Best HIPAA-Ready Form Builders in 2026: BAAs and Prices Checked

For most small medical and therapy practices that want one general form builder, Jotform Gold is the best choice because it has a self-serve BAA, high submission limits and a large template library. If you run a solo or small therapy practice and only need intake paperwork, IntakeQ costs less and lists a BAA on every plan.

The rest of this list is about matching the tool to your volume and budget. Every BAA and price claim below comes from the vendor's own pages, checked on 2 November 2026.

The right form builder is the cheapest one that signs a BAA on the plan you will actually use, and fits how your staff already works.

One rule before the list: a vendor that signs a Business Associate Agreement (BAA) has not made your practice compliant. HHS says a covered entity must have a written contract with any business associate that handles PHI for it, but your own policies, staff access and email settings still matter. This guide is not legal advice.

Quick comparison

Prices checked on vendor pricing pages on 2 November 2026.

How we chose

• A BAA on a named plan. We only gave a top spot to a vendor whose own page says it signs a BAA and on which plan.
• Total monthly cost for a small practice. We looked at the cheapest plan that includes the BAA, not the cheapest plan overall.
• Submission and form limits. A $29 plan that caps you at 500 submissions can cost more in staff time than a $99 plan.
• How PHI moves after submission. Email notifications and integrations are where many practices leak data, so we noted which tools restrict them.
• Fit for clinical paperwork. E-signatures, file uploads and intake-specific features matter more here than survey logic.
• Setup effort. A self-serve BAA you can sign in the dashboard is faster than a sales call.

1. Jotform: best all-round pick for most practices

• Best for: Clinics and group practices that want one builder for intake, consent, payments and internal forms.
• Price: Gold lists at $1,188 a year ($99 a month) or $129 month to month on the Jotform pricing page. Bronze ($39/mo) and Silver ($49/mo) do not include HIPAA features. Enterprise is custom priced.

Jotform's pricing FAQ says HIPAA compliance features, "such as encryption, auditing, and PHI segmentation", are available on Gold and Enterprise plans only. Its help guide on enabling HIPAA features says the dedicated HIPAA environment is an upgrade for eligible Gold and Enterprise customers, and that a Covered Entity then signs the BAA from the Data page. The same guide says a copy of the signed BAA arrives by email.

Gold's plan data on the pricing page lists 10,000 submissions a month, 100 forms and 100 GB of upload space. Jotform also publishes HIPAA form templates, such as counseling intake and consent forms, which saves setup time.

Where it falls short:

• There is no free trial of HIPAA features: the free Starter plan excludes them.
• If you exceed total submission storage, the pricing FAQ says the system deletes the oldest response to make room. Export and purge on a schedule.
• Gold is a big jump from Silver if you only need a few intake forms.

Our take: The safest default for a practice that wants one tool for everything. Budget for Gold from day one rather than trying to make a cheaper plan work.

2. Cognito Forms: best for unlimited entries at a fixed price

• Best for: Practices with high form volume that want a predictable bill and an in-app BAA.
• Price: Enterprise is $129 a month billed yearly or $174 month to month on the Cognito Forms pricing page, with 20 users and unlimited entries. The Pro and Team plans do not include HIPAA.

Cognito's HIPAA compliance guide says your organization must be on the Enterprise plan, and not a trial, to enter a BAA. It adds that there is no extra cost for the BAA beyond the subscription. An owner signs it from the Plan & Billing menu and can download it any time.

The same guide lists what changes after signing: all forms are encrypted at rest, guest access is switched on for workflow and save-and-resume links, and you are told to mark PHI fields as protected so they are not sent in email notifications. That is useful guardrail behavior for a small office.

Where it falls short:

• You cannot test HIPAA mode on a trial.
• Extra users cost $5 each a month, and storage above 100 GB adds $25 a month per 50 GB.
• Fewer healthcare-specific templates than Jotform.

Our take: A strong pick when volume is high or unpredictable. Unlimited entries on Enterprise remove the submission math entirely.

3. IntakeQ: best for solo and small therapy practices

• Best for: Therapists, counselors and small allied health practices that want intake forms, e-signatures and notes in one place.
• Price: The IntakeQ pricing page lists Forms Only at $54.90 a month plus $20 per additional practitioner, and Practice Management at $84.90 a month plus $30 per additional practitioner. Low-volume versions start at $29.90 a month for 10 form submissions a month. No contract.

IntakeQ lists "HIPAA BAA" as a feature of its Forms Only plans, and Practice Management includes all Forms Only features. That makes it the simplest path to a BAA in this list for a solo clinician.

It is built around clinical paperwork rather than general forms. Plans include branded intake forms, client and provider e-signatures, form reminders, treatment notes and secure document sharing. Practice Management adds a booking widget, client portal, telehealth, claims and superbills.

Where it falls short:

• It is not a general marketing form builder. Use it for intake, not newsletter sign-ups.
• Per-practitioner fees add up in a group practice.
• The low-volume Forms plan's 10 submissions a month is tight once you are busy.

Our take: For a therapy practice, this often beats a general form builder on both price and fit. If you already use another EHR, check for overlap first. Our guide to HIPAA-friendly forms and scheduling for therapists covers the scheduling side.

4. HIPAAtizer: lowest-cost BAA for low volume

• Best for: A single practitioner or small med spa with a handful of forms.
• Price: On the HIPAAtizer pricing page, Simple Compliance Gold is $29 a month billed yearly or $34 monthly (5 forms, 500 submissions a month). Gold Plus is $39 or $45 (10 forms, 1,000 submissions). Platinum is $99 or $125 (50 forms, 5,000 submissions).

HIPAAtizer's pricing table marks the BAA as included on every paid Simple Compliance plan. The free Developer Sandbox account is marked as not HIPAA compliant and without a BAA, so do not collect patient data on it.

The entry Gold plan includes e-signatures, email notifications and audit logs. Its pricing table does not tick Stripe or PayPal payments, webhooks or save-and-continue for Gold, so check the higher tiers if you need those. The page offers a 30-day free trial.

Where it falls short:

• Form caps are low: five published forms on the entry plan.
• Payment and save-and-continue features are not ticked on the entry plan.
• A smaller company with a smaller ecosystem than Jotform or Zoho.

Our take: The cheapest BAA in this list. Good for low volume, but check the form cap against your real paperwork count before you buy.

5. Zoho Forms: best for high volume and Zoho users

• Best for: Practices already on Zoho CRM or Zoho One, or groups with very high submission volume.
• Price: Premium is $90 a month billed yearly or $110 month to month, with 150,000 submissions a month and 100 users, per the Zoho Forms pricing page.

Zoho's HIPAA help article says HIPAA features are available only on Premium and Zoho One plans. The same article says you request the BAA by emailing Zoho's legal team.

Once a field is marked ePHI, Zoho restricts or warns on email, SMS and push notifications, integrations, exports and PDFs that use it. That is protective, but it changes how staff get alerted to new forms.

Where it falls short:

• A form can have at most 25 fields that are encrypted or marked ePHI. Long intake packets may need splitting.
• The BAA is by email request, not a click in the dashboard.

Our take: Excellent value at volume and a natural fit inside Zoho. For a five-form practice, it is more tool than you need.

6. Formstack: best for larger groups with approval workflows

• Best for: Multi-location groups that want forms, documents and e-signatures with approvals.
• Price: Forms starts at $83 a month billed yearly or $99 monthly (1 builder user, 25 forms, 1,000 submissions per form). Suite starts at $250 billed yearly or $299 monthly. The Formstack pricing page lists HIPAA as an add-on for both, without a public add-on price.

Formstack's HIPAA features page says it offers a Standard BAA or will evaluate custom BAA requests. It then creates a special account (or converts an existing one) with data encryption, SMTP options and field and folder security.

Where it falls short:

• You must talk to sales to price the HIPAA add-on, so the real monthly cost is unknown up front.
• One builder user on the entry Forms plan.

Our take: Worth a quote if you need document generation and approvals. For simple intake, Jotform or Cognito is easier to price.

7. FormDr: patient intake platform, quote only

• Best for: Practices that want intake forms plus two-way texting, reminders and EHR integration.
• Price: The FormDr pricing page shows no prices. Every tier is "Get Pricing" or "Talk to Sales".

FormDr's Complete Plan lists "HIPAA Compliant with BAA", unlimited forms and packets, automated appointment reminders and two-way texting. The Enterprise tier mentions a custom BAA and SLA.

Where it falls short:

• No public pricing. The FAQ also lists file conversion at $10 per page and training meetings at $250 each, while the plan header advertises free file conversions, so ask which applies to you.
• Annual subscriptions cancelled in the first six months are non-refundable, per the same FAQ.

Our take: More of a patient intake platform than a form builder. Get a written quote before comparing it to the tools above.

8. Gravity Forms: WordPress option, but no BAA from the vendor

• Best for: Practices on WordPress with a host that signs a BAA and a developer to set up encryption.
• Price: Basic license $59 a year (1 site), Pro $159 (3 sites), Elite $259 (unlimited), per the Gravity Forms pricing page.

Gravity Forms' own HIPAA documentation says that because it does not host or store your form data, it will not sign a BAA. It also says data is not encrypted at rest by default, and that encryption would need an add-on or custom code.

That means the compliance burden sits with your hosting company and your developer, not the plugin. Our guide to WordPress form plugins covers the wider plugin choice.

Where it falls short:

• No vendor BAA, no default encryption at rest.
• Form notifications go through your site's email setup, which you must secure separately.

Our take: Only choose this if a developer owns the whole stack, including a hosting BAA. Most small practices are better served by a hosted tool above.

9. Paperform: not for patient data yet

• Best for: Marketing forms that never collect health information.
• Price: Not listed here, because no plan includes a BAA.

Paperform's help center says plainly that it is not HIPAA compliant at this time. Its medical forms page adds that it does not sign BAAs today and that HIPAA support is planned for the first half of 2027.

Our take: Fine for event sign-ups or newsletter forms. Do not use it for intake, symptoms or appointment requests that include health details.

How to choose

• Choose Jotform if you want one builder for intake, consent, payments and internal forms, and can budget about $99 a month.
• Choose Cognito Forms if your volume is high or unpredictable and you want unlimited entries.
• Choose IntakeQ if you are a solo or small therapy practice and mostly need intake paperwork and e-signatures.
• Choose HIPAAtizer if you have five or fewer forms and want the lowest monthly cost with a BAA.
• Choose Zoho Forms if you already run on Zoho or need very high submission limits.
• Skip Gravity Forms and Paperform for PHI unless a developer owns the full WordPress stack (Gravity) or Paperform's planned HIPAA support ships.

Whatever you pick, the form is only one part of the website. If you want help connecting it to a site built for patients, see our healthcare web design services. Our HIPAA checklist for marketing vendors helps you vet the rest of your stack, and our pricing breakdown shows the full cost by plan.

Frequently asked questions