On this page
Only on its top plans, and only once a BAA is signed. As of November 12, 2026, Typeform's help center says it can provide a BAA to customers on its Enterprise or Growth Custom plans, requested through sales. Its usage policy says that without a signed BAA you must not submit information covered by HIPAA. On any other plan, a Typeform is not the place for intake answers.
Checked November 12, 2026 on Typeform's usage policy, its healthcare page and its help center article on the business associate agreement. Confirm the plan and the BAA with Typeform sales before you publish a patient form.
What does Typeform say?
Typeform's usage policy is the clearest of its pages. If you plan to collect information covered by HIPAA, you are to notify Typeform so it can assess offering "HIPAA-compliant services." Then: "Unless a Business Associate Agreement is signed, Client shall not submit information subject to HIPAA requirements." Typeform also disclaims any promise that its services meet HIPAA obligations on their own.
Its help center article on the BAA names the plans: Typeform says it can currently provide a BAA for customers on Enterprise or Growth Custom, and that those customers should ask the sales team, giving the organization's name and the account's email address. Its healthcare page says "The Enterprise Plan includes HIPAA compliance."
Both plans are sold through sales, not from the pricing page checkout. So for a solo practice the working answer is: the self-serve plans don't come with a BAA.
How do you get the BAA?
- Contact Typeform sales and say you are a healthcare provider who will collect protected health information.
- Ask which plan you need and for a copy of the BAA.
- Have the BAA signed by both sides before any form with health questions goes live.
- Ask which features and integrations the BAA leaves out, and get the answer in writing.
- Keep the signed copy with your other vendor agreements.
If sales tells you the plan is out of reach for a practice your size, that is your answer. Use a form tool with a BAA on a plan you can buy yourself.
What may go in a Typeform, and what to keep out
With a signed BAA, a Typeform can hold what intake normally holds: health history, symptoms, current medications, goals and consent.
Without one, treat Typeform like any general web form:
- Fine: a contact form asking for name, email, phone and a good time to call.
- Fine: a webinar sign-up or a feedback survey with no health questions and no names tied to care.
- Not fine: "What symptoms are you having?", "List your current medications" or "Upload your last labs."
- Not fine: a "quiz" that sorts people by symptom or goal and then asks for their email. The result plus the email is health information about a named person.
Where do practices slip up?
The quiz is the common one. Typeform is good at friendly, one-question-at-a-time flows, so practices build a "Is hormone therapy right for you?" quiz for their ads. Each answer is a symptom, and the last screen asks for a name and email to send the result. On a self-serve plan, every completed quiz is a small health record held with no BAA.
The second slip is what happens after the form. Typeform connects to spreadsheets, CRMs, email tools and Zapier. Even with a BAA from Typeform, every tool that receives the answers needs its own. Zapier says it can't sign one; see Is Zapier HIPAA compliant? The same goes for sending quiz results into Mailchimp, covered in Is Mailchimp HIPAA compliant?
If you want a quiz in your ads, keep it general and anonymous until the end, then ask only for contact details, with no result attached to the name. Ask the health questions later, in a covered form.
Typeform or something else?
| Option | BAA | Plan |
|---|---|---|
| Typeform | Yes, through sales | Enterprise or Growth Custom |
| Jotform | Yes | Gold or Enterprise, with HIPAA turned on |
| IntakeQ | Yes | Listed on its paid Forms plans |
| Google Forms | Yes, under the Google Workspace BAA | A Workspace account with the BAA accepted |
| Your EHR's forms | Covered by the EHR's BAA | Depends on the EHR |
| Tally | No | Its own comparison page lists HIPAA-compliant forms as not available |
For most solo practices, the EHR's own forms are the shortest path, because answers land in the chart. If you need a stand-alone form, Jotform on Gold with HIPAA turned on is the one you can set up without talking to sales. Our intake form guide covers what to ask and when.
To check your other tools, use the HIPAA and BAA checker.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does Typeform sign a BAA?
Yes, for customers on its Enterprise or Growth Custom plans, requested through the sales team (as of November 2026). Its usage policy says not to submit HIPAA-covered information unless a BAA is signed.
Is the free or Basic Typeform plan HIPAA compliant?
No. Typeform names only Enterprise and Growth Custom for a BAA. Forms on other plans shouldn't ask health questions.
Can I use Typeform for a symptom quiz in my ads?
Not if it ties symptom answers to a name or email on a plan with no BAA. Keep the quiz general, and collect health details later in a form that is covered.
What is a HIPAA-compliant alternative to Typeform?
Jotform signs a BAA on Gold and Enterprise once HIPAA is turned on, and IntakeQ lists one on its paid Forms plans. Forms inside an EHR are covered by the EHR's BAA.