What "HIPAA Compliant" Means for Form Builders
There's no official HIPAA certification for software. When a vendor says "HIPAA compliant", it should mean they meet the Security Rule's safeguards and will sign a Business Associate Agreement (BAA).
For a form builder, that means:
- A BAA. The vendor signs an agreement acknowledging it handles PHI and must protect it.
- Encryption. TLS in transit and AES-256 (or equivalent) at rest.
- Access controls. Role-based permissions; no shared logins, no open access.
- Audit logs. A record of who accessed what and when.
Missing any of the four means it isn't ready for healthcare.
The Options Compared
Formisoft
Built for healthcare, not a generic form tool with a HIPAA add-on. It includes a signed BAA, encryption in transit and at rest, role-based access, and audit logs. Details are on the security page.
Forms are the starting point. Responses map to the patient record automatically, e-signatures are built in for consents and financial agreements, and 200+ intake templates cover specialties like dental, mental health, pediatrics, and dermatology. No re-typing submissions into another system.
JotForm HIPAA
JotForm's HIPAA plan includes a BAA, encrypted submissions, and controls such as restricting access and disabling integrations that could leak PHI. It's a solid general form builder with a healthcare layer.
The limit: it's still a form tool. No patient records, scheduling, or visit workflows; each submission stands alone, and connecting it to the rest of the practice means exports or third-party integrations.
Best for: practices that only need standalone forms.
Formstack
HIPAA plans with a BAA, encryption, and access controls, plus conditional logic, approvals, and document generation. The controls are real.
The trade-offs are cost and complexity. HIPAA plans can be expensive for small practices, the interface takes learning, and you build healthcare workflows from scratch.
Best for: organizations with IT staff to configure custom workflows.
Google Forms
Free and familiar, so many practices start here. Free Google Forms isn't HIPAA compliant. Paid Google Workspace plans can be covered by Google's BAA, which includes Forms, but Forms still has no healthcare fields, coarse control over who sees responses, and nothing connecting it to the visit.
Best for: staff surveys and anything without PHI.
Typeform
Known for beautiful, conversational forms. HIPAA support and a BAA aren't available on standard plans, so check with Typeform before using it for any PHI.
Best for: marketing surveys and feedback forms.
How to Choose
If you need one consent form hosted securely, a standalone HIPAA form tool may be enough. If you want forms connected to patient records, a view of who is ready for their visit, and no manual data entry, choose something built for healthcare.
Treat forms as part of the visit: the patient books online, completes intake, signs consents with e-signatures, and arrives with everything done. That's patient readiness.
Ask every vendor three questions: Do you sign a BAA? Where is my data stored and how is it encrypted? Can I control who on my team sees what?
Get every patient ready before they walk in.
- Forms, consents, and signatures before the visit
- Your paper forms converted by AI
- BAA included