HIPAA compliant forms? Form builders that sign a BAA
Online form builders that sign a BAA — on which plans, how you put the agreement in place, and what to set up so answers stay protected after a patient presses Submit.
Online forms and patient intake at a glance
An online form can collect patient information under HIPAA when the form vendor signs a BAA for your plan, the answers stay inside the covered account — notifications, integrations and exports included — and the page hosting the form doesn't pass them to trackers. We compare 7 products in Online forms and patient intake. 3 sign a Business Associate Agreement (Google Forms, IntakeQ, Microsoft Forms). 4 sign one only for certain plans or products (Cognito Forms, Formstack Forms, Jotform, Typeform). Every value links to the vendor's own documentation and shows when it was checked.
| Sign a BAA | Google Forms, IntakeQ, Microsoft Forms |
|---|---|
| Only some plans or products | Cognito Forms, Formstack Forms, Jotform, Typeform |
| Products compared | 7 |
3 more facts
| Compared on | BAA without a sales process, BAA on entry-level team plans |
|---|---|
| Commissions | None — no vendor pays us |
| Facts checked since | 2026-10-17 |
Comparison
Alphabetical. No vendor pays us for listings, rankings or referrals — methodology.
| Product | Signs a BAA | BAA without a sales process | BAA on entry-level team plans |
|---|---|---|---|
| Cognito Forms | Conditional | Yes | No |
| Formstack Forms | Conditional | Not verified | Partial |
| Google Forms | Yes | Yes | Not verified |
| IntakeQ | Yes | Not verified | Yes |
| Jotform | Conditional | Yes | No |
| Microsoft Forms | Yes | Yes | Yes |
| Typeform | Conditional | No | No |
Found an outdated or wrong fact? Report it
What to check before you choose
- A BAA on your plan
- Form builders usually limit the BAA to higher plans or a HIPAA add-on, and some move your account to separate HIPAA servers first. Sign it before the first patient submits a form (164.502(e)).
- Notification emails
- A notification that pastes the patient's answers into an ordinary email sends PHI outside the covered account. We recommend staff notifications without patient answers, linking instead to the protected account. If notifications contain PHI, assess the receiving email service, its BAA coverage and safeguards. A patient's request to receive their own information by unencrypted email is a separate workflow, not permission to send staff notifications insecurely.
- Integrations and exports
- Every service the answers flow into — a spreadsheet, CRM, email marketing or payment tool — handles PHI too and needs its own BAA where it is a business associate. Once answers are exported or downloaded, protecting them is on you.
- Where the answers end up
- Check whether the vendor permits use as a patient-record system, and transfer information into your clinical record where its terms and your workflow require it. Information kept in a form tool may still belong to your designated record set (164.501), and access to it needs the same controls (164.312(a)). Set retention under applicable record-retention laws; HIPAA's six-year rule applies to required HIPAA documentation, not to all patient records.
- The page around the form
- Analytics, ad pixels and chat widgets on the page that hosts the form can send patient information to vendors without a valid basis — check the page, not just the form (OCR tracking guidance, as limited by AHA v. Becerra).
Common mistakes
- Collecting intake answers on a free or entry plan that has no BAA.
- Email notifications that contain every answer the patient typed.
- Connecting a HIPAA form to a spreadsheet or marketing tool that has no BAA.
How we compare
- BAA without a sales process
- You can put the BAA in place yourself — it is included in standard terms or accepted in account settings — rather than requesting it and waiting for approval.
- BAA on entry-level team plans
- The BAA is available on the vendor's entry-level business or team plan, not only on enterprise tiers.