Which Online Forms Are HIPAA Compliant? Jotform, Google Forms and TypeformThe plan each form builder needs, how to get the BAA, and what to check before a patient types anything.

Jotform, Google Forms, and Typeform can each be used for patient forms, but only on specific plans and only after the vendor signs a Business Associate Agreement (BAA). No free plan of any of the three qualifies. We checked each vendor's own pages on October 9, 2026. The plan and the steps for each tool are below.

HIPAA compliant forms at a glance

• A form tool is not compliant by itself. The practice's plan, settings, and BAA decide it.
• A free Jotform, personal Gmail, or standard Typeform account has no BAA.
• Every add-on or integration that touches form answers needs its own BAA.

Why does an online form need a BAA?

An online form needs a BAA because the form vendor stores patient information for the practice. HHS defines a business associate as a person or entity that performs functions for a covered entity "that involve access by the business associate to protected health information." HHS says the HIPAA Rules generally require a written contract with each business associate.

Encryption does not remove this duty. HHS cloud guidance says a cloud provider that stores encrypted patient data is still a business associate, even without the decryption key.

Is Jotform HIPAA compliant?

Jotform supports HIPAA compliance on its Gold and Enterprise plans only. Jotform's pricing page says HIPAA features are on "Gold and Enterprise plans only." Customers who enable the features receive a signed BAA.

Jotform's setup wizard runs these steps:

1. 1

   Upgrade and verify

   The wizard confirms the plan qualifies. It then asks you to verify your email and set a strong password.

2. 2

   Review your forms

   The wizard lists form elements that are unsuitable for HIPAA. Only approved widgets and integrations stay.

3. 3

   Migrate the data

   Jotform moves the account's data to an isolated system. You receive an email when the migration ends.

4. 4

   Sign the BAA

   Click Sign BAA on the Data page. Jotform emails you a copy. Keep that copy with your compliance records.

5. 5

   Mark the PHI fields

   Turn on the PHI switch for each health field. Jotform then removes those fields from notification emails.

Is Google Forms HIPAA compliant?

Google Forms can be used with patient data inside a Google Workspace account that has accepted Google's BAA. Google lists Forms under Google Drive in its HIPAA Included Functionality list, dated August 31, 2026. An administrator accepts the BAA in the Admin console. A personal Gmail account has no Admin console and no BAA. Our Google Workspace HIPAA guide covers the full setup.

Two limits apply to Forms:

• Add-ons are not covered. Google's BAA covers Google's listed services. A third-party Forms add-on is a separate vendor.
• Responses land in Sheets. Sheets is also covered. The practice must still limit who can open the response sheet.

Is Typeform HIPAA compliant?

Typeform offers a BAA on two plans only. Its help center states: "we can currently provide a BAA for customers on our Enterprise or Growth Custom plans." There is no self-service switch. A customer requests the BAA through Typeform Sales and gives the company name and account email.

Typeform's BAA article does not list which features change once HIPAA is enabled. Ask Sales for that list in writing before you build a patient form.

What else makes a patient form compliant?

A signed BAA is the first requirement, not the last. Check these four items on every patient form.

• Notification emails

  Keep form answers out of notification emails unless the mailbox is also under a BAA.

• Access

  Give each staff member a separate login. Remove access on the day someone leaves.

• Integrations

  List every tool the form sends data to. Each one needs its own BAA.

• Page trackers

  Check the page that hosts the form for ad pixels and analytics scripts.

The last item is easy to miss. A compliant form on a page that runs an ad pixel can still leak patient data. Our guide to HIPAA compliant website tracking shows how to check a page in five steps.

How Webpatch helps

Webpatch is a technology company that works with healthcare practices. We build websites and manage their security, HIPAA compliance, SEO, and AEO. We are not a law firm, and this is not legal advice. If you want your site's forms reviewed, contact Webpatch.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.