Best HIPAA-Compliant Survey & Form Tools
The best HIPAA-compliant survey and form tool for most independent practices in 2026 is Jotform on the Gold plan ($99/mo billed annually) — it is the cheapest self-serve builder that bundles a signed BAA, e-signatures, and real conditional logic. If all you need is patient intake, IntakeQ is cheaper and signs a BAA on every plan from $29.90/mo. And yes, Google Forms can be HIPAA compliant — under a paid Workspace account with the BAA accepted.
We compared seven tools on the questions a practice manager actually has to answer: which plan the BAA attaches to, whether the tool can capture a signature on a consent form, and how a completed intake form gets into the chart. Last verified 2026-08-24.
Best Overall Form Builder
Jotform (Gold)
Signed BAA, e-signatures, and healthcare templates in one builder for $99/mo
Best for Patient Intake
IntakeQ
Healthcare-native forms with a BAA on every plan, from $29.90/mo
Lowest Added Cost
Google Forms
Covered by the Workspace BAA your practice may already have signed
FIG · 01Is Google Forms HIPAA compliant?
Yes — but only under a paid Workspace account with the BAA accepted
Google's HIPAA Included Functionality list (updated May 14, 2026) explicitly covers Google Forms as part of Google Drive, alongside Docs, Sheets, and Slides. The same amendment that covers Gmail and Google Drive covers Forms — one signature, no per-product fee.
Three conditions have to hold before a Google Form can legally collect patient information:
- A paid Google Workspace plan (Business Starter is enough — from $7/user/mo billed annually as of Aug 2026). Free consumer Gmail accounts can never be compliant.
- A super administrator must accept Google's Business Associate Amendment in the Admin Console — Apps → Google Workspace → Settings. It costs nothing extra.
- Admin configuration: restrict form and response sharing outside the domain, enforce 2-Step Verification, and turn off any non-covered services that could touch responses.
The catch is not compliance — it's capability. Compared with the purpose-built tools below, Google Forms has three gaps that matter in a clinical workflow:
- No e-signature — consent forms that need a legally attributable signature can't live in Google Forms.
- Conditional logic stops at “go to section based on answer.” No field-level branching, calculations, or repeating sections.
- No EHR integration and no intake workflow. Responses land in Sheets; getting them into a chart is manual.
Our read: Google Forms is the right answer for internal use — staff surveys, training sign-offs, incident intake — when the Workspace BAA is already in place. For patient-facing intake and consent forms that need signatures, a dedicated tool earns its subscription.
Which HIPAA-compliant survey and form tools are worth comparing in 2026?
Every tool below can be operated in compliance with the HIPAA Security Rule's technical safeguards (45 CFR §164.312) and will execute a Business Associate Agreement — on the right plan. The differences that matter are which tier the BAA attaches to, whether the tool can capture a legally attributable signature, and how form data reaches your chart.
Jotform
The most complete HIPAA form builder for independent practices
Strengths
- HIPAA features with signed BAA on Gold ($99/mo annual) and Enterprise
- Encrypted submission storage with HIPAA-eligible field markers
- Jotform Sign e-signatures with audit-ready activity logs
- Hundreds of healthcare templates plus strong conditional logic
Limitations
- Bronze and Silver plans cannot sign a BAA — HIPAA starts at Gold
- Some third-party integrations are disabled in HIPAA mode
- $99/mo is steep if all you need is one intake form
Google Forms
Covered by the Workspace BAA your practice may already hold
Strengths
- On Google's HIPAA Included Functionality list (under Google Drive)
- No added cost beyond paid Workspace — from $7/user/mo annual
- Responses export to Google Sheets, which the same BAA covers
- Zero training burden — staff already know how it works
Limitations
- No e-signature and no healthcare templates
- Branching limited to section jumps — no field-level logic
- Compliance rests entirely on your admin configuration
Formstack
Enterprise workflow forms with EHR and Salesforce connections
Strengths
- AES-256 encryption and SOC 2 Type II certification
- EHR and Salesforce Health Cloud integrations
- Suite tier adds document generation and native e-signature
- Built for multi-step approval and routing workflows
Limitations
- HIPAA is a paid add-on on Forms/Suite plans (quote required)
- Forms plan is $83/mo (annual) for 1 builder user and 25 forms
- Priced for organizations, not solo practices
SurveyMonkey
Patient-experience surveys at enterprise scale
Strengths
- HIPAA settings and BAA available on the Enterprise plan
- Mature analysis, benchmarks, and reporting
- Skip logic, quotas, and multilingual survey support
- Familiar respondent experience — high completion rates
Limitations
- Self-serve plans (Standard, Advantage, Team) cannot be compliant
- Enterprise requires a sales quote — no listed price
- No e-signature; weak as an intake or consent tool
Qualtrics
Research-grade patient experience programs
Strengths
- Signs BAAs and holds HITRUST CSF certification
- Advanced branching, quotas, and statistical analysis
- Healthcare edition built for CAHPS-style programs
- Handles patient-reported outcomes at scale
Limitations
- Custom enterprise pricing only
- Implementation is measured in weeks, not hours
- Far more platform than a small practice will use
IntakeQ
Healthcare-native intake forms with a BAA on every plan
Strengths
- BAA included on all plans — no enterprise upsell
- E-signatures and secure document sharing standard
- Forms-only from $29.90/mo (low volume) or $54.90/mo standard
- Optional practice-management tier adds scheduling and billing
Limitations
- Intake-focused — weaker as a general survey tool
- Per-practitioner fees add up for group practices
- Light on analytics compared with survey platforms
Cognito Forms
Budget HIPAA forms with e-signature, no sales call needed
Strengths
- Enterprise plan ($129/mo annual) includes the BAA at no extra fee
- Forms encrypted at rest for HIPAA customers, uploads included
- E-signature fields plus calculations and repeating sections
- Self-serve signup — no enterprise sales cycle
Limitations
- HIPAA available only on the Enterprise tier ($174 month-to-month)
- No EHR integrations — export is CSV/JSON
- Fewer healthcare-specific templates than Jotform
Prices and plan tiers last verified 2026-08-24 against each vendor's published pricing.
How do the tools compare on BAA tier, encryption, and e-signature?
Every tool here encrypts data in transit and at rest on its HIPAA-capable tier — table stakes under the HIPAA encryption requirements. The columns that actually separate them are the BAA tier, signature capture, and how data reaches your EHR.
| Tool | BAA Tier | Encrypted at Rest | E-Signature | EHR Integration | Conditional Logic | HIPAA Price From |
|---|---|---|---|---|---|---|
| Jotform | Gold + Enterprise | Yes | Yes | Partial | Yes | $99/mo |
| Google Forms | Any paid Workspace | Yes | No | Partial | Partial | $7/user/mo |
| Formstack | Add-on; std. on Enterprise | Yes | Partial | Yes | Yes | $83/mo + add-on |
| SurveyMonkey | Enterprise only | Yes | No | Partial | Yes | Custom |
| Qualtrics | Enterprise (BAA on request) | Yes | No | Partial | Yes | Custom |
| IntakeQ | All plans | Yes | Yes | Partial | Yes | $29.90/mo |
| Cognito Forms | Enterprise only | Yes | Yes | No | Yes | $129/mo |
Legend: ✓ = Yes · – = Partial (export/API only, higher tier, or limited) · ✗ = No. Formstack e-signature requires the Suite tier; Google Forms “EHR” is Sheets export only; Jotform, SurveyMonkey, Qualtrics, and IntakeQ move data via export or API rather than native EHR connections. Verified 2026-08-24.
What does a HIPAA-capable plan actually cost?
The list price on a vendor's homepage is rarely the HIPAA price. Four of the seven tools put the BAA on a tier above the one most buyers start on. This table shows the cheapest plan that can legally hold PHI, as of August 2026.
| Platform | HIPAA Tier | Annual Billing | Monthly Billing | BAA Fee |
|---|---|---|---|---|
| IntakeQ | Every plan | $29.90–$84.90/mo | Same | Included |
| Google Forms | Any paid Workspace | $7/user/mo | $8.40/user/mo | Free (Admin Console) |
| Formstack | Forms/Suite + add-on | $83/mo + quote | $99/mo + quote | With add-on |
| Jotform | Gold | $99/mo | $129/mo | Included |
| Cognito Forms | Enterprise | $129/mo | $174/mo | Included |
| SurveyMonkey | Enterprise | Custom quote | — | Included |
| Qualtrics | Enterprise | Custom quote | — | On request |
Sorted by lowest HIPAA-capable entry price. IntakeQ adds $10–$30 per extra practitioner depending on plan. Formstack's HIPAA add-on is quoted, not listed. Verified 2026-08-24.
The tier-jump trap
The most common finding when we review a practice's vendor list during a risk assessment is a form tool on a plan that cannot sign a BAA — a Jotform Silver account, a SurveyMonkey Team seat, a free Cognito plan — quietly collecting patient names and dates of birth. The vendor's security is fine; the contract does not exist. Under 45 CFR §164.308(b) that is a violation on day one, regardless of whether anything leaks. Check the tier before you build the form.
Which survey tool is best for your practice?
Start from the form you need most. A practice replacing a paper patient intake form and medical history form has different needs from one measuring satisfaction across six locations.
New-patient intake packet
IntakeQ
Demographics, insurance, history, and signed consent in one packet, e-signed before the visit, BAA on every plan. Start from $29.90/mo.
Intake plus surveys plus consent
Jotform Gold
One builder covers intake, satisfaction surveys, and e-signed consent with field-level logic. $99/mo annual is the all-in-one price.
Staff surveys and internal forms
Google Forms
Training sign-offs, incident intake, and engagement surveys stay inside the Workspace BAA you already accepted. No added spend.
Forms that must land in the EHR
Formstack
EHR and Salesforce Health Cloud integrations with approval routing. Budget for the HIPAA add-on on top of the $83/mo Forms plan.
Patient-experience program at scale
Qualtrics or SurveyMonkey Enterprise
Benchmarks, quotas, and analysis for CAHPS-style programs across locations. Both are quote-only and sized for health systems.
What about Typeform, free plans, and other builders?
The questions we hear most often from practice managers, answered against each vendor's current terms. For broader compliance tooling, see our HIPAA compliance software comparison.
Is Typeform HIPAA compliant?
Only on Enterprise or Growth Custom plans, where Typeform will provide a BAA on request through sales. Basic, Plus, and Business plans are not HIPAA-eligible. Enterprise is custom-quoted and priced well above what a small practice pays for Jotform or IntakeQ, so Typeform is rarely the right pick unless you already hold an Enterprise contract.
Is Jotform HIPAA compliant on the free or Silver plan?
No. Jotform's HIPAA features and BAA are limited to Gold ($99/mo annual) and Enterprise. A Silver account with an intake form on it is collecting PHI without a business associate agreement.
Can a free survey tool ever be HIPAA compliant?
No. None of the seven vendors here sign a BAA on a free plan, and a BAA is required before a vendor may create, receive, or maintain PHI on your behalf. The only zero-added-cost option is Google Forms — and that works because you are already paying for Workspace.
Do I need a survey tool or an intake tool?
Surveys are anonymous or low-identity feedback; intake is identified clinical data with signatures. SurveyMonkey and Qualtrics are built for the first. IntakeQ is built for the second. Jotform and Formstack straddle both, which is why they cost more than either specialist.
How do I deploy a survey tool without creating a violation?
Picking a compliant vendor is the easy half. These five steps are the ones that show up as gaps in our HIPAA compliance checklist when a practice rolls out online forms.
Execute the BAA before the first submission
CriticalConfirm the signed agreement is on file and names the plan you are actually on. For Google Workspace, a super admin accepts the amendment in the Admin Console; for Jotform and Cognito Forms it is tied to the account tier.
Turn on the vendor's HIPAA mode
CriticalA BAA does not flip the switches for you. SurveyMonkey Enterprise, Jotform Gold, and Cognito Enterprise each have an account-level HIPAA setting that enables encrypted storage and disables non-covered integrations.
Restrict who can open responses
RequiredUnique logins, MFA, and role-based access to submissions. Shared front-desk logins fail the access-control standard at 45 CFR §164.312(a).
Keep PHI out of notification emails
RequiredMost builders email a copy of each submission by default. Set notifications to a link-only summary, or route them to an inbox covered by its own BAA.
Set retention and export rules
RequiredDecide where submissions live long-term — usually the chart, not the form tool — and purge the vendor copy on a schedule. Keep the audit log export with your risk-assessment records.
Quick Reference Card
| If You Need | Our Pick | HIPAA Tier From |
|---|---|---|
| Patient intake + consent | IntakeQ | $29.90/mo |
| All-purpose form builder | Jotform Gold | $99/mo |
| Already on Workspace | Google Forms | No added cost |
| Budget e-signed forms | Cognito Forms Ent. | $129/mo |
| EHR-connected workflows | Formstack | $83/mo + add-on |
| Enterprise patient experience | Qualtrics / SurveyMonkey | Custom |
Whichever tool you pick, keep the signed BAA on file, and build your forms from a reviewed template — our free patient intake form and informed consent form are a good starting point for the field list.
Related Tools & Guides
Patient Intake Form Template
Editable intake packet with demographics, insurance, and consent fields.
Medical History Form Template
Structured history form you can rebuild in any of the tools above.
Informed Consent Form Template
Consent language and signature block for e-signature workflows.
Is Google Drive HIPAA Compliant?
The Workspace BAA that also covers Google Forms, explained.
BAA Template Generator
Draft a Business Associate Agreement for vendors without a standard one.