict who can view submissions.
6. Integrations are disabled or separately covered.
7. A retention and deletion policy exists for submissions.

The vendor's BAA covers its service, not your configuration or staff behavior. Roles, device security and training stay with you. For the underlying terms, see what 'HIPAA compliant' actually means.

Related categories and internal team communication

Nearby categories: e-signature tools and websites (linked above), and HIPAA-compliant file sharing. If staff need a place to discuss form follow-ups, that category is the neutral pointer. Chanty, published by the same company as this directory, is team chat for staff, with a signed BAA available from the Business plan. It is not a forms tool and appears there as one vendor among others.

FAQ

Is Google Forms HIPAA compliant?

There is no BAA specific to Forms. It is covered once a super administrator accepts the Google Workspace/Cloud Identity HIPAA Business Associate Amendment on a paid edition. Verdict: conditional.

Does Jotform sign a BAA, and on which plan?

Yes, from the Gold plan ($99/month billed annually, $129/month billed monthly). You enable HIPAA compliance in account settings, then click Sign BAA on the Data page.

Can I use Typeform or SurveyMonkey for patient data?

Only under a BAA. Typeform offers one to Enterprise or Growth Custom customers through Sales. SurveyMonkey offers one on Enterprise, with the HIPAA add-on purchased separately. Both are conditional.

Is Gravity Forms safe for PHI on WordPress?

Gravity Forms offers no BAA and directs customers to their website host or data services provider. Safety depends on the host's BAA and your configuration. Verdict: no.

Do I need a BAA for a consent form?

If the form vendor stores or transmits PHI for you, you need a BAA with that vendor. The BAA does not make the consent itself valid; HHS FAQ 264 distinguishes consent from authorization.

Is a free form builder ever OK for PHI?

Free and starter plans are the typical exclusion, and none of the vendors listed offers a BAA on a free plan. Don't put PHI in one.

Does a BAA make a form GDPR compliant too?

No. A BAA is a HIPAA instrument. Check each vendor's own data processing terms.

Can I use a QR code to link to a patient form?

Yes, as a link to a form on a BAA-covered plan. The code itself holds only a URL. The generator's verdict is unknown until a vendor BAA is sourced.

Sources