Best HIPAA compliant form builders
6 tools compared. Checked 6 Nov 2026.
Intake forms collect patient data directly. The BAA usually depends on the plan, and some builders need a HIPAA setting turned on as well.
Where to start
If you already use Google Workspace or Office 365, check Google Forms or Microsoft Forms first. Otherwise start with Jotform, since a Gold plan and a BAA signed from its Data page is the lowest named route here.
| Tool | Result | Where the BAA applies |
|---|---|---|
| QQualtrics | BAA available | On request; plans not stated |
| GGoogle Forms | On some plans | Google Workspace with the BAA accepted |
| JJotform | On some plans | Gold or Enterprise |
| MMicrosoft Forms | On some plans | Office 365 Commercial and GCC |
| SSurveyMonkey | On some plans | Enterprise with HIPAA features on |
| TTypeform | On some plans | Enterprise or Growth Custom |
Qualtrics
BAA availableQualtrics says it will execute BAAs on request with customers who are covered entities, and its security framework says a BAA is considered only for covered entities or business associates.
See the full Qualtrics result and proofGoogle Forms
On some plansGoogle lists Forms within Drive as covered functionality under its Workspace BAA, so coverage depends on a Workspace account whose super admin has accepted the BAA.
Covered: Forms in a Google Workspace account with an accepted BAA.
Left out: Third-party add-ons.
See the full Google Forms result and proofJotform
On some plansJotform lets covered entity customers on Gold or Enterprise plans sign a BAA from the Data page after enabling its HIPAA environment.
Covered: Gold; Enterprise.
Left out: Widgets and integrations not allowed in the HIPAA environment, and more.
See the full Jotform result and proofMicrosoft Forms
On some plansMicrosoft lists Forms in the Office 365 Commercial and GCC scope table for its HIPAA BAA, which is included by default in the Data Protection Addendum for covered entities and business associates.
Covered: Forms under Office 365 Commercial and GCC.
See the full Microsoft Forms result and proofSurveyMonkey
On some plansSurveyMonkey offers a standard-form BAA only with HIPAA-enabled Enterprise accounts, and says PHI is permitted only in such an account with a BAA in place.
Covered: Enterprise, with HIPAA features enabled.
Left out: Surveys holding PHI may not be transferred to regular accounts.
See the full SurveyMonkey result and proofTypeform
On some plansTypeform says it can currently provide a BAA for Enterprise or Growth Custom customers, requested through sales.
Covered: Enterprise; Growth Custom.
See the full Typeform result and proofBefore you choose
- Confirm the BAA covers your exact plan and every feature you’ll use.
- Get the BAA signed before any patient data goes in.
- Turn on the settings the vendor requires, and train your staff on them.
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm before you sign. PHI means protected health information, which includes patient data.