HIPAA-Compliant Forms and Surveys: What to Check Before You Collect Patient Data

No form builder or survey tool is "HIPAA certified," because HIPAA has no official certification. A form setup supports HIPAA compliance when four things are true: the vendor signs a Business Associate Agreement (BAA) that covers your form data, you are on the plan that includes that BAA, submissions are protected in storage and in transit, and your practice controls who sees them and where they go. Below is the checklist we would apply to any vendor, including ourselves. Chanty's own forms tool is still planned, so we also explain what Chanty does and does not do today.

Short answer: what makes an online form HIPAA compliant

A web form that collects a patient's name together with a reason for visit, insurance details or symptoms is collecting protected health information (PHI). A vendor that stores or processes that data for you is a business associate. That relationship is what turns a form tool into something you can use for patient data.

The core requirements:

• A signed BAA that covers form data. It should cover submissions, file uploads and any signatures captured on the form.
• Encryption in transit and at rest. This applies to the form page, the stored submissions and any uploaded files.
• Access controls. These include named user accounts, role-based permissions and a way to remove access.
• Secure storage of submissions. This includes audit logs, retention settings and deletion.

These map to the administrative, physical and technical safeguards of the HIPAA Security Rule.

The plan tier matters. Many vendors offer a BAA only on specific paid plans. The same tool can be appropriate for PHI on one plan and inappropriate on another.

Compliance is shared. A BAA covers what the vendor does. Your practice still decides who can open submissions, whether a notification email forwards a patient's answers to a shared inbox, and how long intake data is kept.

Checklist for choosing a HIPAA-compliant form builder

Use this list when you evaluate a vendor. Ask for written answers, not sales-call answers.

Area	What to confirm	Example from a clinic
BAA	Which plan includes it. Whether it is signed before any PHI is collected. What it covers: forms, file uploads, e-signatures, integrations.	Front desk publishes a new-patient form on Monday, and the BAA is signed the following week. Every submission before signing was collected without coverage.
Encryption	Encryption in transit and at rest for submissions and uploads.	Patients upload photos of insurance cards. Confirm the files are encrypted where they are stored, not just the text fields.
Notifications	Whether notification emails include the submitted answers or only a link to log in.	"New submission" emails that contain the full intake land in a shared front-desk Gmail inbox. Switch them to link-only.
Access	Per-user roles, two-factor authentication, SSO, and fast removal of access.	A billing coordinator leaves. Their form account should be closed the same day as their other accounts.
Records	Audit logs of who viewed or exported submissions. Retention and deletion settings. Data export.	Your privacy officer needs to see who downloaded last month's submissions as a spreadsheet.
Integrations	Each connected app (spreadsheets, CRMs, automation tools) is usually outside the form vendor's BAA. Check each one separately.	A form pushes every submission into a spreadsheet for tracking. That spreadsheet now holds PHI and needs its own coverage.
Embeds	Whether your website or plugin also stores a copy of the submission.	A WordPress contact form plugin may save entries in the site database as well as sending them to the form vendor.

If a vendor cannot answer the BAA and integration questions clearly, treat that as an answer.

HIPAA-compliant surveys: patient, post-visit and NPS

Surveys bring up the same questions as forms, with a few differences.

When survey answers are PHI. Responses linked to a patient's identity, a specific visit or health information are generally PHI. A post-visit survey that records the patient's email, appointment date and provider name falls in this group. Truly anonymous responses, with no identifiers and no way to link them back to a person, may not be PHI. "Anonymous" in a survey tool's settings does not always mean de-identified under HIPAA. Check what the tool still records behind the scenes.

Post-visit and NPS surveys sent by email or SMS. Check two things separately:

1. The survey vendor's BAA.
2. The delivery channel.

A covered survey platform does not automatically cover the email service or texting service that sends the link. If the message itself names the visit or the provider, the channel matters too.

Survey-specific checks:

• Respondent identifiers: whether email, name or a patient ID is attached to responses.
• IP logging: whether IP addresses are stored with each response, and whether you can turn that off.
• Response export: who can download results, and in what format.
• Viewing rights: whether only the practice manager sees results, or every account holder.

Staff surveys are different. An internal poll asking employees whether the new check-in process is working usually does not involve PHI. Keep it that way. Write questions so staff answer about operations, not about specific patients.

Is Jotform HIPAA compliant? Is SurveyMonkey HIPAA compliant?

These are two of the most common questions practices ask. The useful answer is not "yes" or "no." It is "on which plan, with what BAA, configured how."

	Jotform	SurveyMonkey
HIPAA features offered	Check Jotform's current HIPAA page	Check SurveyMonkey's current HIPAA page
BAA available	Confirm in writing with Jotform	Confirm in writing with SurveyMonkey
Plan required	Confirm which plan includes the BAA	Confirm which plan includes the BAA, if any
Pricing tier	Check current pricing for that plan	Check current pricing for that plan

Both are established tools that many organizations use. For each one:

• Confirm the current BAA terms on the vendor's own site.
• Note the date you checked.
• Run the checklist above against the plan you would actually buy.

Vendor policies change, so recheck at renewal.

For the same check on other common tools, see our guide to Google Forms, Microsoft Forms, Wix and WordPress forms checked for HIPAA.

Are there free HIPAA-compliant form builders?

Usually not in the way people hope. The free plans of mainstream form and survey tools generally do not include a BAA. Without a BAA, the tool should not be used to collect PHI, however secure it looks.

If a vendor advertises a free HIPAA option, get the following in writing before you rely on it:

• that a BAA is signed on the free tier
• submission and storage limits
• data retention and deletion terms
• what happens to your data if you stop paying or the free tier changes

For simple needs, a low-cost alternative is a printable or fillable template handled under the systems and procedures you already have. Examples include a paper intake packet scanned into your EHR, or a fillable PDF returned through a channel your practice already covers. If forms come back by fax, review the HIPAA fax requirements and disclaimers and use a confidential fax cover sheet template.

You can also see other popular tools checked for HIPAA before you choose.

Chanty's forms tool: planned, and what you can do today

A Chanty forms tool is planned. It is not available yet. This page does not promise a release date or a feature list.

What Chanty is today. Chanty is internal team chat and work coordination for staff. It is not a patient-facing form, intake, survey or messaging tool, and it is not an EHR. Patients do not fill anything out in Chanty.

Where Chanty fits. Chanty covers the operational work that happens after a form arrives through your form vendor or EHR. For example:

• The front desk sees that a new-patient packet came back missing an insurance card.
• They post in the front-desk channel and turn that message into a task.
• The task has an owner (the intake coordinator) and a deadline (before the appointment on Thursday).
• Everyone can see when it is done, instead of the request getting lost in a text thread.

HIPAA and plans. Chanty is HIPAA-compliant with a signed BAA on the Business and Enterprise plans. The Free plan has no BAA and should not hold PHI. Data is encrypted in transit with TLS 1.2+, and file storage is encrypted. Details are on the Chanty security, HIPAA and BAA details page. For how teams use it day to day, see HIPAA-compliant chat for staff.

Polls and surveys are for staff. The Business and Enterprise plans include internal communications tools such as polls and surveys. Use them for employee feedback, such as "Which lunch-hour coverage option works for the Eastside location?" They are not designed for patient surveys.

Integrations are outside Chanty's BAA. Zapier, Make and n8n can connect Chanty to other tools. Those services are outside Chanty's BAA scope, so routing form submissions containing PHI through them needs separate review. A Google Forms integration is listed as coming soon. It is not live.

You can try Chanty for staff coordination at chanty.com/signup. Choose Business or Enterprise and sign the BAA before any PHI goes into the workspace.

Free templates to start with

If you are building intake or authorization forms, start from a template rather than a blank page. Browse all of our free HIPAA tools and templates.

• Patient intake form templates. Covers the fields to include, with notes on which ones are PHI. Demographics, insurance, medical history and reason for visit all are.
• HIPAA release form template. Covers authorization basics: what is being disclosed, to whom, for what purpose, an expiration and the patient's signature.

Use the templates only in one of two ways:

• inside a form vendor setup covered by a signed BAA, or
• on paper, handled by your existing procedures for storing and scanning patient documents.

Your side of the responsibility

Even with the right vendor and plan, these steps stay with your practice:

1. Sign the BAA before collecting any PHI. Keep a copy with your privacy officer, along with the date and the plan it covers.
2. Limit who can view submissions. The front desk may need intake forms. The marketing coordinator who manages the website does not.
3. Remove access during offboarding. Add form and survey accounts to the same offboarding checklist as your EHR and email.
4. Turn off PHI in email notifications. Use link-only alerts that require login.
5. Review every connected integration. List each app a submission touches, and confirm coverage for each one.
6. Document the setup in your HIPAA risk analysis. Record the vendor, plan, BAA date, who has access and where data flows.

FAQ

What makes a form HIPAA compliant?

A form setup supports HIPAA compliance when four things are in place:

• the vendor signs a BAA covering the form data
• you use the plan that includes that BAA
• submissions are encrypted in transit and at rest
• access, notifications, integrations and retention are configured to protect PHI

No form builder is HIPAA certified, because no such certification exists.

Is there a free HIPAA-compliant form builder?

Free plans of mainstream form and survey tools generally do not include a BAA. If a vendor claims a free HIPAA option, confirm the BAA, limits and retention terms in writing.

Is Jotform HIPAA compliant, and on which plan?

It depends on the plan and BAA in place. Check Jotform's current terms and run the checklist above against the plan you would buy.

Is SurveyMonkey HIPAA compliant?

It depends on whether a BAA is offered on your plan. Confirm with SurveyMonkey directly and note the date you checked.

Do patient satisfaction or NPS surveys need to be HIPAA compliant?

If responses are linked to a patient, a visit or health information, they are generally PHI and need a BAA-covered setup. Truly anonymous responses may not be PHI. Check the delivery channel (email or SMS) separately.

Can I use a HIPAA-compliant contact form on my WordPress site?

Possibly, if the form vendor signs a BAA and you confirm that the WordPress plugin or site database does not also store submissions. A copy stored on your web host is outside the form vendor's BAA.

Does Chanty have a forms tool?

Not yet. A forms tool is planned, with no release date or feature list announced. Chanty today is internal team chat and work coordination for staff.

Can I send form submissions into Chanty?

Automation platforms like Zapier, Make and n8n can connect tools to Chanty, but they are outside Chanty's BAA scope. Review each one before routing any PHI through it. A Google Forms integration is listed as coming soon, not live.

Is Chanty HIPAA compliant?

Chanty is HIPAA-compliant with a signed BAA on the Business and Enterprise plans. The Free plan has no BAA and should not be used for PHI. Your practice remains responsible for configuring roles, managing access and training staff.