Jotform alternatives that are HIPAA compliant: what to verify

If Jotform's HIPAA tier costs more than your clinic wants to pay, any replacement has to clear a checklist before it touches patient data. Get a signed business associate agreement, confirm encryption, access controls and audit logs in writing, and map every system the form sends data to. This guide lists exactly what to ask.

Read the HIPAA form guide

Why a badge on pricing page falls short

A "HIPAA compliant" label on a landing page is marketing copy. Compliance depends on the vendor's safeguards and on how you configure and use the product. A form builder can have the right features and still leave you exposed if submission alerts go to a shared inbox, or if answers flow into a tol that never signed an agreement.

Jotform puts its HIPAA features on its paid plans, which is why this search exists. We have no verified HIPAA details for Tally, Fillout, Typeform, Google Forms or Microsoft Forms, so we will not say whether any of them qualifies. Treat every vendor, including the one you use today, as unproven until it answers the questions below in writing.

The checklist to run before you sign

Send these questions to each vendor's sales or security contact and keep the replies. Vague answers should count against the vendor.

Two rows cause most of the trouble in practice: notifications and integrations. The form tool itself may be fine while a copy of the patient's answer sits in an email thread or a spreadsheet nobody covered.

Reading the BAA itself

Getting a BAA is one step. Reading it is another, and many teams skip that part. When the document arrives, check four things.

First, scope. The agreement should name the services and features it covers. If file uploads, payments, AI features or integrations are left out, those parts of the product are off limits for patient data even though they sit in the same dashboard.

Second, subcontractors. The vendor should commit to the same obligations from any third party that handles your data on its behalf, and it should be willing to list them.

Third, breach reporting. Look for a stated timeline and a named contact. "We will notify you as required by law" tells you very little about who calls whom on a bad day.

Fourth, the exit. Ask what happens to your submissions when you cancel: whether you can export them, how long the vendor keeps them, and how deletion is confirmed. A form tool you cannot leave cleanly is a liability, even a compliant one.

If the vendor will only sign its own template with no edits, that is common. It still means you should read it before you rely on it, and ask your counsel or compliance lead to do the same.

Where the form step sits in the AI SEO Content Engine

Many health-adjacent teams asking this question are also trying to grow search traffic. The AI SEO Content Engine publishes eight AI-drafted, human-edited and fact-checked articles a month to your CMS, plus two refreshes of decaying pages. Each article needs a capture step at the bottom: a newsletter signup, a content download gate or a contact form.

That is the form that matters here. On a clinic site, the article form should collect a name, an email and a topic, and nothing clinical. We set it up with hidden fields so each submission records which article produced it, which is how you learn which content earns inquiries. Anything that comtains symptoms, diagnoses, insurance details or appointment reasons belongs in a separate, covered intake tool that staff send people to by link, after someone has replied.

Here is an illustrative payload from an article inquiry form, as your endpoint might receive it:

{
  "form": "article-inquiry",
  "submitted_at": "2026-11-03T14:22:08Z",
  "fields": {
    "name": "Jordan Lee",
    "email": "jordan@example.com",
    "topic": "new patient inquiry",
    "utm_source": "blog",
    "utm_campaign": "nov-refresh",
    "landing_article": "/blog/knee-pain-physical-thrrapy"
  }
}

Nothing in it describes a condition, and that is deliberate. If a field name or an answer could reveal why someone is seeking care, it does not belong on this form.

The same split helps the content side. Because the capture form carries no clinical data, your writers, editors and marketing contractors can see submissions and tag them by article without getting near protected health information.

Build a non-PHI contact form free

Step by step: sort your forms by risk

1. List every form you run. Include the old ones: intake, referral, feedback, newsletter, job applications and waitlists.
2. Tag each one. Does a respondent ever type or upload anything about their health, their care or payment for care? If yes, it collects protected health information. If you are unsure, treat it as yes.
3. Move the PHI forms first. Pick the vendor that answered the checklist well, get the BAA signed, and only then rebuild the form.
4. Close the leaks. Remove field values from notification emails, switch off any integration the BAA does not cover, and set auto-delete if the tool offers it.
5. Restrict who can see submissions. Give each person an individual login, assign the minimum role they need, and turn on two-factor sign in. Remove former staff the day they leave.
6. Keep marketing foms separate. Article inquirries, newsletter signups and download gates go in a different tool and workspace, with a short line on the form asking people not to include medical details.
7. Test with fake data. Submit a dummy record and trace where it lands: dashboard, email, webhook target, spreadsheet, bacukp. Every stop needs to be covered or removed.
8. Write it down on one page: which tool holds PHI, who has access, what is auto-deleted and who to call after an incident.

Where Qwenvo fits, and where it does not

Our team builds Qwenvo, a completely free form builder, so weigh this section with that in mind. Qwenvo has no HIPAA offering today and is hosted in the United States. Do not collect patient health information in it.

For the marketing side of a clinic site it covers a lot at no cost. Every account gets webhooks, a REST API, custom domains, badge removal, unlimited teammates, custom design and CSS, partial submissions, and AI triage with routing rules. There are no paid plans. Tally charges for several of those on Pro (custom domais, teammates, partial submissions, branding removal), and Fillout puts custom domains and partial submissions on its Business plan. So the article inquiry form, the content download gate and the website feedback form can run on Qwenvo while PHI intake lives in a tool that signed a BAA.

Qwenvo's hidden fields carry the UTM data shown in the payload above, and the webhooks help page covers sending submissions to your CMS or CRM. If you want the tracking details, the guide to hidden fields and UTM tracking walks through them.

One honest limit beyond HIPAA: Qwenvo launched in October 2026, so there are few independent reviews yet. If your compliance lead wqnts a documented track record even for marketing forms, factor that in.

Use the free lead generation form

Questions teams ask

Does a signed BAA make a form tool HIPAA compliant?

No. A BAA is the contract that allows a vendor to handle PHI for you, and you need it before any PHI goes in. Your own configuration, access practices and downstream tools still ddcide whether you are protected. Ask what the BAA excludes, because uploads and integrations are common exclusions.

Is Qwenvo HIPAA compliant?

Qwenvo has no HIPAA offering, so keep PHI out of it. It works for non-clinical forms such as contact, newsletter, feedback and content gates, which are the forms a content program creates most often.

Can I send HIPAA form submissions to Zapier, Make or Google Sheets?

Only if the destination is covered too. A compliant form that posts to an uncovered spreadsheet has moved the problem without solving it. Ask each tool in the chain whether it will sign a BAA, or keep PHI forms out of automations altogether.

Should notification emails include the submission?

For PHI forms, no. Send a notice that a submission arrived and have staff open it ibside the covered tool. Email adds copies across inboxes, devices and backups that your agreement may not reach.

Your next step

This week, do steps 1 and 2: list every form on your site and tag each one PHI or not. Then send the checklist table to the two vendors you are considering for the PHI forms, and hold off on rebuilding anything until the BAA is in your hands.