SurveyMonkey signs a BAA only for Enterprise customers with a HIPAA-enabled account, and the HIPAA add-on is bought separately. Basic, Individual and Team plans cannot collect PHI under a BAA.
Is SurveyMonkey HIPAA compliant? Verdict: conditional
Conditional A BAA is available only on Enterprise through a separately purchased HIPAA add-on, Basic, Individual and Team plans are not eligible, and the add-on does not extend to Apply or GetFeedback (checked 2026-10-20).
Published by Chanty, Inc., which owns this directory. Chanty is listed as one vendor among others.
Short answer
BAA available on Enterprise for HIPAA-enabled accounts. The HIPAA add-on is purchased separately from the Enterprise plan. Prospects get it through SurveyMonkey sales, and existing Enterprise customers through their Customer Success Manager.
A clinic on a Team Premier plan that sends patient intake or satisfaction surveys has no BAA with SurveyMonkey, so those responses should not contain PHI. For other vendors, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Enterprise | Available, for HIPAA-enabled accounts | Contact sales (prospects) or the Customer Success Manager (existing customers) | HIPAA add-on purchased separately; price not published by the vendor |
| Free/Basic | Not eligible | Not applicable | Not applicable |
| Individual plans | Not eligible | Not applicable | Not applicable |
| Team Advantage | Not eligible | Not applicable | Not applicable |
| Team Premier | Not eligible | Not applicable | Not applicable |
Minimum seats and pricing for Enterprise and the add-on: not published by the vendor.
What the BAA covers and what it excludes
Covered
- SurveyMonkey Enterprise, for HIPAA-enabled accounts.
Excluded
- Apply
- GetFeedback
SurveyMonkey states that HIPAA-enabled accounts are only available with Enterprise.
If your organization also runs Apply or GetFeedback, keep PHI out of them. The Enterprise BAA does not reach those products.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Yes |
| Data residency | Enterprise users can select the physical location for storage of some of their data |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
The Trust Center cites AES-256 encryption at rest and TLS 1.2+ in transit. Report dates for SOC 2 and ISO 27001: not published by the vendor.
Data residency: Enterprise users can select the physical location for storage of some of their data.
How to use SurveyMonkey with PHI
A BAA covers the vendor's side. The rest is your configuration and policy. Terms such as BAA and PHI are defined in the HIPAA glossary.
- Sign the BAA before any survey collects PHI, not after the first responses arrive.
- Confirm the account is HIPAA-enabled on Enterprise. Having the plan alone is not enough, because the add-on is bought separately.
- Keep PHI out of Apply and GetFeedback.
- Configure access controls and SSO so only named staff can open responses.
- Limit who can export or view responses. A front-desk user who only needs to see scheduling feedback should not be able to download every patient response.
- Train staff on survey content policies, such as which free-text questions invite patients to describe symptoms.
Compliance depends on the signed BAA, your configuration and your policies.
Alternatives with a BAA
Listed alphabetically, not ranked. Each vendor's BAA plan and scope is on its own page.
- Is Formstack HIPAA compliant?: conditional, Forms HIPAA add-on.
- Is Google Forms HIPAA compliant?: conditional, paid Google Workspace editions.
- Hushmail for Healthcare: conditional, Healthcare Basic.
- Is Jotform HIPAA compliant?: conditional, Gold.
- Is Microsoft Forms HIPAA compliant?: conditional, Office 365/Microsoft 365 commercial subscriptions.
More options are in HIPAA-compliant forms software.
Sources
- HIPAA-Compliant Surveys & Forms — Vendor page, checked 2026-10-20. "Yes, SurveyMonkey offers a business associate agreement (BAA) to Enterprise customers."
- HIPAA-Compliant Surveys & Forms — Vendor page, checked 2026-10-20. "HIPAA-enabled accounts are only available with SurveyMonkey Enterprise."
- SurveyMonkey Trust Center — Trust center, checked 2026-10-20. "BAAs available as add-on with the Enterprise plan; must be purchased separately"
- SurveyMonkey Trust Center — Trust center, checked 2026-10-20. "We protect your data with AES-256 encryption at rest and TLS 1.2+ encryption in transit."
- SurveyMonkey Pricing — Pricing page, checked 2026-10-20. "Get a demo"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-20. Updates across vendors are listed under Recent changes in vendor HIPAA status.
FAQ
Does SurveyMonkey sign a BAA?
Yes, to Enterprise customers, according to its HIPAA page. The account must be HIPAA-enabled, which requires the separately purchased HIPAA add-on.
Can I collect PHI on a Team Premier, Team Advantage, Individual or Basic plan?
No BAA is available on those plans. They are not eligible for the HIPAA add-on, so PHI should not be collected there.
Is the BAA included in the Enterprise plan price?
No. The HIPAA add-on is purchased separately, through sales for prospects or the Customer Success Manager for existing Enterprise customers. The price is not published by the vendor.
Does the SurveyMonkey BAA cover Apply or GetFeedback?
No. Apply and GetFeedback are excluded from the HIPAA add-on.