Best HIPAA Compliant Form Tools for Clinics 2027: 6 Options

Key Takeaways

• A form tool is a candidate for patient information only when its vendor will sign a Business Associate Agreement (BAA) for the plan you would actually buy.

• Jotform is the clearest published case in this group: its pricing page marks HIPAA features unavailable on Starter, Bronze and Silver, and available on Gold.

• Formstack lists HIPAA as an add-on to its Forms plan, and the add-on price is not printed on the page we opened, so the base price understates the total.

• Cognito Forms and Typeform both place HIPAA behind an Enterprise tier, and Cognito's pricing page showed conflicting Enterprise figures when we checked.

• Microsoft Forms and Google Forms can fall under their suites' BAAs, but you own the configuration checks, including Microsoft's privacy footer and Google's administrator acceptance step.

• Most of the labor and risk sits between the form and your scheduling or records system, so place a human review point before any chart update.

Start with the BAA, not the editor

A HIPAA-compliant form tool, as this guide uses the term, is a form service whose vendor will sign a Business Associate Agreement covering the forms and responses you collect, on a plan you can buy today. That is the category decision. Editors, templates and mobile layouts matter, but they come second. A tool that will not sign the agreement cannot hold patient information, however good its editor is.

Three checks decide most shortlists: whether the BAA exists on the plan you would buy, what the vendor says it encrypts and how it times out sessions, and how answers reach your systems without someone retyping them.

TL;DR: Shortlist only tools whose vendor will sign a BAA on a plan you can buy. Jotform's Gold plan is the clearest published starting point for a standalone builder. Google Forms fits a practice already paying for Google Workspace, and Microsoft Forms needs a footer check before any patient data goes in.

Who this is for

This guide is written for an owner or operations lead at a small healthcare business, such as a clinic, dental office or therapy practice, that collects new-patient intake, consent, refill requests or appointment requests through a web form. If your forms only gather non-patient feedback, a general form builder is probably enough.

Red flags: you plan to put patient answers into a free or entry-level plan and upgrade later; the vendor will not name the plan that carries its BAA; or the only place answers land is a shared spreadsheet with no access rules.

How we evaluated these tools

We built this list from public information: vendor pricing and HIPAA pages, Microsoft and Google compliance documentation, and two independent sources, a trade publication and a review site. We did not run these products with patient data. The weights in Table 1 are our judgment about what a small clinic needs, not a vendor-supplied score.

Feature matrix for intake and follow-up

Table 2 summarizes what the pages we opened say. A cell reading "not stated" means the vendor page did not say so, which is not the same as the feature being missing. Ask for the BAA and safeguards in writing before you commit.

Formstack's HIPAA page is the most concrete on process. Its Forms plan is the one to price, and its HIPAA route is an add-on that you must quote separately, which is why it sits in the matrix as a gap rather than a plan.

What the tools cost for a five-person clinic

Pricing checked October 28, 2026. Only prices printed on the vendors' own pricing pages appear here, and the annual figures are arithmetic on those monthly rates.

Jotform's Gold plan is the entry point for HIPAA on its platform: Jotform's Gold plan: $99/mo billed annually according to Jotform (2026). The month-to-month rate on the same page is higher.

Google's Workspace pricing page lists the Standard tier per seat: Google's Standard plan: $14 per user monthly according to Google Workspace (2026), with all plans billed monthly.

Formstack's pricing page does not say whether its Forms price is per account or per user, so its one-account row is a floor, not a quote. We also could not load Microsoft 365 pricing during this check, so Microsoft is left uncomputed rather than estimated.

Here is a worked example, illustrative and not a customer: a clinic with five staff receives 60 intake forms a month, and a front-desk employee re-keys each one into the scheduling system in 6 minutes. That is 360 minutes, or 6 hours, of copying every month, or 72 hours a year. If a configured rule routes clean submissions straight to a pending chart item, copying shrinks to the flagged minority, but that is a design goal, not a measured result. Such a rule would read responses through the Google Forms API method forms.responses.list, so the clinic still needs a named owner for the matching logic and the access settings.

Vendor profiles: best fit and limits

Table 4 gives the shortlist by situation. The profiles below separate what each vendor states from our read.

Formstack

Vendor states: Formstack offers its Standard BAA and will evaluate custom BAA requests, according to Formstack. Its HIPAA account includes encryption and field- and folder-level security controls.

Best fit: a practice that wants a dedicated form platform and can get a HIPAA quote before buying. Limitations: the add-on price is unpublished, and the pages we opened do not state a session timeout. Implementation: request the Standard BAA, confirm the account type, and get the HIPAA add-on price in writing.

Jotform

Vendor states: eligible customers, meaning covered entities that have enabled HIPAA features in their account, receive a signed BAA, and Gold and Enterprise are the plans named for it, according to Jotform.

Best fit: a small clinic that needs a standalone builder with a BAA on a published plan. Limitations: the pages we opened do not state encryption or session details, and Enterprise is quote-based. A review site, Frontdesk Review, reports the same Gold-and-up split. Implementation: enable HIPAA in the account, confirm the signed BAA is on file, and keep HIPAA-enabled forms separate from general ones.

Cognito Forms

Vendor states: the BAA is limited to the Enterprise plan and not trials, there is no added cost beyond the subscription, and forms and uploads are encrypted at rest. User timeouts drop from 8 hours to 1 hour, according to Cognito Forms.

Best fit: an organization that wants a documented BAA process and can accept Enterprise pricing. Limitations: the guide says Cognito Forms is not an EMR, and guest access turns on automatically for workflow links. Its pricing page showed two Enterprise price sets during our check, so get a written quote from Cognito Forms pricing. Implementation: confirm the account is not a trial, mark PHI as protected in email notifications, and review guest access on each workflow link.

Typeform

Vendor states: HIPAA compliance is listed as an Enterprise-only feature. The Basic plan is a different story: Typeform's Basic plan: $39/mo billed monthly according to Typeform (2026), and none of the priced plans mention HIPAA.

Best fit: a team already on Typeform with an Enterprise budget. Limitations: Enterprise is quote-based, and the BAA help article it links to was not retrievable in our session. Implementation: get the signed BAA before any PHI, then confirm each feature you need, such as file upload, sits within the agreement's scope.

Microsoft Forms

Vendor states: Forms is an in-scope service for 2 Office 365 environments, Commercial and GCC, and Microsoft's BAA is available by default to covered entities, according to Microsoft Learn. The same page says using Microsoft services does not by itself achieve HIPAA compliance.

The footer is the catch: according to HIPAA Journal (2025), Microsoft Forms is not an effective option for collecting protected health information because of a footer issue. Best fit: a practice already on Microsoft 365 that passes the footer review. Implementation: confirm with Microsoft that your subscription and BAA cover Forms before collecting anything.

Google Forms

Vendor states: Google's HIPAA documentation lists Google Forms within Google Drive as included in the Google Cloud BAA, according to Google Cloud. Google's Workspace HIPAA page says administrators must accept the BAA before PHI goes into Workspace. The seat price appears in the cost section above.

Best fit: a practice already on Google Workspace that needs basic intake. Limitations: the pages we opened do not address third-party add-ons or describe Forms-specific session or signature controls. Implementation: accept the BAA in the admin console, restrict add-ons, and give any linked spreadsheet the same access rules as the form.

When NOT to use US Tech Automations. Skip a custom routing build if an existing EHR's built-in intake already handles your forms, if you receive only a few forms a month that one staff member can review by hand, or if you need only a patient-facing form with no downstream system. In those cases a BAA-signed form plan with manual review is the simpler buy.

Routing answers after the form is submitted

The labor sits between the form and the scheduling or records system, where someone copies answers by hand. A proposed US Tech Automations design would target that gap as a configurable workflow, not a finished deployment, and nothing here describes a live customer or a measured result.

Proposed workflow A, new-patient intake. The trigger is a new submission, delivered by webhook where the vendor offers one or by a scheduled pull where it does not. The action matches the patient's name and date of birth against the practice system through its API or a scheduled CSV export, then writes the answers as a pending item, not a final chart entry. The output is a front-desk review task and an audit entry showing which fields moved and under which rule. Prerequisites: an executed BAA covering the form tool and every system in the chain, API or export access on your plans, and a test run with dummy records. Human review points: a staff member confirms identity before any chart update, and answers flagged for symptoms or insurance mismatch go to a clinical queue rather than being filled automatically.

Proposed workflow B, refill requests. The trigger is a refill-request submission. The action creates a task in the prescriber's queue with the medication and pharmacy from the form, and it starts a reminder if no one responds by the clinic's own deadline. The output is a visible, timestamped task. Prerequisites: the same BAA chain, plus permissions so only the prescriber team sees the task. Human review point: a licensed clinician approves or declines every request. The workflow never sends a refill on its own.

Stitching it yourself versus a configured design

Zapier, Make and n8n can connect many of the form tools above, and when configured they can keep run histories, retries and error branches. The buyer still owns what the platform does not decide: idempotency, so a retried run does not create two chart tasks; escalation when a step fails; per-user access controls; and maintenance when a form field is renamed. Whether each automation platform will sign a BAA on your plan is a separate check to complete before any PHI passes through it. A proposed US Tech Automations design would configure those controls up front, with the same prerequisites and review points, but it would not remove your responsibility for the BAA chain, your API access or your staff's review steps.

Common mistakes that cause compliance gaps

• Starting on a free or entry tier with a plan to upgrade after the first patient form is already live.

• Assuming a BAA exists because a marketing page says "HIPAA compliant." Ask for the agreement.

• Forgetting the linked spreadsheet, email notification or add-on, any of which may sit outside the agreed scope.

• Sending PHI through an automation platform without checking that platform's BAA position.

• Treating the BAA as the compliance program. The Microsoft page we opened says a BAA alone does not make you compliant.

• Leaving guest or public links open longer than the intake needs them.

Decision checklist before you sign

• The vendor has put in writing that it will sign a BAA on the exact plan you are buying.

• The plan name, price or quote, and any HIPAA add-on price appear in one document.

• Forms, responses, notification emails and any linked spreadsheet all fall inside the agreed scope.

• Encryption, session timeouts and access controls are confirmed for your account, not only described in marketing.

• The systems you need to feed have API or export access, and a named person owns the matching rules.

• Every automated step that touches a chart or medication has a written human review point.

• If consent forms need a signature step, confirm that the signature feature sits within the BAA's scope.

Questions clinic owners ask before signing

Is a form tool without a BAA ever safe for patient intake?

No. If the form collects information about a patient for a healthcare provider, that information is PHI, and the vendor needs a signed BAA before it handles that information.

Is Google Forms HIPAA compliant?

It can be covered: Google's documentation places Google Forms within Google Drive under the Google Cloud BAA, but an administrator must accept the agreement before PHI goes in.

Can I use Microsoft Forms for patient intake?

Only after you confirm the BAA covers your subscription and you resolve the footer issue, because HIPAA Journal's assessment is that Forms is not an effective option for collecting PHI.

Does a BAA make my clinic compliant?

No. A BAA covers the vendor's obligations. Your own policies, access controls and training still apply, as Microsoft's own compliance page makes clear.

Do I need a BAA for an automation tool that only moves data?

Yes, if the tool handles PHI at any step. Check the automation platform's BAA position before connecting patient data.

Which tool should a five-person clinic start with?

Start with the one whose BAA you can get in writing on a plan you can buy. For many clinics in this list that means Jotform's Gold plan at its published price, or Google Forms if the clinic already runs Workspace and accepts its controls.

Pick the tool your BAA will cover

Start with the BAA, then the plan, then the routing. Jotform is the clearest published starting point in this group. Google Forms and Microsoft Forms are workable only after you confirm their suite-level BAAs and configuration. Formstack, Cognito Forms and Typeform are worth a quote request before you budget. If you want to see how the routing side could be configured for your intake, see how US Tech Automations configures this, and ask for the prerequisites in writing before any patient data moves.