21 best HIPAA compliant form builders (2026)

A clipboard in the waiting room is the slowest and least secure way to collect a health history. Patients want to fill out forms before they arrive: in Kyruus Health's 2024 benchmark of 1,000 US consumers, 92% wanted to complete pre-visit forms online and 93% wanted to give insurance details online. The front desk wants it too. In Weave's 2026 survey of 285 dental, medical, optometry and veterinary practices, 63% said staff spend an hour or more every day on manual data entry, and intake and forms was the second thing they wanted automated (42%), behind scheduling.

The catch is HIPAA. The moment a patient types a medication or a diagnosis into a web form, the company hosting that form is handling protected health information on your behalf. HHS calls that company a business associate, and you need a signed Business Associate Agreement (BAA) with them before the first form goes out. A free survey tool with no BAA is a HIPAA violation waiting to be found, and HHS is enforcing: 25 enforcement actions in 2025 and 7 more so far in 2026, including a solo dental practice that paid $140,000 in August 2026.

This guide explains what makes a form HIPAA compliant, how to build one, and 21 form builders and intake platforms that sign a BAA or state they act as your business associate, checked vendor by vendor in October 2026. It also answers the question practices ask most: is there a free one?

What makes an online form HIPAA compliant

HIPAA does not certify software. "HIPAA compliant form builder" means the vendor will sign a BAA and the product has the safeguards the Security Rule expects. In practice, that is six things:

• A signed BAA. The vendor agrees in writing to protect your patients' information, report breaches to you and only use the data to provide the service. HHS lists a cloud service that stores or transmits patient data as a business associate, and the Privacy Rule requires the written agreement before any data is shared (45 CFR 164.502(e)).
• Encryption in transit and at rest. HTTPS on the form, encrypted storage behind it. Today's Security Rule lists encryption as "addressable"; the rule HHS proposed in January 2025 would make it required, along with multi-factor authentication. That update was not final as of October 2026, but every vendor on this list already encrypts.
• Access controls and an audit log. Each staff member has their own login, you can limit who sees submissions, and the system records who opened what.
• No patient data in email. Most form tools email you each submission. A HIPAA setting strips the health information out of the notification and keeps it inside the encrypted account.
• A valid e-signature. HIPAA does not require electronic signatures and sets no standard for them. The federal ESIGN Act says a signature cannot be denied legal effect only because it is electronic, so a typed or drawn signature with a timestamp and the signer's email is fine for consents and financial policies.
• Minimum necessary. Only ask for what the visit needs. A new-patient form does not need a Social Security number.

The penalties are the reason to get this right. HHS's 2026 penalty schedule runs from $145 per violation for a practice that did not know, up to $73,011 per violation and $2,190,294 a year for willful neglect. The two small-practice cases from the last two years are instructive: a single-physician neurology practice with five staff paid $25,000 after ransomware because it had not done a risk analysis, and the solo dental practice above paid $140,000 after a patient's records-access complaint led HHS to find it had no HIPAA privacy or breach policies, training or safeguards.

Is there a free HIPAA compliant form builder?

Almost never. Free plans at Jotform, Zoho Forms, Cognito Forms, Typeform, Tally and Fillout do not come with a BAA; HIPAA is on a paid tier or not offered at all. Three exceptions worth knowing:

• Google Forms is covered by Google Workspace's BAA if your practice pays for Workspace and an administrator has accepted the BAA in the Admin console. The old free edition cannot accept one, and Marketplace add-ons are not covered.
• Microsoft Forms is in scope of Microsoft's BAA for commercial Microsoft 365 customers, which is included in the standard data protection terms.
• HIPAAtizer lists a BAA on its free developer sandbox, capped at 300 submissions a month.

Neither Google Forms nor Microsoft Forms has a built-in e-signature, and neither puts anything in your practice management system. They are fine for a staff survey or a screening questionnaire. They are not a patient intake system.

How to create HIPAA compliant forms: seven steps

• 1. Sign the BAA first. Before building anything, get the BAA signed and filed. Most vendors put it behind a HIPAA toggle or a request form; some only sign on a specific plan.
• 2. Turn on the HIPAA settings. Enable encryption of stored submissions, strip patient data from email notifications, set session timeouts and require two-factor login for staff.
• 3. Build from your paper packet, then cut. Start with the forms you hand out today: new patient registration, health history, insurance, HIPAA acknowledgment, financial policy, treatment consents. Remove every field you do not use.
• 4. Use conditional logic. Show the pregnancy questions only when the patient is female, the medication list only when they say yes. Shorter forms get finished.
• 5. Add card photos and signatures. Let patients photograph the front and back of their insurance card and ID, and sign consents on their phone.
• 6. Send the forms before the visit. Text the link with the appointment reminder two or three days out. Forms completed at home take the clipboard out of the waiting room.
• 7. Decide where the answers land. This is the step most practices skip. If the form sends you a PDF or a CSV, someone still has to type the health history into the chart. The platforms in the first group below write the answers into the practice management system directly.

Form builders vs. patient intake platforms

There are two kinds of tools on this list, and the difference matters more than any feature.

• General form builders (Jotform, Cognito Forms, Zoho Forms and the rest) let you build any form and will sign a BAA on the right plan. Submissions land in their dashboard, an email or a spreadsheet. They do not know what Dentrix or athenahealth is.
• Patient intake platforms (NexHealth, Weave, RevenueWell, Yapi, FormDoctor and others) ship with intake forms already built, send them by text before the appointment, and write the answers into the patient's chart in your practice management system or EHR. How much writes back varies by vendor and by system, from "a PDF in the document center" to "every field".

If the form is for a marketing page or a staff survey, a form builder is enough. If it is a health history that a hygienist or nurse needs in the chart before the patient sits down, buy an intake platform.

The 21 tools at a glance

Review scores below are G2 and Capterra ratings as of October 2026 with the number of reviews. Prices are what the vendor publishes; where we say "on Capterra", the vendor's own site does not list a price.

Patient intake platforms that put the form in the chart

These come with the intake packet built, send it by text before the visit and write the answers into your practice management system. Ask each one the same question: which of my forms write fields into the chart, and which only drop a PDF.

1. NexHealth Forms

NexHealth Forms is the intake product in the NexHealth patient experience platform, used by dental and medical practices from single offices to DSOs and medical groups. Patients get the forms by text or email before the appointment and fill them out on their phone: health history, consents, financial policy, insurance card and ID photos, signatures. Conditional logic shows only the questions that apply, and the forms can be sent automatically with the appointment reminder.

The difference is where the answers go. NexHealth writes them into the patient's chart in the practice management system or EHR: name, address, medications, allergies and conditions land in the record within seconds, and a signed PDF is saved to the document center. Staff get an alert in the health record system when a patient reports a new allergy or medication. It syncs with 15 systems including Dentrix, Dentrix Ascend, Eaglesoft, Open Dental, Curve Dental, Denticon, athenahealth, eClinicalWorks, NextGen Office and ModMed; practices on other systems can use the forms without the sync.

Forms is part of the same platform as Scheduling, Communications, Verification, Payments, Insights (practice analytics, included free), Treatment Plans, Payment Plans and Phones, plus Coworker, the AI front desk assistant that sends the forms, answers patient texts and books with every step written back into the record. 20,000+ practices and 100 million+ patient records run on NexHealth. HIPAA compliant with a Business Associate Agreement signed with every practice, US-based support, no long-term contracts. Pricing is by quote. See NexHealth Forms.

2. Weave Digital Forms

Weave is a phone and patient communication platform for dental, medical, optometry and veterinary practices, and Digital Forms is a module in its Coordinate bundle. Patients fill out forms on their phone or a tablet in the office, with ID and insurance card upload, and Weave says it syncs patient data and medical history to the patient profile and uploads the completed forms to the document center. Its forms page does not name which practice management systems get the write-back, so ask for yours. Weave publishes its BAA. Pricing: base plans from $199 a month plus the Coordinate bundle at $149 a month, with details by quote. Weave agreed in August 2026 to be taken private by Francisco Partners. G2 4.6 from 521 reviews; Capterra 4.4 from 705.

3. RevenueWell Forms

RevenueWell is a dental marketing and communication platform, and its help center spells out what its Forms module writes back, which is rare. On Dentrix, patient information fields write into the record and health history, insurance and custom forms arrive as PDFs in the Document Center. On Eaglesoft 18 and up, patient information and health history write as data. On Open Dental 22 and up, patient information, health history (medications, problems, allergies) and insurance all write as data, with PDFs alongside. Forms support ID and insurance card photos and signatures. RevenueWell says it acts as your business associate; ask for the BAA. Pricing is not on its site; Capterra lists the Starter plan at $189 a month with basic forms, and custom forms on Professional. G2 4.7 from 142 reviews; Capterra 4.4 from 83.

4. Yapi

Yapi is a dental patient engagement platform whose forms sync into Dentrix, Dentrix Ascend, Eaglesoft and Open Dental; on Dentrix the forms pre-populate from the record and write back, and on Eaglesoft the signed PDF goes to SmartDoc with data sync. It covers intake, consents and treatment plan signing with e-signature. Yapi states it acts as your business associate; ask for the signed BAA. Yapi combined with DoctorLogic in 2025. Pricing is not published; Capterra lists it from $199 a month. Capterra 4.6 from 49 reviews.

5. Dental Intelligence Engagement (Modento)

Modento is now the Engagement product inside Dental Intelligence, and it publishes a BAA. Its help center spells out the write-back by system: completed forms land as PDFs in Eaglesoft SmartDocs, Open Dental Images, the Dentrix Document Center or Denticon chart notes; on Dentrix Ascend the patient information fields also write into the record. Forms include staff e-signature, photo and file upload and Spanish versions; consents and treatment plans are separate modules. Pricing is not published. G2 4.3 from 76 reviews; Capterra 4.6 from 53.

6. Intiveo Forms

Intiveo is a dental patient communication platform used in Canada and the US. On its Enhanced plan, forms update demographic fields and attach a PDF in ClearDent, Dentrix G7, Eaglesoft, Open Dental, ABELDent, Power Practice, OMSVision, DSN and Maxident; the Essential plan is manual download. Providers can sign forms. Its site has a HIPAA and PIPEDA section but no BAA language, so ask for one. Pricing is not published. G2 4.8 from 31 reviews; Capterra 4.6 from 49.

7. Doctible Digital Forms

Doctible is a patient engagement platform for small dental, orthodontic, chiropractic and vision practices. Its forms support e-signature, consent forms and if/then logic, and Doctible requires every practice to sign a BAA. Completed forms arrive as a secure PDF that you upload to your practice management software; Doctible does not document field-level write-back. Pricing is not on its site; Capterra lists Digital Forms in the $399 a month Gold Plus plan. G2 4.5 from 18 reviews; Capterra 4.8 from 265.

8. FormDoctor (FormDr)

FormDoctor (formdr.com) is a standalone HIPAA form builder for medical practices with intake packets, e-signature, card photo upload and consent templates, and the BAA is included with the account. Its EHR integrations add and update patients and push PDFs in athenahealth and ModMed, sync demographics both ways with Epic, upload PDFs only to eClinicalWorks and use HL7 for others; integration cost varies. Plans are Core, Growth and Enterprise, all by quote as of October 2026. G2 3.9 from 17 reviews; Capterra 4.3 from 12.

9. IntakeQ

IntakeQ is a standalone intake forms product for medical, allied health and mental health practices, with e-signature, conditional logic and a BAA included on the Forms plan. Forms live in IntakeQ's portal; per its help center, the Elation integration uploads them as PDFs to the chart and fills demographics and insurance fields, and RevolutionEHR, Zapier and an API are available. Published pricing: Forms $54.90 a month plus $20 per additional practitioner. No dental integrations. G2 4.2 from 16 reviews; Capterra 4.7 from 322.

10. Klara

Klara is ModMed's patient communication platform, used by dermatology, pain and other medical specialty practices. Its eForms include insurance card upload and legally binding signatures, and the athenahealth and ModMed integrations write form data into the chart; for other EHRs, forms save as PDFs in Klara and export. Klara's site says it helps practices stay HIPAA compliant but does not publish a BAA, so ask for one. Pricing is not published. Not built for dental. G2 4.6 from 112 reviews; Capterra 4.6 from 211.

General form builders that sign a BAA

These build any form you can draw, and the HIPAA version adds encryption, PHI-free notifications and the BAA. None of them write into a practice management system; plan on downloading or re-keying.

11. Jotform

Jotform is the most used form builder on this list and offers HIPAA features only on its Gold and Enterprise plans, with a BAA you request from the account's data page after enabling HIPAA. The HIPAA account encrypts submissions, keeps activity logs and includes e-signatures. Gold is $99 a month billed annually or $129 month to month; the free plan excludes HIPAA. Integrations are generic (Google Drive, Dropbox, Stripe, Square), with EHR connections only through third-party tools. G2 4.6 from 5,762 reviews; Capterra 4.7 from 2,930.

12. Cognito Forms

Cognito Forms puts HIPAA on its Enterprise plan at $149 a month billed annually or $199 month to month, with the BAA signed by the account owner in the account settings; its HIPAA page still quotes $129. Protected fields are kept out of email, sessions time out, and e-signatures are included from the Pro plan up. Integrations are API, webhooks and payment processors; no EHRs. G2 4.7 from 179 reviews; Capterra 4.8 from 250.

13. Zoho Forms

Zoho Forms offers HIPAA compliance on its Premium plan at $90 a month billed annually: you mark fields as containing health information, submissions are encrypted, and an audit trail covers 90 days. The BAA is requested by emailing Zoho's legal team. A signature field is on every plan. Best for practices already on Zoho CRM or Zoho's other apps; no EHR integrations. G2 4.4 from 128 reviews; Capterra 4.5 from 148.

14. Formstack

Formstack sells HIPAA as a paid add-on on its Forms ($83 a month billed annually) and Suite ($250 a month) plans, and includes it on Enterprise; the add-on price is not published. HIPAA accounts get encryption, user permissions, field-level security and audit logging, and Formstack Sign covers e-signature. It is built around Salesforce, with no EHR integrations. Formstack bought Formsite in 2023, and Formsite's HIPAA service is now closed to new customers. G2 4.3 from 471 reviews; Capterra 4.0 from 129.

15. FormAssembly

FormAssembly is an enterprise form platform used by hospitals, research groups and Salesforce shops. It signs a BAA on its enterprise-level plans and offers field-level masking and governed workflows, with single-signer e-signature on the entry plan and multi-party on higher plans. It says it connects to EHR systems but names none. Prices are not published. G2 4.4 from 425 reviews; Capterra 4.5 from 103.

16. 123FormBuilder

123FormBuilder, owned by Kiteworks since 2024, includes HIPAA and a BAA on its Compliance plan, listed from $255 per user a month billed yearly; the lower Enterprise tier, from $225, excludes it. It offers encryption at rest and in transit, roles and permissions, US or EU data residency and digital signatures. No EHR integrations. G2 4.5 from 175 reviews; Capterra 4.4 from 175.

17. HIPAAtizer

HIPAAtizer is a healthcare-only form builder for small offices that lists a BAA on every plan, including a free developer sandbox limited to 300 submissions a month. Paid plans run from Gold at $29 a month billed annually ($34 monthly) to Platinum at $99, with form encryption, two-factor login, access and audit logs, e-signature on paid plans and embeds for WordPress and Wix. Integrations are Zapier, webhooks and payments; no EHRs. It is new enough to have one Capterra review.

18. FormHippo

FormHippo is a healthcare-only form builder aimed at counselors and small practices, with a BAA at no extra charge on every plan, AES-256 encryption, audit trails and e-signature with email code verification. Plans are $8.95 and $11.95 per user a month after a 30-day trial; there is no free plan. Google Drive is the only integration, and there are no public G2 or Capterra reviews yet.

19. Typeform

Typeform's conversational forms are popular for marketing, and HIPAA is available: a BAA is offered only on the Enterprise plan, which is priced by quote (self-serve plans start at $28 a month). There is no e-signature field and there are no healthcare integrations. Fine for a patient satisfaction survey, not for intake. G2 4.5 from 1,026 reviews; Capterra 4.7 from 984.

Tools you may already pay for

20. Google Forms

Google Forms is on the list of Google Workspace services covered by Google's BAA, alongside Drive, Docs and Sheets. The BAA has to be accepted by a Workspace administrator in the Admin console, PHI must stay out of services not on the list, and third-party add-ons are not covered. There is no native e-signature, so it cannot replace a consent form, and responses land in a Google Sheet. Capterra 4.7 from 11,603 reviews.

21. Microsoft Forms

Microsoft Forms is in scope of Microsoft's HIPAA Business Associate Agreement, which is included in the data protection terms for commercial Microsoft 365 customers. Microsoft says using its services does not by itself make a practice compliant; you still configure access and retention. Forms has no built-in e-signature and responses go to Excel. G2 4.4 from 476 reviews; Capterra 4.6 from 327.

How to choose: five questions

• Will you sign a BAA, and on which plan? Get the answer in writing before the trial. "HIPAA compliant" on a pricing page without a BAA is marketing.
• Where do the answers land? Ask the vendor to show a completed health history in your practice management system, not in their dashboard. If it is a PDF, ask who types the allergies into the chart.
• Which of our systems does it write to? Get your practice management system or EHR named in writing, with what writes as fields and what arrives as a PDF.
• Can patients finish it on a phone before the visit? Text delivery, card photos, conditional logic and a signature that works with a thumb. Forms that need a tablet at the desk did not remove the clipboard.
• What is the all-in price per location? Form builders charge per plan or per user; intake platforms charge per location per month, sometimes as a bundle. Ask what the e-signature, extra users and EHR integration cost.

Frequently asked questions

Are Google Forms HIPAA compliant?

They can be. Google Forms is covered by the Google Workspace BAA when an administrator has accepted it in the Admin console. Without a Workspace subscription and an accepted BAA, no. Google Forms also has no e-signature.

Is Jotform HIPAA compliant?

Yes, on the Gold ($99 a month billed annually) and Enterprise plans, where you enable HIPAA on the account and request the BAA. The free, Bronze and Silver plans are not covered.

Is Typeform HIPAA compliant?

Only on the Enterprise plan, which is priced by quote and is the only plan where Typeform signs a BAA.

Does HIPAA require electronic signatures?

No. HHS says the Security Rule does not require electronic signatures and sets no standard for them. Electronic consents are valid under the federal ESIGN Act as long as the signature is attributable to the patient, so the forms tools above all count.

What happens if we collect patient information with a non-compliant form?

Using a form tool that stores health information without a BAA is a violation by itself. HHS's 2026 penalty schedule runs from $145 per violation up to $73,011 per violation and $2,190,294 a year for willful neglect, and HHS settled with a solo dental practice for $140,000 in August 2026. IBM's 2025 study put the average cost of a healthcare data breach at $7.42 million, the highest of any industry.

What is the difference between a HIPAA compliant form builder and patient intake software?

A form builder makes the form and stores the answers. Patient intake software sends the right forms to the right patient before the visit and writes the answers into the chart. For a dental or medical practice, the second one is what removes the data entry.

Get every patient's forms into the chart before they arrive

NexHealth Forms sends the intake packet by text before the visit, patients fill it out on their phone with signatures and card photos, and the answers are written into the patient's chart in the health record system you already use. HIPAA compliant with a BAA for every practice, part of the platform 20,000+ dental and medical practices run on. Book a demo or call 866-522-1598 to see it running on your system.