HIPAA-Compliant Form Builders for Medical Practices

Every article ranking for this term tells you the same thing: pick a builder that signs a BAA. That is half the answer, and it is the half that gets practices in trouble. The vendors that market themselves hardest on HIPAA will happily sell you a $34/month plan that explicitly does not include HIPAA features — and nothing in the checkout flow stops you.

So this post compares the five builders a small practice actually shortlists, by the only thing that matters: the cheapest plan on which the vendor will sign a Business Associate Agreement. Every price and tier below was read off the vendor's own live pricing page.

What makes a form builder actually HIPAA-compliant?

Three things, and a signed BAA is only the first. The BAA is the contract that makes the vendor legally accountable for your patients' data; the technical controls (encryption, access limits, audit logs) are what keep it from leaking; and the configuration on your side is what keeps PHI out of places it was never supposed to go.

The BAA is not a formality. HHS's own sample business associate provisions say the contract must require the business associate to implement safeguards, report any impermissible use or disclosure (including breaches of unsecured PHI), make its books and records available to HHS, return or destroy PHI at termination, and bind its own subcontractors to the same terms. A vendor that hands you a PDF without those clauses has given you paperwork, not protection.

• A signed BAA that names your plan — not a marketing page that says 'HIPAA-friendly'.
• Encryption in transit and at rest, so a submission sitting in the vendor's database is not readable plain text.
• Access logs / audit trail — you need to be able to show who opened a submission and when.
• Controlled notifications — a HIPAA-enabled form must not email the patient's answers to your front desk inbox in plain text.
• Deletion and retention control, because PHI you no longer need is pure liability.

That last point is where most practices quietly break their own compliance: the form is fine, and then a Zapier automation drops the submission into a shared Google Sheet nobody has a BAA for.

How do Jotform, Formstack, Cognito Forms, HIPAAtizer, and FormDr compare?

On BAA availability by tier, they split into two camps: builders that gate HIPAA behind a $90–$174/month top plan, and healthcare-specific builders that include it on every plan. Here is what each vendor's live pricing page says today — Jotform, Formstack, Cognito Forms, Zoho Forms, HIPAAtizer and FormDr.

Verdict: for a solo or small practice that just needs compliant intake forms, HIPAAtizer wins on price-to-coverage — it is the only builder on this list that puts a BAA on its entry plan at $29–$34/month instead of $99+. Jotform is the better product if you also want scheduling, payments and e-signature in one place, but you are paying $99/month for the privilege. FormDr is built for healthcare and includes a BAA everywhere, but it refuses to publish a price, which is a red flag in any category.

Why does the cheap plan leave you uncovered on a 'HIPAA' product?

Because the HIPAA badge belongs to the vendor's product line, not to your account. Jotform's HIPAA pricing page states it plainly: 'HIPAA compliance features are only available with our Gold and Enterprise plans.' Its own FAQ repeats that those features — encryption, auditing, PHI segmentation — are available on Gold and Enterprise plans only.

So the failure mode is boringly simple. A practice manager Googles 'HIPAA compliant form builder', lands on a vendor whose entire homepage is about healthcare, signs up on the $34 plan because the feature list looks close enough, and starts collecting medication histories the next morning. No BAA exists. Nothing on the form warns them.

This is not a theoretical risk. Per HHS's enforcement data, as of October 31, 2024 OCR had settled or imposed a civil money penalty in 152 cases totaling $144,878,972 — and the compliance issue alleged most often, cumulatively, is impermissible uses and disclosures of PHI. 'Private Practices and Physicians' are the second most common type of covered entity alleged to have violated the rules, right behind general hospitals.

Before you buy anything, do this: open the vendor's pricing page, find the exact plan name you intend to pay for, and confirm HIPAA is listed in that column. Then ask sales, in writing, to send the BAA before you take payment. If they cannot produce it in a day, they are not a healthcare vendor.

Is there a genuinely free HIPAA-compliant form option?

Two, with real caveats. HIPAAtizer's Developer Sandbox Account is free, lists a Business Associate Agreement in its feature set, and allows 300 submissions a month across up to 100 published forms — but it is explicitly positioned 'For Developers, Web Designers and Those Supporting Health Care Professionals', so read the terms before you route live patient data through it.

The second is Google Forms, and it surprises people. Google's HIPAA Included Functionality list — as of May 14, 2026 — covers 'Google Drive (including Google Docs, Google Forms, Google Sheets, Google Slides, and Google Vids)'. Google Forms can be used with PHI. But only if you are a Google Workspace customer who has accepted Google's BAA in the Admin console, and Google states flatly: 'Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services.'

Two catches kill it for most practices. A free consumer @gmail.com account cannot accept a BAA, so the 'free' Google Form on your website is not covered. And Google says third-party applications, including add-ons, are not part of the Included Functionality — so the moment you bolt a form add-on or a Sheets automation onto it, you are outside the BAA.

What else on the page can leak PHI even if the form is compliant?

The tracking scripts sitting next to it. A perfectly compliant form on a page that also loads a Meta Pixel or an untethered analytics tag can still ship identifiable data to a vendor you have no BAA with — and the form builder's compliance does nothing to stop it.

HHS's guidance on online tracking technologies gives the exact scenario: if someone books an appointment through a covered clinic's website and that site runs third-party tracking, the site 'might automatically transmit information regarding the appointment and the individual's IP address to a tracking technology vendor. In this case, the tracking technology vendor is a business associate, and a BAA is required.' Note also that on June 20, 2024 a federal court vacated a portion of that guidance covering unauthenticated pages — which changed the edges of the rule, not the core of it.

That argument deserves its own page, and it has one. Read how to handle analytics and ad pixels on a healthcare site before you point a single ad campaign at your intake form.

How do you connect a compliant form to your EHR without breaking anything?

Assume every hop needs its own BAA. The form vendor, the automation tool in the middle, the storage the data lands in, and the EHR connector are four separate business associates — and a chain is only as compliant as its weakest link.

• Prefer a native EHR integration over a generic automation tool. FormDr publishes direct integrations for athenahealth, Dentrix Ascend, eClinicalWorks, Elation, Epic, ModMed, plus HL7 and an open API — and notes cost varies by integration.
• Never let submission data pass through a tool you have no BAA with. That includes generic Zapier-style middleware, shared spreadsheets, and Slack notifications.
• Turn off the plain-text email notification that most builders enable by default. Send a 'you have a new submission' alert with a link, not the answers.
• Budget for the file conversion. FormDr, for example, lists file conversion at $10.00 per page and implementation or training meetings at $250.00 per meeting — turning 40 pages of legacy PDFs into online forms is a real line item.
• Keep the marketing form and the clinical form separate. A 'request an appointment' form with name, phone and reason for visit is already PHI once you are a covered entity — but it does not need to collect a medication list.

That last rule is also a conversion rule. The longer the first form, the fewer people finish it — which is why we split intake into a short public request form and a long post-booking clinical packet. The relationship between form length and conversion rate is the reason, and the wider pattern is covered in our lead-capture guide.

Which one should a small practice actually buy?

If your only job is compliant patient intake, start with HIPAAtizer at $29–$34/month — it is the only mainstream builder that gives you a BAA below the $99 tier. If your forms also need to take payments, book appointments and collect e-signatures, pay for Jotform Gold at $99/month and stop pretending the $39 Silver plan will do. If you are a multi-location group with an EHR you must feed, look at FormDr and Formstack Enterprise, and make them put pricing in writing before the second call.

What none of them do is make your website compliant. The builder covers the form; you still own the page it sits on, the pixels on that page, and the inbox the notification lands in. If your practice is running ads or SEO to that form, the compliance surface is the whole funnel — the same reason we treat healthcare SEO as a compliance-aware discipline, not a keyword exercise.

If you want the funnel checked end to end — intake form, tracking, and the pages feeding it — our dental and medical practice SEO work starts there, and a conversion-focused website build fixes the page the form sits on. Get my free audit and we will tell you what is leaking before it costs you.