Is Jotform HIPAA compliant?

Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →

BAA details

What you still have to configure

1. In Settings > Data, run Enable HIPAA Compliance: it moves the account to Jotform's HIPAA servers and allows only HIPAA-suitable widgets and integrations. Then click Sign BAA. source
2. Label every form field that collects PHI as a PHI field, and keep the HIPAA features switched on. source

Limitations

• Jotform's published standard BAA is framed for covered-entity customers and says it is void if the customer is not a covered entity. A business associate should confirm that Jotform will provide an agreement covering its role before using it for PHI. source
• HIPAA features are not available on the Starter, Bronze or Silver plans. source
• Use a third-party integration with PHI only where you have a BAA or equivalent agreement with that provider. source
• Jotform's BAA says form data is not to be used as a designated record set or relied on directly for patient care — move it to your record system — and Jotform is not responsible for PHI once it is exported or downloaded. source

Against our criteria

Alternatives

• Cognito Forms →BAA: conditional
• Formstack Forms →BAA: conditional
• Google Forms →BAA: yes
• IntakeQ →BAA: yes
• Microsoft Forms →BAA: yes
• Typeform →BAA: conditional