S
On some plansIs SurveyMonkey HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
SurveyMonkey offers a standard-form BAA only with HIPAA-enabled Enterprise accounts, and says PHI is permitted only in such an account with a BAA in place. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Regular (non-HIPAA-enabled) accounts, which SurveyMonkey says may not store PHI | Not covered |
| Enterprise, with HIPAA features enabled | Covered |
What the BAA leaves out
- Surveys holding PHI may not be transferred to regular accounts
How to get the BAA
New customers contact SurveyMonkey sales; existing Enterprise customers contact their Customer Success Manager.
What the vendor says to do
- Contact SurveyMonkey to enable HIPAA features and put the BAA in place
- Prefer Web Link Collectors over Email Invitation Collectors for PHI
- Share surveys and results only with authorized people
- Encrypt downloaded exports
Proof from the vendor
- HIPAA Compliance and SurveyMonkeyEnterprise only, standard-form BAA, restrictions, recommended practices, activated features
- HIPAA-Compliant Surveys & FormsBAA offered to Enterprise customers and the contact route
- Get Quick Insights with Analyze with AIAI analysis page tells users not to enter sensitive or personal information in questions; no HIPAA mention
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.