14 Best HIPAA Form Builders in 2026

How we verified this: BAA availability, HIPAA tier, plan pricing, and compliance certifications were pulled directly from each vendor's live compliance / security / pricing pages on 2026-07-30. G2 ratings and review counts come from each product's own G2 review page on the same date. Because HIPAA plan gating changes frequently (Zoho, Typeform, and Formstack have all shifted HIPAA tiers in the last 24 months), reconfirm with sales before signup if it has been more than a few months since publication.

The HIPAA form builder problem, in plain language

Every vendor on this list says they are "HIPAA compliant." That phrase does not mean what most buyers think it means. HIPAA has no government certification. There is no HHS-stamped seal. There is only one signal that matters when you are choosing a form builder that will collect protected health information (PHI): will the vendor sign a Business Associate Agreement (BAA) with your practice, and is that BAA available on the plan you can actually afford?

A form vendor that says "we take security seriously" without signing a BAA cannot legally receive PHI on your behalf. Full stop. If your form asks for a patient's name plus any clinical detail (medications, symptoms, DOB with visit date, insurance ID), you need a signed BAA before you turn the form on. Anything less puts your practice on the hook if the vendor gets breached and puts you at HHS Office for Civil Rights (OCR) risk if the practice is audited.

The second reality is the pricing curve. Every vendor gates HIPAA and the BAA behind a paid plan. The cheapest way in is around $99 a month (Jotform Gold, yearly billing). The most common way in is $129 to $174 a month (Cognito Forms Enterprise, or a mid-tier plan with an add-on). Enterprise-only HIPAA (SurveyMonkey, Typeform, FormAssembly) means a sales cycle and a five-figure annual contract for most practices. If you are a solo therapist, you are picking between three or four tools. If you are a health system, the shortlist is different.

The third distinction: HIPAA-eligible vs. HIPAA-marketed. Microsoft Forms and Google Forms are HIPAA-eligible via a BAA on your Google Workspace or Microsoft 365 contract, which most practices already pay for. They are not marketed as "HIPAA form builders" because forms are not their core product, but for basic intake and screener forms they are the cheapest path in for anyone already on Microsoft 365 Business Standard or Google Workspace Business Standard. They also have the weakest form-builder UX on this list.

This list is 14 tools deep so you can pick the one that fits your practice size, your budget, and the exact PHI you are collecting. The tools are ranked by how well they solve the average HIPAA form problem for the average buyer: BAA on a reasonable plan, real form-builder features, clean audit posture, and pricing you can quote without a sales call.

The 60-second quick pick

• Best all-around HIPAA form builder: Jotform Gold at $99/mo billed yearly ($129 monthly), BAA on Gold and Enterprise, HIPAA-dedicated templates, telemedicine toolkit
• Best budget HIPAA form builder: Cognito Forms Enterprise at $129/mo yearly ($174 monthly), BAA, native payments on every tier, powerful calculations
• Best if you already have Microsoft 365 or Google Workspace: Microsoft Forms (BAA covered by M365 Business Basic and above via the standard Microsoft DPA) or Google Forms (BAA covered by Workspace Business Standard and above, with Forms confirmed as HIPAA-included functionality as of May 2026)

Compliance is your responsibility. Any HIPAA form builder is a business associate under HIPAA. The tools below sign BAAs, but the covered entity (your practice) is still responsible for training staff, encrypting endpoint devices, maintaining audit logs beyond what the form vendor stores, running your own annual risk assessment, and enforcing minimum-necessary access. This listicle is not legal advice. When in doubt, engage a HIPAA compliance consultant or your practice's counsel before turning on a new intake form.

1. Jotform Gold, best all-around HIPAA form builder

Jotform is the safest default for most practices. It has a dedicated HIPAA product surface at jotform.com/hipaa, HIPAA templates for intake, medical history, telemedicine consent, and consent for treatment, and it signs its BAA on the Gold plan at $99 per month billed annually. That is the cheapest self-serve BAA in this category. A solo therapist or a small dental practice can be live and HIPAA-scoped on Jotform in an afternoon without an Enterprise sales cycle.

The reason Jotform wins for the median buyer is not any single feature. It is the combination: HIPAA on a $99/mo plan, 10,000 HIPAA templates, a telemedicine toolkit, Jotform Sign for HIPAA-scoped e-signature, 40+ payment gateways for practices that collect copays at intake, and roughly 5,300 G2 reviews at 4.7 stars as of 2026-07-30 (the largest review base on this list after SurveyMonkey and Google Forms). If the vendor is going to sign a BAA and store PHI on your behalf, review depth is a real signal about how they handle production incidents.

Best for: solo therapists, dental practices, small clinics, mental health teams, and any healthcare-adjacent business that needs HIPAA on a self-serve plan without opening an Enterprise contract.

Strengths

• BAA on Gold at $99/mo yearly (cheapest self-serve BAA in the category)
• 300+ HIPAA-friendly form templates and a full telemedicine toolkit
• Jotform Sign for HIPAA-scoped e-signature (bundled into Gold and Enterprise)
• 40+ payment gateway integrations (Stripe, Square, PayPal, Authorize.Net, plus healthcare-specific processors)
• Deep integrations with Salesforce Health Cloud, ClinicSense, DrChrono via native connectors or webhook
• AI features route through Google Gemini via Vertex AI with BAA support

Weaknesses

• HIPAA features gated to Gold ($99/mo yearly) or above; Bronze and Silver do not sign BAAs
• Interface can feel busy for teams used to Typeform-style conversational flows
• Free tier does not sign a BAA (so you cannot pilot HIPAA workflows on Free)

Pricing

• Free (Starter): $0/mo, 100 submissions, no BAA
• Bronze: $34/mo yearly ($39/mo monthly), no BAA
• Silver: $39/mo yearly ($49/mo monthly), no BAA
• HIPAA tier: Gold at $99/mo yearly ($129/mo monthly), signed BAA included
• Enterprise: custom pricing, includes HIPAA options and SSO

G2 rating: 4.7/5 (5,353 reviews on G2)

2. Formstack, best for HIPAA + Salesforce healthcare workflows

Formstack is the tool healthcare orgs pick when the form is only the front door and the real work is downstream: signed engagement PDFs, Salesforce Health Cloud sync, document generation, and multi-step consent workflows. Formstack Suite ships Forms + Documents + Sign in one product, and Formstack signs its standard BAA. It is not the cheapest HIPAA option, but for practices that need HIPAA-scoped document generation and Salesforce integration, no other tool on this list does the whole workflow in one contract.

Two things to know before signing. First, HIPAA is not automatic on every Formstack plan. It ships baked into Salesforce Solutions and Enterprise, and it is an add-on for standalone Forms and Suite plans. Second, Formstack will evaluate custom BAAs if your legal team requires bespoke language, which is unusual in this category (most vendors are take-it-or-leave-it on BAA text).

Best for: healthcare orgs and health-adjacent SaaS running on Salesforce Health Cloud, and any practice where intake forms end in a signed document (engagement letters, consent for treatment, medical records release).

Strengths

• Forms + Documents + Sign in one Suite (native HIPAA-scoped e-signature)
• Salesforce Solutions plan is HIPAA-scoped by default with deep Health Cloud sync
• Standard BAA available; custom BAA requests evaluated (rare in this category)
• Conditional logic, workflow approvals, and multi-step routing built for compliance use cases
• Field-level encryption and audit log export

Weaknesses

• HIPAA is an add-on to Forms and Suite plans, not included by default (pricing bump on top of $83/mo Forms or $250/mo Suite)
• No public price on the HIPAA add-on; contact sales
• Pricier than Jotform or Cognito Forms for equivalent single-form use cases
• No free tier

Pricing

• Forms: $83/mo yearly ($99/mo monthly), HIPAA available as add-on
• Suite (Forms + Docs + Sign): $250/mo yearly ($299/mo monthly), HIPAA available as add-on
• HIPAA tier: Salesforce Solutions or Enterprise (both HIPAA-scoped by default), custom pricing
• Free trial: 14 days on Forms and Suite

G2 rating: 4.3/5 (471 reviews on G2)

3. Cognito Forms Enterprise, best for budget HIPAA + native payments

Cognito Forms is the pragmatic pick for a mid-sized practice that wants HIPAA plus native copay and consultation-fee collection on the same form. HIPAA sits on the Enterprise plan at $129/mo billed yearly ($174/mo monthly), which is $30 more than Jotform Gold but includes 20 users plus 20 guests and native Stripe payments on every tier, including the free one. For a specialty practice that collects a deposit at intake, that math often wins.

Cognito's real edge is the calculation engine. It has repeating sections that behave like a mini spreadsheet, deep conditional logic, and calculation fields that let you compute things like insurance eligibility, sliding-scale fees, or lost-wage estimates inline. Personal injury clinics and physical therapy groups often pick Cognito for exactly that reason.

Best for: mid-sized practices, specialty clinics, personal-injury and physical-therapy groups that want HIPAA plus native payments and calculation-heavy intake forms in one product.

Strengths

• HIPAA and BAA on Enterprise at $129/mo yearly, includes 20 users + 20 guests
• Native Stripe payments on every tier (including Free), which is rare in the category
• Powerful calculations and repeating sections (spreadsheet-inside-a-form)
• Client portal and workflow approvals on Team tier ($39/mo yearly)
• SSO on Enterprise
• Fair overage pricing at $0.05 per extra entry

Weaknesses

• Free tier is capped at 100 entries per month per organization
• No AI form generator as of 2026-07 (Jotform, Formester, Typeform all ship one)
• HIPAA gated to Enterprise, $30/mo more than Jotform Gold
• Traditional form-builder UI feels utilitarian next to Typeform or Formester

Pricing

• Individual (Free): $0, 100 entries/mo, 1 user, unlimited forms, native payments
• Pro: $19/mo yearly ($24/mo monthly), 2 users, 2,000 entries
• Team: $39/mo yearly ($49/mo monthly), 5 users + 5 guests, 10,000 entries, client portal
• HIPAA tier: Enterprise at $129/mo yearly ($174/mo monthly), 20 users + 20 guests, signed BAA, SSO
• Free trial: not needed, the free plan is permanent

G2 rating: 4.6/5 (130 reviews on G2)

4. Alchemer, best for enterprise research with HIPAA + FedRAMP + FERPA

Alchemer is the survey and workflow platform that regulated research teams pick when the compliance stack has to check more than one box. HIPAA and a BAA are available on Alchemer's Platform / Business tier (contact sales), and Alchemer separately holds SOC 2 Type II, ISO 27001, FERPA, and CCPA attestations, with FedRAMP available for federal customers. For a health research org running longitudinal patient surveys, or a clinical trial vendor collecting patient-reported outcomes, that stack matters.

The self-serve tiers (Collaborator, Professional, Full Access) do not automatically ship a BAA. HIPAA requires an upgrade to the Business Platform plan and a sales conversation. That is worth knowing before you start a trial expecting to turn HIPAA on with a checkbox.

Best for: clinical trial vendors, health research orgs, patient-reported outcome studies, universities running FERPA-scoped student surveys, government contractors needing FedRAMP.

Strengths

• Full compliance stack: HIPAA (BAA), SOC 2 Type II, ISO 27001, FERPA, CCPA, GDPR, FedRAMP available
• Advanced survey logic, weighted scoring, and academic research question types
• Deep integrations with Salesforce, Marketo, and clinical trial platforms
• Multi-language survey support (55+ languages) for global research
• Professional Services team available for custom-fit deployments

Weaknesses

• BAA gated to Platform / Business tier (contact sales); self-serve Collaborator, Professional, Full Access do not include HIPAA
• Self-serve pricing per-user is steep for a form-only use case: $55/user/mo monthly Collaborator, $165/mo Professional, $275/mo Full Access
• Enterprise-focused UI is heavier than a simple intake tool needs to be
• 7-day free trial only

Pricing

• Collaborator: $55/user/mo monthly, $315/user/yr yearly (~$26/user/mo), no HIPAA
• Professional: $165/user/mo monthly, $1,075/user/yr yearly (~$90/user/mo), no HIPAA
• Full Access: $275/user/mo monthly, $1,895/user/yr yearly (~$158/user/mo), no HIPAA
• HIPAA tier: Business Platform (contact sales) with BAA, SOC 2 Type II, ISO 27001, FERPA, FedRAMP available on request
• Free trial: 7 days on any paid plan

G2 rating: 4.4/5 (955 reviews on G2)

5. SurveyMonkey Enterprise, best for HIPAA-scoped market research at scale

SurveyMonkey is on this list for a specific buyer: a large healthcare org or pharma company running patient satisfaction surveys, provider network research, or member studies at real scale. HIPAA-enabled accounts are only available on SurveyMonkey Enterprise, and Enterprise is contact-sales only. If you already run SurveyMonkey enterprise-wide for non-PHI research, adding HIPAA scope is a call to your Customer Success Manager. If you do not, this is not the cheapest way in.

The reason to consider SurveyMonkey at all is scale plus its compliance stack: ISO 27001, SOC 2, PCI-DSS, plus the HIPAA BAA on Enterprise. Nearly 24,000 G2 reviews at 4.4 stars means the product itself is battle-tested for high-volume distribution, panel management, and multi-language surveys.

Best for: hospitals, health systems, pharma, and health insurance orgs that need HIPAA-scoped surveys at panel scale.

Strengths

• Panel management for large-scale patient / member surveys
• ISO 27001, SOC 2, PCI-DSS compliance stack
• SurveyMonkey Audience for buying targeted research panels
• Deep integrations with Salesforce, Marketo, HubSpot, Tableau
• 200+ app integrations for research ops

Weaknesses

• HIPAA only on Enterprise (custom pricing, contact-sales cycle)
• Non-HIPAA tiers (Basic Free, Standard, Advantage, Premier) do not sign BAAs; do not use for PHI
• Response-cap pricing: paid plans overage at $0.15 per response above your monthly limit
• No native payment collection on any tier
• Overkill for a solo practice or small clinic

Pricing

• Basic (Free): $0, 10 questions, 40 responses per survey, no BAA
• Standard Monthly: $99/mo, 1,000 responses, no BAA
• Advantage Annual: $46/mo billed annually ($552/yr), 15,000 responses, no BAA
• Premier Annual: $139/mo billed annually ($1,668/yr), 40,000 responses, no BAA
• HIPAA tier: Enterprise (custom pricing, contact sales)
• Free trial: not applicable (Free plan is permanent, Enterprise is sales-only)

G2 rating: 4.4/5 (23,870 reviews on G2)

6. FormAssembly, best for HIPAA + deep Salesforce integration

FormAssembly (rebranded to the Atlas platform in 2026) is the tool health-adjacent Salesforce shops keep for one reason: the Salesforce integration is deeper than any horizontal form tool. Multi-object updates in a single form submission, prefill from Salesforce records, and object-level permissions all work natively. HIPAA plus a BAA sits on Atlas Enterprise, and FormAssembly's Atlas Gov Cloud adds FedRAMP High for government healthcare contractors (VA, DoD medical, federal grant-funded research).

Pricing is contact-sales across every tier. Expect a real Enterprise conversation and pricing that runs $5,000 to $30,000+ annually depending on volume and user count. For a Salesforce-native healthcare org, that is competitive with FormStack Salesforce Solutions.

Best for: healthcare orgs on Salesforce Health Cloud or Sales Cloud, federal healthcare contractors (VA, DoD medical), and any team that needs deep multi-object Salesforce writes from a single form submission.

Strengths

• Native multi-object Salesforce writes from a single submission (no other form tool matches this)
• HIPAA + BAA on Atlas Enterprise; FedRAMP High on Atlas Gov Cloud
• Salesforce prefill, lookup, and object-level permissions built in
• Field-level masking for sensitive data (PHI, PII, PCI)
• Custom SLAs on Atlas Enterprise

Weaknesses

• Contact-sales pricing across all four Atlas tiers (Explorer, Team, Enterprise, Gov Cloud)
• Atlas Team and Atlas Explorer do not include HIPAA / BAA
• Overkill for anyone not on Salesforce
• No self-serve pilot; expect a 2-4 week sales cycle before you can trial

Pricing

• Atlas Explorer: custom pricing, no HIPAA
• Atlas Team: custom pricing, no HIPAA
• HIPAA tier: Atlas Enterprise (custom pricing, includes HIPAA + BAA + field-level masking + custom SLA)
• Atlas Gov Cloud: custom pricing, FedRAMP High for federal customers
• Free trial: request via sales

G2 rating: 4.4/5 (419 reviews on G2)

7. 123FormBuilder, best for EU + US data residency with HIPAA

123FormBuilder is the pick for a healthcare org that operates in both the US and the EU and needs the data-residency choice built into the plan. HIPAA plus a custom BAA sits on Enterprise at roughly $225 per month (contact sales for a firm quote), and Enterprise ships EU + US data residency, dedicated onboarding, and Salesforce integration. For a multinational health system or a health-tech vendor selling into both markets, this beats picking one HIPAA tool and one GDPR tool.

The Diamond plan at $49.50/mo yearly is the mid-tier price point, and it covers a lot of general use cases (webhook, integrations, custom domain), but Diamond does not include HIPAA or the BAA. HIPAA on 123FormBuilder is a real Enterprise conversation.

Best for: multinational health orgs, health-tech SaaS operating in both US and EU markets, and any team that wants HIPAA plus GDPR data-residency choice in one product.

Strengths

• EU + US data residency built into Enterprise
• HIPAA + custom BAA on Enterprise (custom BAAs are rare in this category)
• Salesforce integration on Enterprise
• Dedicated onboarding session included in Enterprise
• White-label forms available

Weaknesses

• HIPAA gated to Enterprise, roughly $225+/mo (contact sales)
• Diamond and below (up to $49.50/mo yearly) do not ship HIPAA
• UI is dated relative to Jotform or Typeform
• Smaller G2 review base (175 reviews) than the top three

Pricing

• Basic (Free): $0, no HIPAA
• Gold: $18.50/mo yearly ($37/mo monthly), no HIPAA
• Platinum: $24.50/mo yearly ($49/mo monthly), no HIPAA
• Diamond: $49.50/mo yearly ($99/mo monthly), no HIPAA
• HIPAA tier: Enterprise at $225+/mo (contact sales for firm quote), signed BAA, EU + US data residency, dedicated onboarding
• Free trial: Basic plan is permanent free

G2 rating: 4.5/5 (175 reviews on G2)

8. WPForms Pro, best for HIPAA on self-hosted WordPress

WPForms is the WordPress-native form plugin that healthcare bloggers, medical practices with WordPress sites, and health-adjacent SaaS use to keep forms on their own domain. But be careful with how HIPAA works here. WPForms is a plugin, not a hosted service. WPForms Inc. does not sign a BAA. HIPAA eligibility depends entirely on your WordPress host signing a BAA and on your practice handling PHI storage, backups, and access controls correctly on the server side.

That is why WPForms sits at #8. It is a strong HIPAA-friendly form builder if your infrastructure is HIPAA-eligible (Kinsta, WP Engine, Rocket.net, LiquidWeb all offer HIPAA-compliant WordPress hosting with BAAs). If you are on a shared host with no BAA, WPForms cannot make you HIPAA compliant.

Best for: medical practices with an existing WordPress site, health-adjacent bloggers and content sites, and any team that wants forms on their own domain without a third-party hosted service.

Strengths

• Runs on your own WordPress site (data stays under your control)
• Pro tier at ~$200/yr covers 4 sites, unlimited forms, conditional logic, payment gateways
• Native Stripe, Square, PayPal payment integrations
• HIPAA-friendly form templates (medical history, appointment request, patient intake)
• Highly rated: 4.7/5 with 971 G2 reviews

Weaknesses

• WPForms Inc. does not sign a BAA. HIPAA compliance depends on your WordPress host having a BAA and your practice enforcing PHI handling on the server side
• Requires HIPAA-eligible WordPress hosting (Kinsta from $60/mo, WP Engine from $115/mo yearly, plus a BAA add-on that can be $300-500/mo)
• Not a hosted SaaS: you are responsible for updates, security patches, and backups
• No web-based dashboard for form building outside of WordPress admin

Pricing (WPForms plugin only, hosting separate)

• Basic: $49.50/yr (regular $99/yr), 1 site
• Plus: $99.50/yr (regular $199/yr), 3 sites
• Pro: $199.50/yr (regular $399/yr), 5 sites, payment gateways, conditional logic
• Elite: $299.50/yr (regular $599/yr), unlimited sites, premium integrations
• HIPAA tier: no HIPAA plan; the BAA must come from your WordPress host, not from WPForms

G2 rating: 4.7/5 (971 reviews on G2)

9. Microsoft Forms, best for teams already on Microsoft 365

If your practice is already paying for Microsoft 365 Business Basic ($6/user/mo) or higher, Microsoft Forms is HIPAA-eligible via the standard Microsoft BAA that ships baked into the Online Services Data Protection Addendum. There is no extra plan to buy, no add-on to unlock, no sales call. Microsoft Forms is explicitly in-scope under the Microsoft HIPAA BAA per Microsoft's compliance page (updated 2026-06-02).

The catch is the form builder itself. Microsoft Forms is the least capable form builder on this list. No native payments. No advanced conditional logic beyond simple branching. No custom domain. No white-label. It is a survey and quiz tool with a HIPAA path attached. For a screener, an internal staff feedback form, or a simple patient satisfaction survey, it is the cheapest way to be HIPAA-scoped. For an intake form that runs your business, pick Jotform Gold or Cognito Enterprise instead.

Best for: practices already on Microsoft 365 that need basic HIPAA-scoped forms (screeners, staff surveys, simple intake) without buying another SaaS tool.

Strengths

• HIPAA-eligible via the standard Microsoft BAA on M365 Business Basic and above (no add-on cost)
• ISO 27001, HITRUST CSF, SOC 2, FedRAMP (GCC/GCC High for federal customers)
• Native Excel, Teams, and SharePoint integration
• Response data stays inside your existing M365 tenant

Weaknesses

• Least capable form builder on this list: no native payments, no advanced logic, no custom domain
• Formatting and branding options are minimal
• No native e-signature; needs Adobe Sign or DocuSign for signed intake
• Limited third-party integrations outside the Microsoft ecosystem

Pricing (Microsoft 365 plans that include Forms + BAA)

• M365 Business Basic: $6/user/mo yearly, includes Forms + BAA
• M365 Business Standard: $12.50/user/mo yearly, adds desktop apps
• M365 Business Premium: $22/user/mo yearly, adds Intune device management + advanced security
• M365 Enterprise E3: ~$36/user/mo, adds full enterprise security stack
• M365 Enterprise E5: ~$57/user/mo, adds Defender, Purview, and analytics
• HIPAA tier: any M365 Business or Enterprise plan (BAA available by default via the Online Services DPA)

G2 rating: 4.4/5 (475 reviews on G2)

10. Google Forms, best for teams already on Google Workspace

Google Forms is the mirror of Microsoft Forms for the Google Workspace side. As of May 14, 2026, Google Forms is confirmed in the HIPAA Included Functionality list for Google Workspace, meaning a Workspace admin can turn on HIPAA compliance by accepting the BAA in the Admin console, and Google Forms responses are covered. The BAA is available on Google Workspace Business Standard ($14/user/mo yearly) and above.

Free Gmail accounts and Google Workspace Business Starter are not covered by the HIPAA BAA. If you are running a solo practice on personal Gmail, you cannot legally use Google Forms for PHI. Upgrade to a Workspace Business Standard seat first.

Google Forms as a form builder is a step above Microsoft Forms in polish but still below every dedicated form tool on this list. Basic conditional logic (section jumps), no native payments, no custom domain. But for a $14/mo Workspace seat, it is HIPAA-scoped at a price nothing else on this list matches.

Best for: solo practitioners and small clinics already paying for Google Workspace, simple patient intake and screener forms, teams that want the lowest possible HIPAA form cost.

Strengths

• HIPAA-eligible via the Workspace BAA on Business Standard and above (confirmed in the HIPAA Included Functionality list, May 2026)
• Cheapest HIPAA path on this list at $14/user/mo yearly (Business Standard)
• ISO 27001, ISO 27017, ISO 27018, SOC 2, SOC 3 compliance stack
• Native integration with Sheets, Drive, Docs
• Response data stays in your Workspace tenant

Weaknesses

• Basic form builder: no native payments, no advanced logic, no custom domain, no white-label
• Workspace admin must accept the BAA in the Admin console before HIPAA scope activates (easy to forget)
• Free personal Gmail is NOT covered; do not use for PHI
• No native e-signature; needs DocuSign or a third-party integration
• No dedicated HIPAA templates

Pricing (Google Workspace plans that include Forms + BAA)

• Business Starter: $7/user/mo yearly, no BAA
• Business Standard: $14/user/mo yearly, BAA available
• Business Plus: $22/user/mo yearly, BAA available
• Enterprise: custom pricing, BAA available
• HIPAA tier: Workspace Business Standard and above (admin must accept BAA in Admin console)

G2 rating: 4.6/5 (48,128 reviews on G2)

11. Formester, best when HIPAA is not required

Formester is not a HIPAA-certified form builder. We do not sign BAAs. If your intake contains PHI, pick one of tools 1 through 10 above. Formester is on this list because a lot of practices ask about Formester anyway, and the honest answer is that for the non-clinical work in the same shop, it is a strong tool.

Where Formester fits inside a healthcare-adjacent business: patient education forms, general contact forms, event RSVPs, marketing surveys, employee onboarding for non-clinical staff, community outreach signups, GDPR-regulated (EU) intake that does not touch PHI, and non-PHI payment collection like donations, event fees, or product sales. Anywhere the form does not collect PHI, Formester's AI form generator, unlimited free tier, and no per-user pricing are exactly what a solo practitioner or a small clinic marketing team wants.

What Formester does not do: sign a BAA. Ship the encryption-at-rest disclosures HIPAA requires. Ship the audit log format HIPAA auditors expect. Ship SOC 2, ISO 27001, or FedRAMP attestations. If those matter, do not use us. If they do not, we are 5 to 10 times cheaper than the tools above for the same non-clinical intake work.

Best for: modern GDPR / CCPA-regulated form builder for non-PHI intake inside healthcare-adjacent businesses (marketing forms, patient education, community outreach, non-clinical staff onboarding).

Strengths

• Truly free plan with unlimited forms and unlimited responses (no tool 1 through 10 offers this)
• AI form generator accepts a prompt, a question list, or a PDF upload
• Native Stripe and PayPal for non-PHI payment collection (donations, event fees, product sales)
• No per-user cost on paid tiers (Business at $45/mo covers 25 users)
• GDPR, UK GDPR, CCPA compliant with EU data residency available

Weaknesses

• Not HIPAA-certified. Will not sign a BAA. Do not use for PHI intake.
• No FedRAMP, no SOC 2, no ISO 27001
• Payment gateways limited to Stripe and PayPal (Jotform offers 40+ for healthcare-specific processors)

Pricing

• Free forever: $0, unlimited forms + responses, GDPR compliant
• Personal: $12/mo billed yearly ($13/mo monthly), custom domain, conditional logic
• Business: $45/mo billed yearly ($49/mo monthly), 25 users, API access, PDF export
• HIPAA tier: none at any price point

G2 rating: 4.7/5 (13 reviews on G2)

12. Paperform Business, best for HIPAA + design-forward forms

Paperform is the design-forward option for practices that treat the intake form as a brand moment (aesthetics-first therapists, cash-pay dental practices, concierge medicine, wellness clinics). It reads like a document, not a form, and Paperform's SOC 2 Type II attestation is public. HIPAA availability lives on the Business tier at $99/mo yearly or Agency+ at $150/mo yearly, but BAA scope is not surfaced clearly on the public pricing table as of 2026-07-30. Contact Paperform sales to confirm scope and get a BAA signed before signup if PHI is involved.

Where Paperform earns its spot: the visual polish is a real conversion advantage on a cash-pay practice's website. If your website is your marketing tool and the form is part of the brand experience, Paperform's finished forms convert measurably better than a Google Forms embed.

Best for: cash-pay medical practices, concierge medicine, aesthetics and wellness clinics, and any healthcare business where the intake form is part of the brand experience.

Strengths

• Document-style form design that reads like a landing page
• SOC 2 Type II attestation (public on their security page)
• Business tier includes 20 form workspaces, unlimited responses, integrations
• Native Stripe, Square, PayPal for cash-pay copays
• Paperform Sign for e-signature bundled into Business+
• Custom domain and full white-label on Agency+

Weaknesses

• HIPAA / BAA availability not clearly surfaced on the public pricing table as of 2026-07-30; contact sales to confirm scope
• Business tier at $99/mo is roughly the same price as Jotform Gold but with less-clear HIPAA documentation
• No FedRAMP, no ISO 27001
• Smaller G2 review base (86 reviews) than the top four

Pricing

• Essentials: ~$29/mo yearly, no HIPAA
• Pro: ~$59/mo yearly, no HIPAA
• Business: $99/mo billed yearly, HIPAA available (contact sales to activate + sign BAA)
• Agency+: $150/mo yearly ($190/mo monthly), HIPAA available, white-label, 10 Pro client teams
• HIPAA tier: Business at $99/mo yearly or Agency+ at $150/mo yearly (BAA via sales)

G2 rating: 4.8/5 (86 reviews on G2)

13. Zoho Forms Premium, best for HIPAA inside the Zoho ecosystem

Zoho Forms Premium at $90/mo billed yearly is the pick for a practice already running on Zoho (Zoho CRM, Zoho One, Zoho Desk). HIPAA Compliance / ePHI is explicitly a Premium-only feature on the pricing comparison, and Zoho enters BAAs with Premium customers on request. Zoho holds ISO 27001 and SOC 2 Type II across the platform.

The economics work best if you are already paying for Zoho One (the full-suite bundle at ~$45/user/mo yearly) or Zoho CRM Enterprise. If you are just buying Zoho Forms Premium standalone at $90/mo yearly, Jotform Gold at $99/mo yearly is likely the better choice for a healthcare-only practice: more HIPAA templates, deeper healthcare integrations, more mature product.

Best for: practices and health-tech vendors already running on Zoho One, Zoho CRM, or Zoho Desk that want HIPAA-scoped forms inside the same ecosystem.

Strengths

• HIPAA and ePHI handling on Premium at $90/mo yearly
• Deep native integration with Zoho CRM, Zoho Desk, Zoho One
• Multi-language forms (30+ languages)
• Offline mobile app for on-site data collection
• ISO 27001 and SOC 2 Type II attestations across the Zoho platform

Weaknesses

• HIPAA gated to Premium at $90/mo yearly; Basic ($10), Standard ($25), Professional ($50) do not include HIPAA
• Standalone Premium price is competitive with Jotform Gold but with less healthcare-specific tooling
• Zoho ecosystem is heavy: if you are not already on Zoho One or Zoho CRM, adding just Zoho Forms Premium can feel awkward
• BAA is not on-file by default; must be requested

Pricing

• Free: $0, 3 forms, 500 submissions
• Basic: $10/mo yearly, no HIPAA
• Standard: $25/mo yearly, no HIPAA
• Professional: $50/mo yearly, no HIPAA
• HIPAA tier: Premium at $90/mo billed yearly, HIPAA Compliance / ePHI, BAA available on request

G2 rating: 4.4/5 (129 reviews on G2)

14. Typeform Enterprise, best for HIPAA + conversational healthcare intake

Typeform is the conversion-rate leader on this list. One question per screen, generous whitespace, and completion rates that consistently beat traditional multi-question forms. For a mental health teletherapy service, an addiction recovery intake, or any healthcare use case where completion rate drives caseload, Typeform's UX is a genuine business advantage.

The problem is HIPAA gating. Typeform's HIPAA compliance sits on the Enterprise plan only. Business at $83/mo yearly, Plus at $50/mo yearly, and Basic at $25/mo yearly do not sign BAAs. Enterprise is contact-sales, no public pricing, expect a $12,000 to $50,000+ annual contract depending on volume and integrations. If your teletherapy caseload justifies that, the completion-rate lift often pays for it. If you are a solo therapist, Jotform Gold at $99/mo yearly is a cheaper way to be HIPAA-scoped.

Best for: mental health teletherapy services, addiction recovery orgs, health-adjacent SaaS with a paid intake funnel, and any healthcare use case where conversion rate on the intake form is a core business metric.

Strengths

• Highest completion rates on this list (industry benchmarks routinely show +30% to +50% vs. traditional forms)
• Enterprise ships HIPAA + BAA + SSO + custom SLAs
• One question per screen UX that feels less clinical than traditional intake
• Native integrations with 500+ tools including Slack, Zapier, HubSpot, Salesforce
• Multi-language forms

Weaknesses

• HIPAA gated to Enterprise only (contact sales); Basic, Plus, Business do not sign BAAs
• Enterprise pricing is opaque; expect a real sales cycle and a five-figure annual contract
• Free plan is capped at 10 responses per month (extremely tight for any real use)
• No native payments on Basic; payments start on Plus tier
• More expensive per response than Jotform Gold or Cognito Enterprise for equivalent volume

Pricing

• Free: $0, 10 responses/mo, no BAA
• Basic: $25/mo yearly ($28/mo monthly), 100 responses/mo, no BAA
• Plus: $50/mo yearly ($56/mo monthly), 1,000 responses/mo, no BAA
• Business: $83/mo yearly ($91/mo monthly), 10,000 responses/mo, no BAA
• HIPAA tier: Enterprise (custom pricing, contact sales, HIPAA + BAA + SSO)

G2 rating: 4.5/5 (1,017 reviews on G2)

At a glance: 14 HIPAA form builders compared

How to pick the right HIPAA form builder for your practice

Start with what will actually break your workflow if you get it wrong.

Solo therapist or a one-person practice. You want the cheapest self-serve HIPAA path. That is Jotform Gold at $99/mo yearly or, if you already pay for Google Workspace Business Standard, Google Forms at $14/user/mo (activate the BAA in Admin console first). Cognito Forms Enterprise at $129/mo yearly is worth the extra $30 if you collect copays at intake and want native payments on the same form. Do not use Formester, WPForms without a HIPAA host, or Typeform Basic / Plus / Business for PHI.

Small clinic (2 to 20 users). Jotform Gold covers your team on Gold's user cap or upgrade to Enterprise. Cognito Forms Enterprise gives you 20 users + 20 guests at $129/mo yearly, which is often the sweet spot for a growing practice. If you use QuickBooks or similar accounting, Cognito's native payments are easier to reconcile than Jotform's per-integration setup.

Mental health teletherapy or addiction recovery. Typeform Enterprise pays for itself in completion-rate lift on the intake funnel. If you cannot justify the Enterprise contract yet, run Jotform Gold with a well-designed multi-page form. Skip Typeform Basic / Plus / Business (no BAA).

Personal injury, workers comp, or medical-legal practice. Cognito Forms Enterprise for the calculation engine (lost-wage estimates, medical-bill totals inline) plus HIPAA plus native payments. Or Formstack Suite if the intake ends in a signed engagement letter and you need document generation.

Health system, hospital, or health insurance org. SurveyMonkey Enterprise for panel-scale research. FormAssembly Atlas Enterprise if you are on Salesforce Health Cloud. Formstack Salesforce Solutions if you need HIPAA-scoped document generation plus Salesforce sync in one contract. Do not shop this segment based on price; shop on integration depth and audit posture.

Clinical trial or health research org. Alchemer Business Platform for the FERPA + HIPAA + FedRAMP stack, and for the survey question types built for longitudinal research. FormAssembly Gov Cloud if you need FedRAMP High.

Dental office, chiropractor, physical therapy, aesthetics clinic. Jotform Gold covers 80% of what you need. Paperform Business is the pick if the intake form is part of the brand experience on a cash-pay practice's website. Cognito Forms Enterprise if you have complex fee calculations at intake.

Federal healthcare contractor (VA, DoD medical, HHS-adjacent). FormAssembly Atlas Gov Cloud for FedRAMP High. Microsoft Forms via GCC High if you are on Microsoft 365 GCC High tenants. Neither of these is a normal purchasing decision; expect procurement to drive the choice.

Multinational healthcare org (US + EU). 123FormBuilder Enterprise for HIPAA + EU data residency in one product. Or run a two-tool stack: Jotform Gold for HIPAA in the US, Formester Business for GDPR forms in the EU.

The final take

If you need HIPAA and want the cheapest self-serve path with the most mature product, it is Jotform Gold at $99/mo billed yearly. If you need HIPAA plus native payments on the same intake form, it is Cognito Forms Enterprise at $129/mo yearly. If you already pay for Microsoft 365 or Google Workspace, activate the BAA on Business Standard or above and use Microsoft Forms or Google Forms for basic intake at the lowest possible cost.

For enterprise research, longitudinal studies, or clinical trials, it is Alchemer Business Platform for the FERPA + HIPAA + FedRAMP stack. For Salesforce Health Cloud shops, it is FormAssembly Atlas Enterprise or Formstack Salesforce Solutions. For a mental health teletherapy service where completion rate drives caseload, Typeform Enterprise pays for itself.

Formester is the answer only if you do not need HIPAA. If your intake collects PHI, pick one of tools 1 through 10 above and sign the BAA before you turn the form on. For the non-clinical intake in the same shop (patient education, event RSVPs, marketing surveys, community outreach), Formester's free plan will save you 5 to 10 times the cost of routing that traffic through the HIPAA tool.

Pick the constraint that hurts most: BAA availability, budget, integration depth, or completion rate. Then pick the tool that solves it without introducing three others.