Collecting health information online is not something you can improvise. If a form touches protected health information (PHI), it has to be encrypted, access-controlled, logged, and covered by a signed Business Associate Agreement (BAA). Get it wrong and you’re exposed to breaches and penalties. Healthcare organizations can be fined tens of thousands of dollars per violation. Get it right and patients can share sensitive details safely from any device.
The tricky part is that many form tools advertise “security” without offering true HIPAA coverage. A genuinely compliant tool signs a BAA, encrypts data in transit and at rest, restricts who can see submissions, and keeps an audit trail. Below are the tools that actually meet that bar, what each does well, and where each is limited, so you can match one to your organization’s size and systems.
How we evaluated these tools
We judged each tool on what real HIPAA compliance requires:
✓ A signed BAA: the vendor formally takes on HIPAA responsibility.
✓ Encryption in transit (TLS 1.2 or higher) and at rest for every submission.
✓ Role-based, and ideally field-level, access so only authorized staff see PHI.
✓ Audit trails that record who viewed or changed data.
✓ Integrations with your EHR or CRM to avoid manual re-entry.
Quick comparison
| Tool | Best for | HIPAA / BAA support | Standout strength |
| FormAssembly | Healthcare orgs on Salesforce | BAA on enterprise/Compliance Cloud; encryption; field-level access | Governance and Health Cloud fit |
| Jotform | Quick, template-driven intake | BAA on healthcare plans | Ease of use |
| Formstack | Forms, docs, and signatures | BAA on higher tiers | All-in-one suite |
| Cognito Forms | Smaller practices on a budget | BAA on paid plans | Affordability |
| 123FormBuilder | Configurable regulated forms | HIPAA on enterprise | Configurability |
| Typeform | Conversational patient forms | HIPAA on enterprise | Respondent experience |
The best HIPAA-compliant form tools
1. FormAssembly: best overall for healthcare data
FormAssembly is a strong choice as a HIPAA-compliant form builder for providers and payers. On its enterprise and Compliance Cloud plans it signs BAAs, encrypts data in transit (TLS 1.2) and at rest, and controls access through role-based and field-level permissions with audit logging that supports compliance reviews. Because it connects cleanly to Salesforce Health Cloud and other systems, PHI flows into your records without manual re-entry, which reduces both errors and exposure. You can even embed standardized screening tools and trigger conditional workflows, such as flagging high-risk responses for clinical review.
Standout features
Multi-object mapping to Salesforce, dynamic prefill, conditional logic, secure payments, and approval workflows, all under enterprise-grade security. Its Compliance Cloud environment is independently audited throughout the year, and its e-signatures meet FDA 21 CFR Part 11 for clinical use, built for organizations that must prove compliance, not just claim it.
✓ Enterprise governance, encryption, and audit controls built for compliance.
✓ Deep Salesforce and Health Cloud integration keeps PHI connected.
✓ Field-level access and conditional workflows for the “minimum necessary” standard.
– HIPAA features sit on enterprise/Compliance Cloud plans, not entry tiers.
– More configuration than a plug-and-play form tool.
Best for: healthcare organizations that need compliant data collection tied directly to Salesforce.
2. Jotform: best for quick, template-driven intake
Jotform offers HIPAA-friendly plans with a signed BAA and a very large library of healthcare templates, so teams can stand up intake, consent, and screening forms fast. Its drag-and-drop builder means non-technical staff can make changes without waiting on IT. It’s a practical choice when speed to launch matters more than deep CRM mapping.
✓ Huge library of healthcare templates.
✓ Easy for non-technical staff to build and edit.
✓ BAA available on healthcare plans.
– Integration depth trails Salesforce-native tools.
– HIPAA features require the right plan tier.
Best for: practices that want compliant forms live quickly.
3. Formstack: best all-in-one suite
Formstack provides HIPAA compliance on higher tiers and pairs forms with document generation and e-signatures, which is useful for consent and paperwork-heavy workflows. A single flow can capture data, generate a document, and collect a signature. That breadth suits teams that want to consolidate vendors.
✓ Forms, documents, and signatures together.
✓ Workflow and approval tools included.
✓ Good fit for consent-heavy processes.
– HIPAA features sit on higher-priced plans.
– More than forms-only teams may need.
Best for: teams that need compliant forms plus documents and signatures.
4. Cognito Forms: best value
Cognito Forms supports HIPAA compliance with a BAA on its paid plans at a noticeably lower price point, making it appealing for smaller practices with straightforward needs. It includes payment support, so co-pays and fees can be collected in the same form. Enterprise governance is lighter, which is a fair trade at this price.
✓ Affordable HIPAA coverage with a BAA.
✓ Built-in payment support.
✓ Simple enough for small teams to manage.
– Fewer enterprise governance features.
– Less suited to large, complex organizations.
Best for: small practices that need compliance without enterprise budgets.
5. 123FormBuilder: best for configurable forms
123FormBuilder includes HIPAA features on its enterprise plans and offers strong configurability for teams that need tailored regulated forms. It handles conditional logic, integrations, and approval routing for more involved workflows. The trade-off is more setup effort to realize that flexibility.
✓ Highly configurable for tailored workflows.
✓ Enterprise HIPAA option with a BAA.
✓ Solid conditional logic and routing.
– Setup effort for advanced forms.
– HIPAA limited to enterprise plans.
Best for: teams that need configurable, compliant data collection.
6. Typeform: best respondent experience
Typeform brings a conversational, one-question-at-a-time experience and offers HIPAA compliance on enterprise plans, which can lift completion rates on longer forms. For patient-facing questionnaires where drop-off is a concern, that experience is a real advantage. CRM depth and lower-tier HIPAA availability are the main limits.
✓ Engaging, high-completion format.
✓ HIPAA available on enterprise.
✓ Strong for patient-facing questionnaires.
– HIPAA limited to the top tier.
– Less CRM and mapping depth.
Best for: patient-facing forms where experience and completion matter.
How to choose the right one
Confirm the BAA first. Without a signed BAA, no tool is HIPAA-compliant for your use, no matter how secure it sounds. Verify the vendor will sign one on the specific plan you’re buying, since coverage is often tied to higher tiers.
Match integration to your systems. If PHI needs to reach an EHR or CRM, choose a tool that writes to it directly, since re-keying data by hand is both slow and risky.
Weigh governance for larger teams. The more staff who touch PHI, the more you need role-based and field-level access plus audit logs, not just encryption.
Balance experience and depth. A friendlier form can raise completion, but make sure it still meets your compliance and integration needs.
Frequently asked questions
What makes an online form HIPAA-compliant?
It’s a combination of a signed BAA with the vendor, encryption in transit and at rest, access controls, and audit logging. The tool alone isn’t “HIPAA-certified”; compliance depends on how you configure and use it under that BAA.
Is Google Forms HIPAA-compliant?
Standard Google Forms is not covered by a BAA for most users and shouldn’t be used for PHI. Some Google Workspace agreements can cover certain services, but you must confirm coverage before collecting health data.
Do I need a BAA even for a simple contact form?
If the form collects any protected health information, yes. If it only collects a name and general inquiry with no health context, it may fall outside PHI, but when in doubt, treat it as PHI.
Can HIPAA-compliant forms still take payments?
Yes. Several tools here support secure, PCI-compliant payments alongside HIPAA coverage, so you can collect co-pays or fees within the same compliant form.
Which plan do I need for HIPAA compliance?
It varies by vendor, and HIPAA features are usually reserved for higher or enterprise tiers. FormAssembly, for example, provides BAAs and HIPAA controls on its enterprise and Compliance Cloud plans. Always confirm the exact plan before collecting PHI.
The bottom line
For healthcare organizations that need compliant intake tied to their CRM, FormAssembly is the strongest overall pick: its BAA, encryption, field-level access, audit logging, and Health Cloud integration cover the whole chain. Jotform and Cognito Forms are excellent when speed or budget lead, Formstack when you also need documents and signatures, and Typeform when respondent experience is the priority. Whatever you choose, confirm the BAA and your integration path before you collect a single record.
Also read: Conversational AI in Healthcare: Tech That Makes Patient Care Easy
