On this page
Only on Gold or Enterprise, and only after you turn HIPAA on. As of November 11, 2026, Jotform signs a BAA with eligible customers on those two plans who move their account into its HIPAA environment. On any other plan, or before you switch HIPAA on, a Jotform intake form is not a place for patient answers.
Checked November 11, 2026 on Jotform's HIPAA page, its HIPAA FAQ and its help article on enabling HIPAA. Confirm the current terms with Jotform before you publish a patient form.
What does Jotform say?
Jotform's HIPAA page says that "eligible customers with HIPAA features enabled can execute a signed Business Associate Agreement (BAA) with Jotform," and names the Gold and Enterprise plans. Its help article calls the HIPAA environment an upgrade "for eligible customers on the Gold subscription and on Jotform Enterprise."
The BAA is not automatic. You start a wizard from the account's Data page. It checks your plan, asks you to verify your email and set a strong password, moves your data to a dedicated HIPAA system, and reviews your forms for elements that aren't allowed. Once that's done, you sign the BAA from the same Data page, and the button changes to "View BAA." If you never see that button, you have no BAA.
What changes once HIPAA is on?
Three things matter for a practice:
- Notification emails go quiet. Jotform's FAQ says "No submission data will be included in any notification emails." You get an alert that a form came in and log in to read it. That's the point: answers stay off your inbox.
- Some widgets and integrations are blocked. The wizard flags any that don't qualify. Jotform doesn't publish a full list on that page, so check each form after migration.
- Every connected app needs its own BAA. The FAQ is direct about it: for any app you connect, "you must sign a Business Associate Agreement (BAA) with the company."
The mistake that undoes it: where the answers go next
Most practices that get Jotform wrong get the form right. The trouble is the pipe after it. A typical setup: a Gold account with HIPAA on, an intake form for new hormone patients, and a Zap that copies each submission into a Google Sheet and a CRM so a VA can follow up.
That Zap breaks the chain. Zapier says it can't sign a BAA, so every intake answer now passes through a tool with no BAA, and the CRM may not have one either. The form was covered; the copies aren't. See Is Zapier HIPAA compliant? for safer ways to move data.
Other places answers leak:
- Autoresponders that echo the patient's answers back to them by email
- Payment fields on the intake form, which send a description to the payment processor. Jotform's FAQ lists Stripe, Square and PayPal as payment options but doesn't say they're covered. Name the item "Initial visit," never the condition, as in our Stripe guide.
- PDF exports saved to a personal laptop or a shared drive without a BAA
- A second, older account on a lower plan that still hosts a copy of the form
What may go in a Jotform form, and what to keep out
With HIPAA on and the BAA signed, a Jotform intake form can hold what intake normally holds: health history, current medications, symptoms, goals, consent signatures and uploaded lab results. That's what the BAA is for.
Without HIPAA on, treat Jotform like any general web form. It's fine for a contact form that asks for name, email, phone and preferred time. It isn't fine for "Which symptoms are you having?" or "Upload your last labs," even on a short pre-screen.
Jotform or something else?
Jotform makes sense when you need a custom form outside your EHR, for example a pre-consult questionnaire linked from ads, and you can run it on Gold or Enterprise. It makes less sense when your EHR already has intake forms under its own BAA, because every answer then has to be moved from Jotform into the chart by hand or by an integration that also needs a BAA.
| Option | BAA | Answers land in |
|---|---|---|
| Jotform | Gold or Enterprise, with HIPAA turned on | Jotform, then wherever you send them |
| IntakeQ | Listed on its paid Forms plans | IntakeQ |
| Your EHR's forms | Covered by the EHR's BAA | The chart |
| Google Forms | Covered under the Google Workspace BAA, once accepted | Your Workspace Drive |
Whichever you pick, keep the form short. One intake form sent at the right moment beats three sent at once. Our guide to the hormone and functional medicine intake form covers what to ask and when.
To check the rest of your stack, use the BAA checker.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does Jotform sign a BAA?
Yes, on Gold or Enterprise. After you turn on HIPAA from the account's Data page and finish the migration wizard, you sign the BAA on the same page (as of November 2026).
Is the free Jotform plan HIPAA compliant?
No. Jotform offers its HIPAA environment and BAA only on Gold and Enterprise. Forms on other plans shouldn't collect health information.
Are Jotform email notifications HIPAA safe?
With HIPAA on, Jotform leaves submission data out of notification emails. You get an alert and log in to read the answers. Autoresponders you write yourself should not repeat health details either.
Can I connect Jotform to Zapier with HIPAA on?
Not for patient answers. Zapier says it can't sign a BAA, so sending intake data through a Zap moves it outside any BAA. Use integrations whose vendors sign a BAA with you.