J
On some plansIs Jotform HIPAA compliant?
Checked 6 Nov 2026 from 4 vendor sources
Jotform lets covered entity customers on Gold or Enterprise plans sign a BAA from the Data page after enabling its HIPAA environment. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Starter (free) | Not covered |
| Bronze | Not covered |
| Silver | Not covered |
| Gold | Covered |
| Enterprise | Covered |
What the BAA leaves out
- Widgets and integrations not allowed in the HIPAA environment
- Connected third-party apps without their own BAA with the customer
How to get the BAA
After enabling HIPAA features, go to the Data page, select Sign BAA, enter your details and submit; the signed copy arrives by email.
What the vendor says to do
- Select Enable HIPAA Compliance on the account’s Data page
- Confirm plan eligibility, verify email and set a strong password
- Consent to moving data to the HIPAA environment
- Review forms for flagged elements and migrate them
- Sign the BAA from the Data page if you are a covered entity
Proof from the vendor
- How to Enable the HIPAA Environment?Gold and Enterprise only, setup steps, widget and integration limits
- How to Receive a BAA for Your HIPAA AccountCovered entity requirement and signing steps
- Jotform Features and PricingHIPAA features on Gold and Enterprise only; free Starter excludes them; AI Agents use Gemini via Vertex AI on HIPAA accounts
- HIPAA Frequently Asked Questions for Web FormsThird-party apps need their own BAA with the customer
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.