14 Best HIPAA Form Builders in 2026

Which HIPAA form builder should you choose?

A form builder is only HIPAA-capable if the vendor will sign a Business Associate Agreement. Everything else, the encryption, the access logs, the security page, means nothing without that signature.

That single requirement removes most form software immediately, and it is why HIPAA-capable plans cost several times more than standard ones. The 14 tools below are compared on what the compliant tier actually costs and what you get on it.

How the 14 HIPAA form builders compare at a glance

The table shows the cheapest plan on which each vendor will sign a BAA, since that is the only price that matters for protected health information. Anything cheaper on their pricing page cannot legally carry PHI.

How we picked and ranked these 14 tools

Everything here comes from the vendors' own pricing and compliance pages, read in full. The ranking question was simple: which plan will the vendor sign a BAA on, and what does that plan cost each month?

Several vendors publish no price for their compliant tier, and where that is the case this page says so. One tool in this list, our own, does not offer HIPAA at all, and it is included so the comparison is complete rather than convenient.

1. Jotform Gold, cheapest self-serve HIPAA

Jotform Gold is the least expensive way to get a signed BAA without a sales call. You upgrade, enable HIPAA features in the account settings, and the BAA is available through the dashboard.

The compliant account gets encrypted storage and access logs, plus the option to disable data retention entirely, alongside the same 20,000+ template library as every other Jotform tier.

Gold costs $129 a month on monthly billing, or $99 billed yearly. HIPAA is not available on Bronze or Silver at any price.

Best for: small practices that want compliance without a procurement process.

The catch: the jump from Silver at $49 to Gold at $129 is entirely about compliance, so you pay 2.6 times more for the same builder.

G2 rating: 4.7/5, from 5,426 reviews, the largest base of any tool here.

2. Formstack, best for regulated enterprises

Formstack builds for regulated industries as its default posture rather than as an upgrade. HIPAA support, granular permissions and audit trails are standard concerns in its product design.

The Suite extends into document generation and signature, so a patient intake form can produce a consent document and route it for signing inside one platform.

Forms starts at $99 a month on monthly billing, and the Suite at $299, above the advertised annual rates of $83 and $250.

Best for: healthcare organisations that need forms, documents and signature under one BAA.

The catch: at $99 a month minimum it is a compliance purchase, not a form-builder purchase, and it prices accordingly.

G2 rating: 4.3/5, from 471 reviews. A large base, with cost the usual complaint.

3. Cognito Forms Enterprise, best for complex clinical intake

Clinical intake often needs repeating sections, one block per medication, per symptom, or per family member. Cognito Forms handles that natively where most builders need workarounds.

Calculations are built in too, which covers scoring instruments and risk assessments without exporting to a spreadsheet.

HIPAA arrives only on Enterprise at $174 a month, or $129 billed yearly. That tier also removes the entry metering that applies to every plan below it.

Best for: practices whose intake forms involve repeating clinical data or scoring.

The catch: HIPAA sits on the $174 tier, so a small practice pays enterprise pricing for compliance it cannot avoid.

G2 rating: 4.6/5, from 133 reviews. A reasonable base with a consistently good score.

4. Alchemer, best for clinical research

Alchemer is a research platform, and for clinical studies that distinction matters. Its logic, piping and reporting handle longitudinal instruments that a form builder would struggle to express.

HIPAA support is available on its business platform accounts, arranged through its sales team rather than enabled from a settings page.

Published pricing is per user per month: Collaborator at $55, Professional at $165, and Full Access at $275, with the upper two capped at three users.

Best for: clinical research teams running structured studies.

The catch: three people on Professional costs $495 a month, and HIPAA still needs a separate conversation on top.

G2 rating: 4.4/5, from 956 reviews. A large base, with cost the recurring theme.

5. SurveyMonkey Enterprise, best for large health systems

SurveyMonkey Enterprise is what large health systems buy when patient experience surveys need to run consistently across many departments under one agreement.

The governance layer is the purchase: shared question banks, controlled templates and reporting that rolls up across the organisation.

Enterprise pricing is quoted rather than published. The team plans below it are $30 and $92 per user a month, both with a three-seat minimum, and neither carries a BAA.

Best for: health systems standardising patient experience measurement.

The catch: you cannot budget for it from the pricing page, because only the non-compliant tiers are published.

G2 rating: 4.4/5, from 23,901 reviews. A very large base reflecting long familiarity.

6. FormAssembly, best for Salesforce-based healthcare

FormAssembly's reason to exist is Salesforce. Its forms write directly into Salesforce objects, which suits healthcare organisations running patient or donor records there.

HIPAA compliance with a BAA sits on the Atlas Enterprise plan, alongside advanced security controls and a dedicated success plan.

FormAssembly does not publish prices for any tier. Plan names are listed, and rates are arranged through their team, so this page does not quote figures.

Best for: healthcare and non-profit organisations running Salesforce.

The catch: no prices are published at any tier, so there is no way to compare cost before contacting them.

G2 rating: 4.4/5, from 425 reviews. A solid base for an enterprise-focused product.

7. 123FormBuilder, best for straightforward compliant forms

123FormBuilder offers HIPAA on its Enterprise Compliance tier, with a straightforward builder that does not demand the setup effort of the enterprise platforms.

For a practice that wants compliant forms without adopting a whole system, that simplicity is the appeal.

The company no longer publishes a pricing grid; its pricing URL now leads to a pricing FAQ. Rates for the compliance tier are arranged through their team, so none are quoted here.

Best for: practices wanting compliant forms without an enterprise rollout.

The catch: the pricing page no longer shows a plan grid, so you cannot compare it against anything without asking.

G2 rating: 4.5/5, from 175 reviews. A reasonable base for an established product.

8. WPForms Pro, best for WordPress clinics

WPForms takes a different route to compliance. Because it runs inside your own WordPress site, submissions never touch a third-party server, so there is no business associate to sign an agreement with.

That shifts the burden onto you: your hosting, your encryption, your access controls and your risk assessment. Done properly it works; done casually it does not.

Pro costs $399 a year at renewal, with a lower first-year promotional rate. Elite is $599 at renewal.

Best for: clinics with WordPress sites and the technical capacity to secure them.

The catch: self-hosting means you own the compliance obligation entirely, including hosting, encryption and audit logging. That is a real responsibility, not a technicality.

G2 rating: 4.7/5, from 971 reviews. A large base among WordPress users.

9. Microsoft Forms, best bundled with your suite

If your organisation already runs Microsoft 365, PHI handling may already be covered. Microsoft's BAA extends to Forms when the tenant is configured for it, at no additional cost.

For internal clinical surveys and staff forms, that removes both the purchase and the vendor review, which is often the fastest compliant path available.

Business Basic is $7 per user a month on annual billing, and Business Standard now bundles Copilot at $23.50. The BAA covers the tenant rather than the form tool specifically.

Best for: organisations already on Microsoft 365 with a configured tenant.

The catch: coverage depends on your tenant being configured correctly, which is an IT task rather than a checkbox. Confirm it before collecting PHI.

G2 rating: 4.4/5, from 476 reviews, which fits its internal-tool scope.

10. Google Forms, best free compliant option

Google Workspace can be configured for HIPAA, and Forms is among the covered services when your administrator has accepted Google's BAA and enabled the right controls.

For a practice already paying for Workspace, that makes compliant internal forms free at the margin, which nothing else here can match.

Workspace Business Starter is $7 per user a month on an annual basis, Standard is $14, and Plus is $22. Consumer Google accounts are not covered.

Best for: practices already on Workspace that need compliant internal forms.

The catch: a personal Google account is never covered, so the free version most people reach for cannot carry PHI.

G2 rating: Google Forms has no standalone G2 profile. The 4.6/5 from 48,175 reviews quoted elsewhere covers Google Workspace as a whole.

11. Formester, for the non-clinical forms in the same practice

Formester does not offer HIPAA and does not sign BAAs. It cannot carry protected health information, and no configuration changes that.

It appears in this list because most practices run two kinds of forms. The clinical ones need a compliant tool from the tiers above. The other ones, event RSVPs, patient education sign-ups, staff feedback and donation pages, do not.

For those, paying $129 a month for a HIPAA tier is money spent on protection you are not using. Formester covers them free, with unlimited responses and payments included.

Best for: the non-clinical forms a practice runs alongside its compliant ones.

The catch: it is not a HIPAA form builder. If a form will ever touch patient health information, use one of the compliant tools above instead.

G2 rating: 4.7/5, from 14 reviews. High score, small sample; read it as an early signal.

12. Paperform Business, best-looking forms without HIPAA

Paperform makes the most attractive forms in this comparison, and for patient-facing communication that is worth something.

It does not, however, offer HIPAA or sign BAAs, so it sits in the same category as Formester here: good for the forms around the clinical work rather than the clinical work itself.

Business costs $129 a month on monthly billing, or $99 billed yearly, which is the same headline as Jotform Gold without the compliance.

Best for: patient-facing non-clinical forms where design matters.

The catch: Business costs $129 a month, exactly what Jotform Gold costs with a BAA. If you need compliance, that comparison is decisive.

G2 rating: 4.8/5, from 86 reviews, the highest score in this comparison.

13. Zoho Forms Premium, cheapest compliant tier here

Zoho Forms offers HIPAA compliance on its Premium plan, which at $90 a month billed annually is the cheapest compliant tier in this comparison.

For practices already inside the Zoho suite, submissions also route into Zoho CRM and the rest of the stack without extra integration work.

The tiers below Premium do not carry HIPAA, so Basic at $10 and Standard at $25 are not options for PHI regardless of how the forms are configured.

Best for: Zoho-based practices needing the lowest-cost compliant option.

The catch: the value depends on already using Zoho. Outside it, you are adopting a dated builder to save $39 a month against Jotform Gold.

G2 rating: 4.4/5, from 129 reviews, at the lower end of this list.

14. Typeform Enterprise, best patient experience

Typeform's one-question-at-a-time format genuinely helps with long patient questionnaires, where a wall of clinical questions causes abandonment.

HIPAA is available only on Enterprise, which is quoted rather than published, so the published tiers cannot carry PHI at any price.

Those published tiers run $39, $79, and $129 a month, and none of them includes a BAA.

Best for: organisations where patient completion rates justify enterprise pricing.

The catch: no published plan carries a BAA, so compliant use always means a quoted Enterprise contract.

G2 rating: 4.5/5, from 1,017 reviews. A large base, with cost the common complaint.

How to pick the right HIPAA form builder

Start with the BAA, not the features. If a vendor will not sign one, the tool cannot carry protected health information no matter how secure its marketing sounds. That question alone eliminates most form software.

Among the tools that will sign, cost separates them sharply. Jotform Gold at $129 a month is the cheapest self-serve route, Zoho Forms Premium is $90 a month billed annually if you already use Zoho, and everything else either quotes or runs higher.

Then check whether you already own compliance. Organisations on Microsoft 365 or Google Workspace with correctly configured tenants may already be covered, which makes compliant internal forms free at the margin.

Common questions about HIPAA form builders

What makes a form builder HIPAA compliant?

A form builder is HIPAA compliant when the vendor signs a Business Associate Agreement and applies the required safeguards, including encryption in transit and at rest, access controls and audit logging. Without a signed BAA, no amount of technical security makes a tool compliant.

What is the cheapest HIPAA form builder?

The cheapest HIPAA-capable tier here is Zoho Forms Premium at $90 a month billed annually, followed by Jotform Gold at $129 a month, which is the cheapest option you can enable yourself without contacting sales.

Is there a free HIPAA compliant form builder?

There is no genuinely free HIPAA form builder. The closest is Google Forms or Microsoft Forms inside a paid Workspace or Microsoft 365 tenant that has been configured for HIPAA, where compliant forms cost nothing beyond the subscription you already pay.

Does Google Forms sign a BAA?

Yes, Google will sign a BAA covering Google Workspace, and Forms is among the covered services once your administrator has accepted the agreement and enabled the appropriate controls. Consumer Google accounts are never covered.

Can I use a self-hosted form plugin for PHI?

Yes, a self-hosted plugin like WPForms Pro can handle PHI because submissions stay on your own infrastructure, so no third-party business associate exists. The compliance obligation then falls entirely on you, covering hosting, encryption, access control and audit logging.

Why do HIPAA plans cost so much more?

HIPAA plans cost more because the vendor takes on legal liability by signing a BAA, and must maintain encryption, audit logging, access controls and staff training to support it. Jotform charges $129 for Gold against $49 for Silver, and the builder itself is identical.

Does Formester offer HIPAA compliance?

No, Formester does not offer HIPAA compliance and does not sign BAAs on any plan. It should not be used for protected health information. It appears in this list for the non-clinical forms a practice runs alongside a compliant tool.

Which HIPAA form builder works with Salesforce?

FormAssembly offers the deepest Salesforce integration among HIPAA-capable tools, writing form data directly into Salesforce objects, with HIPAA and a BAA on its Atlas Enterprise plan. Formstack also integrates closely with Salesforce.