How we make this list: we compare vendor pricing pages, product documentation and plan limits, and print the month we checked each price. We don’t accept payment for rankings.
QUICK ANSWER
Google Forms is the best HIPAA-compliant form builder in 2026 because it is free with unlimited responses and covered under a Google Workspace BAA. Jotform ranks second for teams that need HIPAA on a named plan, Gold at $99 a month, and Zoho Forms is the best budget pick with HIPAA on Premium at $90 a month.
Key takeaways
7 of 8 tools in this list have a free plan, and the lowest paid start is $7 a month per user (Google Workspace Business Starter) (Nov 2026).
Google Forms ranks first because it is free with unlimited responses and covered under a Workspace BAA.
Free plans never carry a BAA, so the free tier is never the compliant tier.
Jotform Gold at $99 a month billed annually is the clearest named HIPAA plan in this list.
Paperform, Tally and Gravity Forms sign no BAA, so they are not in this list at all.
The best HIPAA-compliant form builders all share one thing: a signed Business Associate Agreement, or BAA, with the vendor. A form tool that says it is secure is not the same as one that will sign a BAA, and the free plan never carries one. This guide ranks the 8 best HIPAA-compliant form builders in 2026 by BAA availability, with real prices and the plan that carries the BAA.
Starting priceFree; Google Workspace Business Starter is…
Free planYes
Free trial14 days (Google Workspace)
PlatformsWeb
Google Forms is the first pick because it is free with unlimited responses and covered under a Google Workspace BAA. A Workspace admin accepts the BAA, and the form data stays inside the Workspace account, with responses landing in Google Sheets. A personal Google account is never covered, so the BAA only applies when the admin accepts it on a Workspace plan.
The catch is the thin feature set. Google Forms is free and unlimited, but it has no payment fields, no conditional pricing and only basic analytics. It is HIPAA-eligible only under a Google Workspace BAA, so a personal Google account can never carry patient data. For plain intake and surveys it is hard to beat; for sales it falls short.
What we like
Free with any Google account, with unlimited responses (Nov 2026).
Responses land straight in Google Sheets.
Quizzes with automatic grading are built in.
Watch out for
No native payments or advanced automation.
Design and branding control are basic.
HIPAA cover needs a Workspace BAA; a personal account is never covered.
Jotform is the clearest HIPAA pick here. Gold at $99 a month billed annually includes HIPAA features, with encryption, access controls and a BAA, and every feature is on every plan, so the tier differs only by limits. The free Starter plan covers 5 forms and 100 submissions a month, but it never carries a BAA, so the compliant tier starts at Gold.
The catch is the single-user rule. Every paid plan except Enterprise covers one user, so a team of three needs three accounts or an Enterprise quote. Bronze at $34 a month billed annually is fair for one person, and the free plan stops at 100 submissions a month, so a busy form pushes you up the ladder fast.
What we like
Free Starter plan covers 5 forms and 100 submissions a month (Nov 2026).
Every feature is on every plan; tiers differ only by limits.
HIPAA features are available on Gold at $99 a month billed annually.
Watch out for
Free forms carry Jotform branding.
All plans except Enterprise are single-user.
HIPAA needs Gold, so regulated teams pay $99 a month.
Formstack suits a team that needs HIPAA with documents and signatures. Forms at $99 a month, or $83 billed annually, covers one builder and 25 forms, with document generation and e-signatures in the same suite. HIPAA costs extra below Enterprise, so a team that needs a BAA should confirm the price in writing before it signs up.
The catch is the entry price and the seat count. Forms at $99 a month, or $83 billed annually, covers one builder and 25 forms, which is steep for a small team. HIPAA costs extra below Enterprise, and the document and signature features that make Formstack special need Suite at $250 a month billed annually.
What we like
Forms, document generation and e-signatures share one suite (Nov 2026).
Salesforce-native products suit Salesforce teams.
HIPAA and PCI options are available on higher tiers.
Watch out for
No free plan, only a 14-day trial.
Forms plan covers one builder, 25 forms and 1,000 submissions per form.
Zoho Forms is the budget HIPAA pick. Premium at $90 a month billed annually includes HIPAA cover, with encryption and a BAA, and it plugs straight into Zoho CRM, Books and Desk. Basic at $12 a month is cheap for unlimited forms, but it has no HIPAA cover, so a regulated team needs Premium from the start.
The catch is the ecosystem pull. Basic at $12 a month is cheap for unlimited forms and 10,000 submissions, and it plugs straight into Zoho CRM, Books and Desk. On its own it is a plain form builder, and HIPAA needs Premium at $90 a month billed annually, so the best value lands on teams already inside Zoho.
What we like
Basic costs $12 a month with unlimited forms and 10,000 submissions (Nov 2026).
Free plan covers 3 forms and 500 submissions a month.
HIPAA cover is on Premium at $90 a month billed annually.
Watch out for
Free plan covers only 3 forms.
Most value comes when you also use other Zoho apps.
SurveyMonkey suits a survey team that needs HIPAA on an enterprise plan. Its enterprise plans include a BAA, with encryption and access controls, and the large template library covers most survey types. The free Basic plan shows only 10 responses per survey, and Advantage Annual at $39 a month has no BAA, so the compliant tier needs a sales conversation.
The catch is the free plan and the monthly price. Basic is free, but you can only view 10 responses per survey, which makes it a demo, not a research tool. Advantage Annual at $39 a month is the realistic entry point, and paying month to month costs $149 for Standard, so commit to a year or pay far more.
What we like
Large template library and question bank (Nov 2026).
Advantage adds exports, skip logic and AI analysis.
Research panel lets you buy responses from outside your list.
Watch out for
Free plan shows only 10 responses per survey.
Month-to-month billing costs $149 a month for Standard.
Starting priceFree Surveys account; Strategic Research $…
Free planYes
Free trial30 days (Strategic Research)
PlatformsWeb
Qualtrics is the research pick for regulated teams. Its enterprise plans include HIPAA cover with FedRAMP and SOC 2, and the analysis tools cover conjoint, MaxDiff and concept tests. The free Surveys account covers 3 surveys and 500 responses, while Strategic Research costs $420 a month billed annually and has no BAA on that tier.
The catch is the price per response. Strategic Research at $420 a month billed annually covers only 1,000 responses shared across the whole team, and everything above it is custom-priced. The free account is a preview, not a program, with 3 surveys and 500 total responses. Qualtrics fits research teams, not casual surveys.
Fillout is the modern pick for regulated teams, with a BAA on Enterprise only. The free plan covers 1,000 responses a month with logic and payments, and unlimited seats on every plan, including free, which suits a team that shares forms widely. A team that needs a BAA should confirm the Enterprise price and terms in writing before it collects patient data.
The catch is the response meter and the compliance wall. The free plan gives 1,000 responses a month, ten times Typeform, but Starter at $15 a month covers only 2,000, and Business at $75 a month is the step to unlimited responses. Fillout signs a BAA only on Enterprise, so regulated teams should plan around a sales conversation.
What we like
Free plan covers 1,000 responses a month with logic and payments (Nov 2026).
Unlimited seats on every plan, including free.
Deep Notion and Airtable links, with scheduling and PDFs built in.
Watch out for
HIPAA and a BAA are Enterprise only.
Custom domains and analytics need Business at $75 a month.
Response caps are monthly, so a big month can force an upgrade.
Typeform is the conversational pick for regulated teams, with a BAA on Enterprise only. Its one-question-at-a-time format lifts completion rates, and AI form creation drafts the questions from a prompt. The free plan stops at 10 responses a month, and Basic at $25 a month billed annually has no BAA, so the compliant tier needs a sales conversation.
The catch is the response meter. The free plan collects only 10 responses a month, and Basic at $25 a month billed annually covers just 100, so a busy lead form hits the cap fast. Removing Typeform branding starts on Plus, and higher response limits climb steeply, so price by the responses you expect, not by the form count.
What we like
Conversational one-question-at-a-time forms convert well (Nov 2026).
AI form creation and follow-up questions are built in.
Basic costs $25 a month billed annually for 100 responses.
Watch out for
Free plan stops at 10 responses a month.
Branding removal starts on Plus at $50 a month billed annually.
Sources used: vendor pricing pages, vendor product pages and vendor help pages, checked Nov 2026.
Criterion
Weight
What we looked at
BAA availability
40%
We ranked by whether the vendor will sign a BAA and on which plan, since a form tool without a BAA cannot carry patient data.
Price of the compliant tier
25%
We compared the price of the plan that carries the BAA, since the free plan never carries one and the compliant tier is the real price.
Security features
20%
We checked encryption, access controls and audit logs, since a BAA alone does not make a form secure.
Form features
15%
We weighed logic, question types and integrations, since a compliant form still has to work well.
What are the best HIPAA-compliant form builders in 2026?
The best HIPAA-compliant form builders in 2026 are Google Forms, Jotform and Zoho Forms. Google Forms leads because it is free with unlimited responses and covered under a Google Workspace BAA. Jotform is the clearest named HIPAA plan at Gold for $99 a month, and Zoho Forms is the best budget pick with HIPAA on Premium at $90 a month.
What is a BAA and why does it matter?
A BAA, or Business Associate Agreement, is a contract in which a vendor agrees to handle patient data under HIPAA rules. Without a signed BAA, a form tool cannot legally carry protected health information, no matter how secure it claims to be. Sign the BAA before you collect any patient data, and confirm the plan that carries it in writing.
Is Google Forms HIPAA compliant?
Yes, Google Forms is HIPAA compliant when it runs under a Google Workspace BAA. A Workspace admin accepts the BAA, and the form data stays inside the Workspace account. A personal Google account is never covered, so a clinic that uses a personal account for patient data is not compliant. The form itself is free, with Workspace Business Starter at $7 a user a month.
Which form builder is cheapest for HIPAA?
Google Forms is the cheapest HIPAA option, since the form is free and a Workspace BAA costs $7 a user a month on Business Starter. Zoho Forms Premium at $90 a month billed annually is the cheapest named HIPAA plan, and Jotform Gold at $99 a month billed annually is the clearest named plan. Formstack Forms at $99 a month needs a HIPAA add-on, so confirm the price first.
Can I use a free form builder for patient data?
No, free plans never carry a BAA, so the free tier is never the compliant tier. Google Forms is free, but it is covered only under a Workspace BAA, which needs a paid Workspace plan. Jotform free, Zoho Forms free, Typeform free and Fillout free all have no BAA, so a clinic that collects patient data on a free plan is not compliant.
Frequently asked questions
What is the best HIPAA-compliant form builder?
Google Forms is the best HIPAA-compliant form builder because it is free with unlimited responses and covered under a Google Workspace BAA. Jotform ranks second for teams that need HIPAA on a named plan, Gold at $99 a month, and Zoho Forms is the best budget pick with HIPAA on Premium at $90 a month.
Is Google Forms HIPAA compliant?
Yes, Google Forms is HIPAA compliant when it runs under a Google Workspace BAA. A Workspace admin accepts the BAA, and the form data stays inside the Workspace account. A personal Google account is never covered, so a clinic that uses a personal account for patient data is not compliant.
Is Jotform HIPAA compliant?
Yes, Jotform is HIPAA compliant on Gold at $99 a month billed annually, with encryption, access controls and a BAA. The free Starter plan covers 5 forms and 100 submissions a month, but it never carries a BAA, so the compliant tier starts at Gold. All plans except Enterprise are single-user.
Is Zoho Forms HIPAA compliant?
Yes, Zoho Forms is HIPAA compliant on Premium at $90 a month billed annually, with encryption and a BAA. Basic at $12 a month is cheap for unlimited forms, but it has no HIPAA cover, so a regulated team needs Premium from the start. It plugs straight into Zoho CRM, Books and Desk.
Is Typeform HIPAA compliant?
Typeform offers a BAA on Enterprise only, so a team that needs HIPAA cover should confirm the terms in writing before it collects patient data. The free plan stops at 10 responses a month, and Basic at $25 a month billed annually has no BAA, so the compliant tier needs a sales conversation.
Is Fillout HIPAA compliant?
Fillout offers a BAA on Enterprise only, so a team that needs HIPAA cover should confirm the price and terms in writing before it collects patient data. The free plan covers 1,000 responses a month with logic and payments, and unlimited seats on every plan, including free.
Can I use a free form builder for patient data?
No, free plans never carry a BAA, so the free tier is never the compliant tier. Google Forms is free, but it is covered only under a Workspace BAA, which needs a paid Workspace plan. Jotform free, Zoho Forms free, Typeform free and Fillout free all have no BAA.
Final verdict
Pick Google Forms if you want HIPAA cover at no extra cost.
Pick Jotform if you need HIPAA on a named plan.
Pick Formstack if you need HIPAA with documents and signatures.
Pick Zoho Forms if you want HIPAA on a budget.
Pick SurveyMonkey if you run surveys under an enterprise BAA.
Pick Qualtrics if you need HIPAA with research-grade analysis.
Pick Fillout if you want modern forms with a BAA on Enterprise.
Pick Typeform if you want conversational forms with a BAA on Enterprise.
