A signed BAA
The Business Associate Agreement makes the vendor legally responsible for protecting your PHI. Without it, no amount of encryption makes a form builder HIPAA compliant.
Dec 2026HIPAA compliant form builder
A HIPAA compliant form builder is coming to Formester
You want patient intake, consent, and medical history forms that are as easy to build as any other Formester form, with a signed Business Associate Agreement (BAA) behind them. It is coming in December 2026. Formester does not sign BAAs yet, so join the waitlist and we will tell you the day it is ready.
Free to join. We email you when HIPAA support and BAAs are ready.
New patient intakePHI
Full nameMaria Lopez
Date of birth04/12/1986
Reason for visitFollow-up, lower back pain
Insurance cardUploaded
HIPAA planDec 2026
Signed BAAPlanned
PHI encryptedPlanned
Audit logPlanned
TLS encryptionLive
Team 2FALive
Trusted by 56,000+ teams worldwide
HIPAA waitlist
Tell us what you need to collect
Join the waitlist and we will email you when HIPAA support and signed BAAs are ready. Your answers help us decide which forms and features to ship first.
- First to hear when it launches
- Launch pricing before it is public
- A chance to try it before everyone else
What HIPAA asks of a form builder
What makes a form builder HIPAA compliant
There is no official HIPAA certification for software. A form builder is safe for protected health information only when the vendor signs a BAA with you and the product protects PHI the way the HIPAA Security Rule expects. This is what we are building toward.
PHI encrypted in transit and at rest
Submissions travel over TLS and are stored encrypted, so a leaked database or intercepted request does not expose patient data.
Access only for the people who need it
Role-based permissions and two-factor sign-in keep front-desk staff, clinicians, and admins to the records they actually work with.
An audit trail
A log of who viewed, edited, exported, or deleted each submission and when, so you can answer questions during an audit or after an incident.
No PHI in plain email
Email alerts tell your team a new submission arrived without putting the patient details in the email body.
Control over how long data stays
Set how long submissions are kept and delete them for good when they are no longer needed.
Where we stand
What Formester does today, and what HIPAA adds
| Today | With HIPAA (planned) | |
|---|---|---|
| Signed BAA | No | Yes, on the HIPAA plan |
| Encryption in transit | TLS on every form | TLS on every form |
| Field-level encryption for PHI | No | Planned |
| Submission audit log | No | Planned |
| PHI hidden from email alerts | No | Planned |
| Hosting | AWS, through Heroku | HIPAA eligible infrastructure |
| Safe for PHI | No | Yes, once your BAA is signed |
Who it is for
Built for teams that handle patient data
Any team that collects patient details on a form, and wants the same builder for its clinical and non-clinical forms.
Clinics and medical offices
New patient intake, medical history, insurance details, and consent forms the patient fills out before the visit.
Therapists and counselors
Intake questionnaires, screening forms, and signed consent for treatment, without paper in the waiting room.
Dental, chiro, and physical therapy
Treatment consent, pre-appointment health questions, and progress check-ins with e-signatures.
Virtual care providers
Pre-visit symptom forms and eligibility checks that patients complete on their phone before the call.
Health-adjacent SaaS and startups
Embedded forms and API access for products that collect health data on behalf of covered entities.
Labs, pharmacies, and wellness clinics
Test requests, prescription refill forms, and health assessments that link to a patient record.
FAQ
Common questions
Find answers to common questions below, or reach out to our team for more help.
Coming December 2026
Get HIPAA compliant forms from Formester first
Join the waitlist and tell us what you need to collect. Early sign-ups shape what we build first and hear about launch pricing before anyone else.
No spam. One email when it is ready, plus the odd question about your use case.