Is Cognito Forms HIPAA compliant?
Online form builder. Cognito Forms signs a BAA with organizations on its Enterprise plan, accepted inside the app.
Signs a BAAConditional
Cognito Forms signs a Business Associate Agreement only under specific conditions. Enterprise plan only, not a trial; no extra cost. An Owner with authority to sign contracts accepts it under Settings > Plan & Billing > Compliance.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: Cognito Forms — HIPAA compliance · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
| Signs a BAA | Conditional | Cognito Forms — HIPAA compliance |
|---|---|---|
| Plans that include a BAA | Enterprise | Cognito Forms — HIPAA compliance |
What you still have to configure
- Mark fields that hold PHI as protected so they are not sent by email, unless the patient has signed a waiver allowing PHI by email. Cognito describes this as a signed waiver; it does not waive the practice's HIPAA duties or cover unrelated emails to staff. source
Limitations
- Cognito Forms is not an electronic medical record system — move PHI that belongs in the patient's record into a system built for it. source
- With HIPAA enabled, sign-in sessions time out after 1 hour instead of 8, and support works by email and shared templates, without staff access to your entries. source
Against our criteria
| BAA without a sales process | Yes — Accepted in the app by an account Owner. | Cognito Forms — HIPAA compliance |
|---|---|---|
| BAA on entry-level team plans | No — Enterprise plan only. | Cognito Forms — HIPAA compliance |
Alternatives
- Formstack Forms →BAA: conditional
- Google Forms →BAA: yes
- IntakeQ →BAA: yes
- Jotform →BAA: conditional
- Microsoft Forms →BAA: yes
- Typeform →BAA: conditional