Are Google Forms, Microsoft Forms, Typeform, Qualtrics, Wix and WordPress Forms HIPAA Compliant?

No form tool is HIPAA compliant out of the box. A form builder can only be used to collect patient information when three conditions are met. First, the vendor signs a business associate agreement (BAA). Second, that BAA covers the specific product and plan you use. Third, you configure the form and every place it sends data. This guide checks each popular tool against those three conditions and points to the vendor policy an editor must confirm. Need starting points for the forms themselves? See our free HIPAA tools and templates.

Quick answer: which form builders can be used with PHI

Vendor policies change, so every cell below must be checked against the vendor's current documentation before you rely on it.

Before you rely on this table: check each vendor's current documentation and record the date you checked it.

Tool	Signs a BAA?	Plan required	PHI-ready by default?	Key caveat
Google Forms	Check Google's current Workspace HIPAA services list for Forms	Confirm which Workspace editions qualify	No. Needs a BAA and setup	Add-ons and linked Sheets shared outside your control
Microsoft Forms	Check Microsoft's current BAA in-scope services list for Forms	Confirm which Microsoft 365 licenses qualify	No. Needs a BAA and setup	Power Automate flows and connectors that move responses elsewhere
Typeform	Check Typeform's current HIPAA/BAA policy	Confirm with Typeform	No. Needs a BAA and setup	Integrations, webhooks and data region settings
Qualtrics	Check Qualtrics' current HIPAA and BAA terms	Confirm in your license or contract	No. Needs a BAA and setup	Distribution emails, panels and exports
Wix	Check Wix's current BAA policy	Confirm with Wix	No. Needs a BAA and setup	Where native form submissions are stored
WordPress core	Not applicable as a vendor. WordPress is software, so the BAAs come from your host and other providers	Depends on your host	No. Needs covered providers and setup	Host, email delivery, backups and plugins each need review
Gravity Forms	Check Gravity Forms' official HIPAA statement	Confirm license tier, if relevant	No. Needs covered providers and setup	Entry storage in your WordPress database and add-on BAA status

The one-line rule: if the vendor won't sign a BAA for the product and plan you use, don't collect PHI with it.

Checking a different tool? See more popular tools checked for HIPAA.

What makes a form tool usable under HIPAA

The BAA comes first

A covered entity is a healthcare provider, health plan or clearinghouse that HIPAA applies to directly. Most practices that bill insurance electronically fall into this group. A business associate is any outside company that creates, receives, stores or transmits protected health information (PHI) on the covered entity's behalf. A form vendor that stores a new patient's medication list is a business associate.

Before that vendor handles PHI, HIPAA requires a written contract called a business associate agreement (BAA). The BAA spells out how the vendor will protect the data and report breaches (45 CFR 164.502(e) and 164.504(e)).

The BAA must cover your product and your plan

A signed BAA with "Google" or "Microsoft" does not automatically cover every product that company makes. Many vendors limit their BAA to a list of named services or to certain paid tiers. Read the covered services list and confirm two things:

• The form tool appears on it by name.
• Your subscription tier qualifies.

Configuration is your job

The vendor secures its platform. You decide who can see the responses. The HIPAA Security Rule expects administrative, physical and technical safeguards (45 CFR 164.308–164.316). For a form tool, that means:

• Access controls. Only the staff who process the form can open responses. The front desk lead may need intake responses. The marketing coordinator does not.
• Two-factor authentication on every account that can view or export responses.
• Retention and deletion. Set how long responses stay in the form tool after they've been entered into your practice management system or EHR.
• Encryption in transit and at rest. This is necessary but not enough on its own.

Hidden leak paths

Most form-related exposures don't happen inside the form tool. They happen where the data goes next:

• Email notifications that paste the full answers into an inbox. That inbox may not be covered by a BAA.
• File uploads, such as insurance card photos or referral letters, stored in a location with different sharing rules.
• Connected spreadsheets that get shared "with anyone with the link" so a part-time biller can see them.
• Automations through Zapier-style tools that copy responses into a CRM, a task app or a chat channel.
• Analytics and tracking scripts on the page where the form is embedded. Review current HHS guidance on tracking technologies with your privacy officer.

Do you even need HIPAA here?

HIPAA applies when a covered entity or business associate collects PHI. A careers page form or a newsletter signup that asks for no health information may not need a BAA-covered tool. A "request an appointment" form becomes PHI collection once it asks for the reason for the visit.

Many practices design general website forms so they ask only for name, phone and preferred callback time. This is a judgment call, so confirm it with your privacy officer or counsel.

Is Google Forms HIPAA compliant?

Consumer Google accounts. Don't use a free personal Google account for PHI. Unless you have confirmed that a BAA covers the account you are using, treat it as uncovered. This includes a staff member's personal Gmail used to "quickly build" a symptom questionnaire.

Google Workspace. Google offers a BAA for a defined list of Workspace services. Two facts need confirming:

• Whether Forms is on that list.
• Which Workspace editions qualify.

How to make Google Forms HIPAA compliant (if it is covered)

1. Review and accept the BAA in the Google Admin console, following Google's current instructions.
2. Restrict who can respond and who can edit. Patient-facing forms may need to accept respondents outside your domain. Confirm how that interacts with BAA coverage.
3. Turn off settings that email copies of responses to respondents or form owners if those messages would contain PHI.
4. Lock down the linked Google Sheet. Share it with named staff accounts only, never by link.
5. Review add-ons. Third-party add-ons are built by other companies and may not be covered by Google's BAA, so remove any that touch responses unless you've confirmed coverage.

Common mistakes

• Sharing a response Sheet by link so a covering staff member can "check it from home."
• Installing an add-on to send formatted PDFs of submissions.
• Building the form in a personal account and transferring ownership later. The responses already sit in an uncovered account.

Is Microsoft Forms HIPAA compliant?

Microsoft makes its HIPAA BAA available through its contract terms. Check its current Product Terms and Data Protection Addendum to see where it sits. Whether Microsoft Forms is an in-scope service needs confirming.

Licenses and account types. Personal Microsoft accounts and work or school accounts are treated differently. Confirm which Microsoft 365 licenses are required for coverage.

Setup

• Respondents. Choose between "only people in my organization" and "anyone can respond." Understand what each option means for authentication and PHI.
• Notifications. Review email notification settings so response content doesn't land in inboxes it shouldn't.
• Storage. Know where responses live. Depending on how the form was created, that may be Forms itself, a linked Excel file or SharePoint. Know who can open each location. A group form saved to a team site may be visible to the whole team.

Caveat: Power Automate flows and third-party connectors can move responses outside Microsoft's covered services. One example is a flow that posts every new intake to an external app. Confirm coverage before you build them.

Is Typeform or Qualtrics HIPAA compliant?

Typeform

Searches often ask whether Typeform's position changed in 2025. Don't assume either way. Confirm the current policy, including:

• Whether Typeform signs a BAA, and on which plan.
• Any HIPAA-specific features or settings that must be enabled.
• Any data region requirements.

Integrations and webhooks. A Typeform intake that sends answers to a spreadsheet, CRM or webhook moves PHI to another party. Confirm whether the BAA covers these flows. If it doesn't, assume each destination needs its own BAA.

Qualtrics

Confirm whether Qualtrics offers a HIPAA-enabled product, whether it signs a BAA and which products or licenses include it. If your organization buys Qualtrics under a negotiated contract, make sure the HIPAA scope is written into your agreement. A university or hospital system license doesn't mean your practice's surveys are covered.

For both tools

Check whether these stay within BAA scope:

• Survey distribution emails
• Respondent panels
• Reminder messages
• Exports (CSV, PDF)

A patient satisfaction survey that asks about a specific procedure contains PHI. So does the export someone downloads to a laptop.

WordPress, Gravity Forms and Wix: can a website form be HIPAA compliant?

WordPress is software, not a vendor, so it can't sign a BAA. Whether a WordPress form can be used for PHI depends on every party that touches the data:

• Your hosting provider
• Your form plugin
• Where entries are stored
• The service that sends notification emails
• Your backup provider

Each one either signs a BAA or must never see PHI.

Gravity Forms

Confirm whether the plugin vendor signs a BAA. Confirm whether entries are stored in your own WordPress database, which would make your host the party that matters most. Common approaches include:

• Encrypting stored entries.
• Configuring the form not to store entries at all.
• Sending submissions to a HIPAA-covered service through an add-on.

Confirm each specific add-on and its vendor's BAA status before you use it. Don't name or install an add-on until that check is done.

Building a HIPAA-ready WordPress site: checklist

• Hosting with a signed BAA, with the host's current policy confirmed
• TLS on every page, not only the form page
• Encrypted storage for form entries and uploads
• Few admin accounts, each with 2FA, and no shared logins
• No PHI in notification emails unless the email provider has a BAA. A "new submission received, log in to view" message is safer.
• Encrypted backups, with the backup provider covered or never holding PHI
• Plugin minimization: remove anything that can read form data and isn't needed
• No tracking pixels or analytics scripts on form pages
• Audit logging of who viewed or exported entries

Encryption and an SSL certificate are on this list. Neither one makes a site HIPAA compliant by itself.

Wix

Confirm Wix's current BAA policy and how native form submissions are stored. If Wix doesn't sign a BAA, keep PHI out of Wix forms. Instead, embed a form from a service that is covered. Confirm whether embedding keeps submissions off Wix's servers and away from site scripts.

Do WordPress forms need to be HIPAA compliant?

Yes, if a covered entity uses them to collect PHI. A "new patient inquiry" form asking about symptoms or insurance is PHI collection. If you don't want to run that infrastructure, design your website forms not to collect health information. Move PHI collection to a covered tool.

Checklist before you put any form in front of patients

• BAA: A BAA is signed, and it names the product and plan you use.
• Data flows: Notifications, exports, integrations and automations are reviewed. Anything outside the BAA receives no PHI.
• Access: Access is limited by role and 2FA is on. Departing staff are offboarded the same day, including the front desk temp who had access to the intake responses.
• Retention: Retention and deletion rules are set. A named form owner reviews the form, its settings and its access list on a schedule.
• Signatures: If the form is a consent or authorization that needs a signature, check the signing step separately. See the HIPAA e-signature guide.
• Documentation: The decision is documented in your risk analysis.

This checklist supports your process. It is not legal advice. Confirm final decisions with your privacy officer or counsel.

After the form is submitted: keeping staff follow-up out of personal texts

Collecting the form is half the job. Someone still has to act on it:

• The front desk calls the patient back.
• Billing verifies the insurance card upload.
• A clinic manager approves a records request.

That follow-up often slides into personal texts or long email threads. A photo of a response gets forwarded to a colleague's phone. That can undo the care you put into choosing and configuring the form.

Chanty is internal staff chat where any message can become a task with an owner and a deadline. "Verify insurance for tomorrow's 9:00 new patient" gets assigned to a named person instead of being lost in a group thread. HIPAA-compliant staff chat with a signed BAA is available on the Business and Enterprise plans. Chanty is used alongside your form tool and clinical systems. It is not a form builder, a patient-facing tool or an EHR, and it doesn't make a practice compliant on its own.

A Chanty form builder is planned, not available today. Check the status of Chanty's planned HIPAA form builder. To decide which questions your forms should ask, start with our patient intake form templates and our HIPAA release form template.

FAQ

Are Google Forms HIPAA compliant?

Don't count on it with a free consumer Google account. Treat that account as uncovered unless you've confirmed a BAA applies. With Google Workspace, it depends on whether Forms is on Google's list of covered services and whether your edition qualifies. Configuration still matters either way.

How do I make Google Forms HIPAA compliant?

If Forms is covered:

1. Use a qualifying Workspace edition and accept the BAA in the Admin console.
2. Turn off email copies of responses.
3. Share the linked Sheet only with named staff.
4. Remove add-ons unless you've confirmed a BAA covers them.
5. Document the decision in your risk analysis.

Does Google sign a BAA for Google Forms?

Google offers a BAA for listed Workspace services. Whether Forms is included must be checked against the current list.

Is Microsoft Forms HIPAA compliant with a Microsoft 365 business license?

It depends on whether Forms is in scope under Microsoft's BAA and whether your license qualifies. Also review Power Automate flows and connectors.

Is Typeform HIPAA compliant in 2025, and does Typeform sign a BAA?

Check Typeform's current policy rather than older blog answers, including the plan and any data region requirements. Even with a BAA, confirm whether integrations and webhooks are covered.

Is Qualtrics HIPAA compliant?

Confirm with Qualtrics whether it offers a HIPAA-enabled product and signs a BAA, and on what terms. Make sure the HIPAA scope is written into your organization's contract, not assumed from a parent organization's license.

Is Gravity Forms HIPAA compliant?

That depends on the vendor's own statement. It also depends on where your entries are stored, your host's BAA, your email delivery and any add-ons.

Can a WordPress site be HIPAA compliant?

A WordPress site can be set up to support HIPAA compliance. Every provider that touches PHI must sign a BAA or never see PHI. That includes your host, email delivery service and backup provider. The site also needs encryption, access controls, audit logging and no tracking scripts on form pages.

Do WordPress contact forms need to be HIPAA compliant?

Only if a covered entity uses them to collect PHI. A contact form that asks only for name, phone and callback time may not collect PHI. Confirm with your privacy officer.

Are Wix forms HIPAA compliant?

Check Wix's current BAA policy. If Wix doesn't sign one, don't collect PHI in native Wix forms. Consider embedding a covered form service instead, and confirm how embedding affects where submissions go.

Is a form HIPAA compliant if the data is encrypted but there is no BAA?

No. Encryption is one safeguard. A vendor that stores or transmits PHI for you still needs a signed BAA. HIPAA also has no official certification, so treat any "HIPAA certified" label with caution.

Can form notification emails contain patient information?

Only if your email provider is covered by a BAA and the mailbox access is controlled. The safer pattern is a notification that says a new submission arrived, with staff logging in to the covered form tool to view it.