7 Best HIPAA-Compliant Form Builders for Healthcare (2027)

The best HIPAA-compliant form builder is one whose vendor will sign a Business Associate Agreement (BAA) on the plan you actually pay for, and that keeps responses somewhere your clinic can control. For most clinics that narrows the field fast. Jotform needs its Gold plan ($129/month, or $99/month billed yearly). Cognito Forms needs Enterprise. Zoho Forms lists HIPAA only on Premium. Typeform offers a BAA only on Enterprise or Growth Custom. Formstack sells HIPAA as an add-on. Google Forms can be covered, but only inside a paid Google Workspace account whose admin has accepted Google's BAA. Paperform says it doesn't sign BAAs yet. Our pick, ClinikForms, runs inside ClinikEHR under the same BAA as the patient chart, and its forms are included on the Free plan.

ClinikEHR makes ClinikForms. Here's how we judged every option, including ours.

Quick Answer

Note: Every competitor price and HIPAA statement below comes from the vendor's own page, checked in September 2026. Plans change, so check each vendor's current terms before you sign. This article isn't legal advice.

How We Evaluated

We scored each builder against five questions that matter when the answers are protected health information (PHI):

1. Is a BAA available, and on which plan? HHS explains that a covered entity may share PHI with a business associate only after getting "satisfactory assurances", in the form of a business associate agreement, that the information will be protected (HHS: Business Associates, checked September 2026). A builder that won't sign one on your plan is out, however good it looks.
2. What does that plan cost? We quote the cheapest plan that includes HIPAA, not the cheapest plan overall. The gap is often large.
3. Builder depth. Conditional logic, calculated fields, file uploads and payments decide whether one form can replace a clipboard, a spreadsheet and a card terminal.
4. Where responses live. A response sitting in a separate forms account has to be copied into the chart by someone. A response that lands on the record doesn't.
5. Healthcare fit. Signatures, reminders, scored questionnaires and in-person completion at the front desk.

This guide is about the form builder itself. If you're comparing full intake systems, including portals and EHR bundles, read our patient intake and digital forms software comparison. For the signature side, see the best HIPAA-compliant e-signature software.

The 7 Best HIPAA-Compliant Form Builders

1. ClinikForms (ClinikEHR): Our Pick

Best for: clinics that want every answer on the patient's chart, not in a second account.

ClinikForms is the forms and e-signature module inside ClinikEHR, and it runs under the same BAA as the chart. That's the main difference from everything else on this list: you don't buy a HIPAA tier, and you don't copy answers across.

The builder covers the question types a clinic uses: short and long text, email, phone, number, choice, checkbox and dropdown questions, scales and ratings, grids, dates and times, file upload, signature and location. A Calculation question works a number out from other answers, such as a BMI or a total score, using functions like sum, average, min, max and round. The Logic tab shows or skips questions based on earlier answers, and calculations can feed that logic. Answers can be filled in from the patient record for the patient to check, and you can save question groups to reuse across forms.

Responses are kept with the client in ClinikEHR. You can read them as a summary, question by question or one at a time, save report views, and export to CSV or Excel on every plan. On Essential and above, scored clinical measures such as the PHQ-9 are scored as their authors publish them and recorded on the chart (see our PHQ-9 and GAD-7 guide).

Sending is where it pays off: forms go out from the chart, as a link, as a pack of several forms, automatically when a visit is booked, or on a clinic device at the desk. Patients don't need an account. Reminders go out on their own, one email per person however many forms they still owe.

Limitations, honestly: ClinikForms has no payment question. Card payments run through ClinikEHR billing instead, at a 1.9% ClinikEHR platform fee plus Stripe's standard 2.9% + $0.30, charged separately. Embedding a form on your own website, removing ClinikEHR branding and webhooks need the Team plan. And it only makes sense if you use, or will use, ClinikEHR as your record.

Price: Free ($0) includes 10 published forms, 100 responses per form, signature questions, 1 GB of form storage and 2 automations per form. Essential ($99.90/month) adds 100 eSignature envelopes a month, 50 GB and scored measures. Team ($250/month) adds 500 envelopes, 250 GB, embedding and webhooks. See ClinikForms & eSignatures and pricing.

2. Jotform

Best for: clinics that want the most capable standalone builder and don't mind a separate account.

Jotform is a mature builder with payments, conditional logic, widgets and its own signature product, Jotform Sign. For HIPAA, its pricing page says the Gold plan "provides optional HIPAA compliance features", including encryption, auditing and PHI segmentation, available on Gold and Enterprise. Jotform's free plan excludes them. Gold is $129/month, or $1,188/year ($99/month billed yearly). The plan data on that page lists 10,000 monthly submissions, 100 forms and 1,000 payment submissions for Gold (jotform.com/pricing, checked September 2026). Jotform's HIPAA page says covered entities that enable HIPAA features "will also receive a signed Business Associate Agreement" (jotform.com/hipaa, checked September 2026).

Limitations: Bronze ($39/month) and Silver ($49/month) don't include HIPAA features, so the real entry price for clinical use is Gold. Responses live in Jotform until you connect them to your EHR.

3. Cognito Forms

Best for: forms with heavy calculations, repeating sections and approval workflows.

Cognito Forms offers calculations ("Solve your form's math problems on the fly"), file uploads and conditional logic (cognitoforms.com, checked September 2026), and its pricing page lists payments on every plan, including the free one. HIPAA is Enterprise-only: its help centre says "Your organization must be on the Cognito Forms Enterprise plan (and not a trial) in order to enter into a BAA", and that there is no extra cost for the BAA beyond that subscription (cognitoforms.com, checked September 2026). The pricing page showed Enterprise at $129/month billed annually, or $174 month to month, with unlimited entries and 20 users (cognitoforms.com/pricing, checked September 2026).

Limitations: the lower plans aren't for PHI, and you can't sign the BAA during a trial, so you pay for Enterprise before you can test with real patient data.

4. Formstack

Best for: larger organisations that also need document generation and signing in one suite.

Formstack's Forms plan is $99/month, or $83/month paid annually, with one builder user, 25 forms and 1,000 submissions per form. Its Suite plan (forms, documents and signing) is $299/month, or $250/month paid annually. On the same page, "Match HIPAA and compliance requirements" is marked "+ Add On" for both plans (formstack.com/pricing, checked September 2026). Formstack's HIPAA page offers "Formstack's Standard BAA" or a review of your own BAA (formstack.com, checked September 2026).

Limitations: the price of the HIPAA add-on isn't published, so you'll need a quote. One builder user on the entry plan is tight for a clinic with several staff editing forms.

5. Zoho Forms

Best for: clinics that already run on Zoho apps.

Zoho Forms' pricing comparison lists "HIPAA Compliance/ePHI" on the Premium plan only, with Premium including 150,000 submissions a month and 10 GB of storage. The page also lists payment gateway integrations such as Stripe, PayPal and Square (zoho.com/forms/pricing, checked September 2026). Zoho's HIPAA page says you can request its BAA template by emailing its legal team (zoho.com, checked September 2026).

Limitations: Zoho shows prices by region. When we checked, the page displayed Premium at ₦69,300/month billed annually in naira and didn't show a US dollar figure, so check Zoho's current price in your currency.

6. Google Forms (with Google Workspace)

Best for: clinics already on a paid Google Workspace account who need simple forms.

Google Forms is a common first choice and it's often assumed not to be covered. In fact, Google's list of HIPAA "Included Functionality" names "Google Drive (including Google Docs, Google Forms, ...)" as covered under its Business Associate Addendum (workspace.google.com, checked September 2026). The catch is the BAA itself: Google says customers who haven't signed its BAA "must not use PHI" in Workspace, and the BAA is accepted by a super administrator in the Admin console (Google Workspace Admin Help, checked September 2026). Because the BAA is accepted in the Workspace Admin console, a personal Google account, which has no Admin console, doesn't offer this route. Google Workspace Business Starter is $7 per user per month on an annual commitment (workspace.google.com/pricing, checked September 2026).

Limitations: the BAA covers the service, not your set-up. Responses sit in Forms and Sheets, so sharing settings, add-ons and who can open the sheet are yours to control. Google's HIPAA implementation guide says it's the customer's responsibility to make sure HIPAA-compliant measures are in place with any third party or add-on before sharing PHI (Google implementation guide, checked September 2026).

7. Typeform

Best for: friendly, one-question-at-a-time forms, where the budget allows Enterprise.

Typeform's self-serve plans start at $39/month on monthly billing (Basic, 100 responses a month), with conditional logic on every plan. HIPAA is marked "Enterprise only" on its pricing page (typeform.com/pricing, checked September 2026). Its help centre says "we can currently provide a BAA for customers on our Enterprise or Growth Custom plans" (help.typeform.com, checked September 2026).

Limitations: Enterprise pricing isn't published. So yes, Typeform can be used with PHI, but not on Basic, Plus or Business.

Not on the List: Paperform (No BAA Yet)

Best for: non-clinical forms such as event sign-ups, job applications and general enquiries.

Paperform is a flexible, good-looking builder that covers conditional logic, calculator forms and payment forms. Its Pro plan is $49/month billed annually, with unlimited submissions and 10 GB of upload storage. But its pricing page is direct: Paperform "is not HIPAA compliant and doesn't sign Business Associate Agreements today", with HIPAA support "planned for the first half of 2027" (paperform.co/pricing, checked September 2026). Don't collect patient information in it until that changes.

Builder Features Side by Side

"Check with" means the vendor pages we opened didn't confirm it either way, not that the feature is missing. Zoho Forms lists payment gateways and conditional rules on its pricing page, and Paperform offers conditional logic, calculator forms and payment forms.

Why does "where responses live" get its own row? Because it decides who does the copying. With a standalone builder, someone on your team matches each response to the right patient and moves the answers or the PDF into the chart. That's manual work and a place for mistakes, such as a consent filed against the wrong person with a similar name. Integrations can automate it, but each connection is another vendor that touches PHI and needs to be covered.

How to Choose in Four Steps

1. List what the form must collect. If it holds health information, a symptom, a diagnosis, a medication or a signed consent, treat it as PHI.
2. Find the plan that comes with a BAA. Ignore the headline price and look for the plan that includes HIPAA. Then ask the vendor for the BAA before you build anything.
3. Decide where answers should end up. If staff will copy answers into the chart, count that time as a cost. A builder inside your record system removes the step.
4. Test the patient side on a phone. Fill the form in yourself, upload a photo of an insurance card and sign. If it's awkward for you, it will be for a patient in the waiting room.

A quick check before you go live: the BAA is signed, only staff who need responses can see them, notification emails don't repeat answers in full, and you know how to export and delete data when a patient asks. For the legal side of signatures on intake forms, see our guide to digital intake forms with e-signature.

Product Insight: Why We Built ClinikForms Into the Record

Standalone builders are good at building forms. The work that follows, chasing unfinished forms, matching a response to the right patient and retyping answers, is where clinics lose time. ClinikForms starts from the chart:

• One BAA. Forms run inside ClinikEHR under the same BAA as the rest of the record.
• Answers on the chart. No export and import, and scored measures tracked over time on Essential and above.
• Sending that follows the visit. Packs of forms, sent when a visit is booked, with automatic reminders.
• Signatures included. Signature questions on every plan, and eSignature envelopes with a certificate of completion from Essential.
• Free to start. The Free plan needs no card. To try Essential, a 30-day trial costs $29.90.

See ClinikForms & eSignatures, patient management, online booking and our pricing page.

Frequently Asked Questions (FAQs)

1. What makes a form builder HIPAA compliant?

No product is compliant by itself. What matters is that the vendor signs a BAA with your practice on the plan you use, and that you configure and use the forms securely. Without a BAA, don't collect patient information in it.

2. Is Google Forms HIPAA compliant?

Google lists Google Forms as covered under its Workspace BAA, as part of Google Drive. You need a Google Workspace account whose admin has accepted the BAA in the Admin console, which a personal Google account doesn't have.

3. Which Jotform plan is HIPAA compliant?

Jotform lists HIPAA compliance features on Gold and Enterprise. Covered entities that enable them receive a signed BAA. Gold is $129/month, or $99/month billed yearly.

4. Does Typeform sign a BAA?

Typeform says it can provide a BAA for customers on its Enterprise or Growth Custom plans. Its self-serve plans don't include HIPAA.

5. Is Paperform HIPAA compliant?

Not yet. Paperform's pricing page says it isn't HIPAA compliant and doesn't sign BAAs today, with HIPAA support planned for the first half of 2027.

6. Is there a free HIPAA-compliant form builder?

ClinikForms is included on ClinikEHR's Free plan, with 10 published forms and 100 responses per form, under ClinikEHR's BAA. Most standalone builders reserve HIPAA for a paid higher tier.

Conclusion

Most form builders can be used with patient information, but rarely on the plan you'd pick by price alone. Jotform needs Gold, Cognito Forms needs Enterprise, Zoho Forms needs Premium, Typeform needs Enterprise, Formstack needs an add-on and Google Forms needs a Workspace account with the BAA accepted. Paperform isn't an option for PHI yet. Once you've found the plan with a BAA, the deciding question is where the answers end up. If your team would otherwise retype them into the chart, a builder inside your record system saves more than it costs.

Key takeaways:

• Check which plan includes the BAA, not just which vendor offers one
• Compare the price of that plan, not the cheapest plan
• Logic, calculations and file uploads are common; payments and chart integration aren't
• Google Forms is covered only through a Google Workspace account with the BAA accepted
• ClinikForms keeps answers on the chart under ClinikEHR's BAA, from the Free plan

Ready to move your forms onto the chart? Try ClinikEHR free, explore our pricing, or book a free demo.

Disclaimer: Vendor plans and terms change. Figures here were checked on each vendor's own pages in September 2026. This article is educational and not legal advice; confirm your obligations with a compliance adviser. ClinikEHR and its authors shall not be held liable for any decisions made based on the information provided herein.

Related Articles

• 7 Best Patient Intake & Digital Forms Software in 2027
• 7 Best HIPAA-Compliant E-Signature Software for Clinics (2027)
• Digital Intake Forms With E-Signature
• Is DocuSign HIPAA Compliant?
• PHQ-9 and GAD-7 Online: Scored Questionnaires