Is Formstack HIPAA compliant?
Online forms and workflows. Formstack offers a standard BAA, with HIPAA sold as an add-on on its Forms and Suite plans.
Signs a BAAConditional
Formstack Forms signs a Business Associate Agreement only under specific conditions. Formstack offers a standard BAA and reviews requests for a custom one; it sets up a dedicated account for HIPAA use.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: Formstack — HIPAA compliance · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
| Signs a BAA | Conditional | Formstack — HIPAA compliance |
|---|---|---|
| Plans that include a BAA | Forms, with the HIPAA add-on, Suite, with the HIPAA add-on, Enterprise and Salesforce solutions | Formstack — Pricing |
What you still have to configure
- Agree to Formstack's standard BAA, or submit your own for review, before collecting PHI; Formstack creates or converts a dedicated account for HIPAA use. source
Limitations
- HIPAA is a paid add-on on the Forms ($83/month billed annually) and Suite plans, not part of the base price. source
Against our criteria
| BAA without a sales process | Not verified — Formstack describes agreeing to a standard BAA and setting up a dedicated account, but not whether you can do it without contacting Formstack. | Formstack — HIPAA compliance |
|---|---|---|
| BAA on entry-level team plans | Partial — Available on the Forms plan as a paid HIPAA add-on. | Formstack — Pricing |
Alternatives
- Cognito Forms →BAA: conditional
- Google Forms →BAA: yes
- IntakeQ →BAA: yes
- Jotform →BAA: conditional
- Microsoft Forms →BAA: yes
- Typeform →BAA: conditional