This article is part of our Website Stack Guides: CMS, website builders, hosting and forms compared, with prices checked on vendor pages. Want to know where your site stands? Get a free 20–30 page website audit within 24 hours.
Pick Jotform if you want the biggest template library and a self-serve BAA on the Gold plan at $99 a month billed yearly. Pick Cognito Forms if you want unlimited entries and a one-click BAA on Enterprise at $129 a month billed yearly. Pick Formstack only if you need document generation and approval workflows and are happy to get a sales quote for its HIPAA add-on.
All three sign a BAA on the right plan. None of them makes your practice compliant by itself: HHS says business associates are directly liable for certain provisions, but the covered entity keeps its own duties. This is not legal advice.
At a glance
| Jotform | Formstack | Cognito Forms | |
|---|---|---|---|
| Plan that includes the BAA | Gold or Enterprise | Forms or Suite plus HIPAA add-on | Enterprise |
| Price of that plan | $99/mo billed yearly ($1,188/yr), $129 monthly | Forms $83/mo billed yearly or $99 monthly, plus add-on (price not listed) | $129/mo billed yearly, $174 monthly |
| How you get the BAA | Enable HIPAA features, then "Sign BAA" in Data page | Standard BAA via Formstack, or custom BAA review | Owner signs in Plan & Billing |
| Submissions | 10,000 a month on Gold | 1,000 per form on Forms | Unlimited entries on Enterprise |
| Users | FAQ calls Enterprise the only multiuser plan | 1 builder user on Forms | 20 users, $5 per extra user |
| Free trial of HIPAA mode | No (free plan excludes HIPAA) | 14-day trial of Forms (HIPAA not stated) | No (BAA not available on a trial) |
Prices checked on vendor pricing pages on 2 November 2026.
Price and the plan you actually need
The headline "starting at" price on each pricing page is not the price of HIPAA mode.
Jotform. Its pricing page lists Bronze at $39 a month and Silver at $49 a month, but its FAQ says HIPAA compliance features are "available on Gold and Enterprise plans only." Gold lists at $1,188 a year ($99 a month) or $129 month to month. Jotform runs discounts on yearly upgrades, and plans renew at full price.
Cognito Forms. The Cognito pricing page lists Pro at $19 and Team at $39 a month billed yearly, but HIPAA appears only on Enterprise: $129 a month billed yearly or $174 monthly. Cognito's HIPAA guide says there is no extra cost for the BAA beyond that subscription.
Formstack. The Formstack pricing page lists Forms at $83 a month billed yearly or $99 monthly, and Suite at $250 or $299. In its feature comparison, "Match HIPAA and compliance requirements" is marked as an add-on for both, with no price shown. You need a sales conversation to know the total.
Verdict: Cognito and Jotform are both transparent. Formstack is the hardest to budget.
Getting the BAA signed
Jotform uses an upgrade wizard. Its help guide on enabling HIPAA features says the HIPAA environment is available to eligible Gold and Enterprise customers. After that, a Covered Entity clicks Sign BAA on the Data page, and the signed copy arrives by email.
Cognito Forms is the simplest. An owner with authority to sign contracts opens Plan & Billing, clicks "Sign our BAA", signs, and can download a PDF. You can also exit the BAA from the same screen.
Formstack is more hands-on. Its HIPAA features page says you can accept its Standard BAA or ask it to evaluate a custom BAA. Formstack then creates a special account, or converts an existing one, with HIPAA settings.
Verdict: If your attorney wants to redline the BAA, Formstack is the only one of the three that says it will review custom BAA requests. Otherwise, Cognito is fastest.
Security settings you get in HIPAA mode
Jotform says its HIPAA features include encryption, auditing and PHI segmentation, per the pricing FAQ. Its HIPAA page says form data is encrypted automatically for HIPAA accounts.
Cognito Forms encrypts all forms at rest after the BAA, including file uploads. It switches on guest access, which requires authentication for workflow and save-and-resume links. Its guide also tells you to mark PHI fields as protected so they are not sent in email notifications.
Formstack lists data encryption, SMTP options, and field and folder security for HIPAA accounts. The same page mentions user-level permissions and audit logging.
Verdict: All three cover encryption. Cognito is the most explicit about email notifications, which is where many small offices slip. HHS says the Privacy Rule allows email with patients only with reasonable safeguards, so check how each tool's notifications behave before launch.
Limits that bite a busy practice
- Jotform Gold: 10,000 submissions a month, 100 forms, 100,000 stored submissions and 100 GB of uploads, per the pricing page's plan data. The FAQ warns that if you exceed total submission storage, the oldest response is deleted to make room. Export and purge on a schedule.
- Cognito Enterprise: unlimited entries, 20 users and 100 GB of storage. Extra storage is $25 a month per 50 GB.
- Formstack Forms: 25 forms, 1,000 submissions per form, 2 GB storage and one builder user. Suite raises that to 100 forms, 5,000 submissions per form and 3 users.
Verdict: For a busy multi-provider clinic, Cognito's unlimited entries are the least likely to surprise you. For a small practice with a few intake forms, Jotform Gold's limits are generous.
Integrations: where the data goes next
A BAA with your form vendor covers that vendor. It does not automatically cover the spreadsheet, CRM or storage app you send submissions to.
HHS's cloud guidance says a cloud provider that stores or processes ePHI for you is a business associate, even if it only holds encrypted data and has no key. So if Jotform pushes intake data into Google Sheets, or Formstack sends it to a CRM, ask whether you have a BAA with that second company too.
Cognito's BAA terms say Cognito will hold its own subcontractors to substantially the same terms. That covers Cognito's vendors, not the apps you choose to connect. Before you switch on any integration, list every place a submission lands and confirm each one.
Verdict: Keep integrations to a minimum in HIPAA mode. The fewer places PHI travels, the fewer contracts you need to manage.
Templates and ease of use
Jotform has the broadest set of healthcare templates of the three, including counseling intake, mental health intake and consent forms on its HIPAA page. Formstack's strength is documents and e-signatures in its Suite plan. Cognito sits in between: fewer healthcare templates, with workflow and approvals included from the Team plan up.
If your team is non-technical and starts from scratch, Jotform's templates save the most setup time. If you need a branded PDF packet generated from each submission, look at Formstack Suite.
Which should you choose
- Choose Jotform if you are a small or mid-size practice that wants templates, one login and a clear $99 a month (billed yearly) budget.
- Choose Cognito Forms if you have several staff, high or unpredictable volume, or want the fastest BAA signing.
- Choose Formstack if you need document generation, approvals or a negotiated BAA, and can wait for a quote.
- Choose none of them if you are a solo therapist who only needs intake paperwork: a clinical tool like IntakeQ may cost less. See our list of HIPAA-ready form builders and the full pricing breakdown.
The form tool is only part of the job. The page it sits on, the thank-you message and your analytics tags matter too. Our healthcare web design team builds patient-facing sites for medical practices and therapy practices. For therapists, our post on HIPAA-friendly forms and scheduling covers booking too.
Frequently asked questions
Which is cheapest for HIPAA: Jotform, Formstack or Cognito?
Jotform Gold is the cheapest of the three with a public price, at $99 a month billed yearly. Cognito Enterprise is $129 a month billed yearly. Formstack's total is unknown until you get a quote for the HIPAA add-on. Prices were checked on 2 November 2026.
Can I try HIPAA mode before paying?
Not on Jotform or Cognito. Jotform's free Starter plan excludes HIPAA features, and Cognito says the BAA is not available on a trial. Jotform's pricing page does offer a 30-day money-back guarantee. Formstack offers a 14-day trial of Forms, but its page does not say whether HIPAA features are included.
Does signing the BAA make my forms HIPAA compliant?
No. The BAA is a contract that sets out how the vendor protects PHI. Your practice still needs its own safeguards, staff training and risk analysis. This is not legal advice.
Can I switch from Jotform to Cognito later?
Yes, but plan for it. Cognito's guide says that when you copy forms into a HIPAA organization, some settings are disabled until you re-enable them and entry data does not copy. Export your old submissions before you cancel.
