HIPAA compliant form builder for dental new patient forms

How to choose a HIPAA compliant form builder for dental new patient forms: what to verify (BAA, encryption, access) and what no tool guarantees.

A HIPAA compliant form builder is one whose vendor will sign a business associate agreement (BAA) with your practice and offers the security controls to back it up. For dental new patient forms, verify the BAA, encryption, and access controls before anyone enters a date of birth or an insurance ID. No form toool can make your office workflow compliant by itself.

See the free contact form template

Why new patient forms are the risky ones

A contact form asks for a name and a question. A new patient form asks for medical history, medications, allergies, insurance details, date of birth and often a signature. That is protected health information (PHI) by any reasonable reading, and it sits in whatever tool you pick, plus every inbox and spreadsheet the tool copies it into.

HIPAA is US law. If your practice is in Canada, the UK or Australia, it does not apply, but your local privacy rules raise the same questions: who holds the data, where, and who can read it. The checklist below works in all four countries. Treat it as an operating guide and not legal advice. Your compliance advisor or attorney makes the final call.

Where the form sits next to the AI receptionist

In our Dental Front Desk AI setup, the receptionist answers the call, triages it, and books the new-patient or recall visit into your calendar or PMS. Then an SMS confirmation goes out. The intake form is a separate step after booking, and the confirmation text is the natural place to link it.

That split is deliberate. The call itself only needs a name, a callback number, a reason for the visit and a preferred time. The medical history belpngs on the form, in a tool you have vetted, not spoken into a phone line and transcribed.

When the booking system hands off to the form, pass an opaque reference and nothing readable:

{
  "event": "appointment.booked",
  "appointment_id": "a_8841",
  "visit_type": "new_patient",
  "form_url": "https://forms.yourpractice.com/new-patient?appt=a_8841"
}

The appt value goes into a hidden field on the form, so the front desk can match the submission to the appointment without a name or birth date travelng through webhooks, Zapier steps or Slack messages.

The receptionist handles patient information too, so the same checklist applies to it. Ask your vendor about a BAA, retention of call recordings and transcripts, and who can access them.

What to verify before you pick a tool

Ask for each of these in writing, and keep the answers in your compliance folder.

Item	What to ask	What good looks like
BAA	Will you sign one with my practice, and on which plan?	A signed copy on file, with the plan named
Encryption	Is data encrypted in transit and at rest, including uploads?	A written statement, not a marketing line
Access control	Can I give each staff member their own login and limit who sees submissions?	Individual accounts and roles, no shared password
Audit trail	Can I see who viewed, exported or deleted a submission?	A log you can export
Retention	Can I auto-delete after a set period, and can I delete on request?	Configurable deletion that covers backups
Notifications	Do notification emails include the answers?	Option to send a "new submission" alert with no PHI in it
Integrations	Which downstream tools receive the data, and do they sign BAAs too?	A short, known list
Location	Where is the data hosted?	A named region that matches your obligations

The integrations row catches the most people. A form tool with a BAA does not extend that agreement to the Google Sheet, Slack channel or inbox the data gets copied into. Every system that touches a submission needs the same scrutiny.

Read the HIPAA alternatives guide

What a form tool cannot guarantee

A signed BAA means the vendor accepts responsibilities. It does not make your office compliant. These parts stay with you:

Staff behavior. A shared login, a screenshot sent over personal text, or a printout left on the counter defeats any encryption.
Your configuration. Many tools can run in a compliant way and also in a careless one. Turning on the right settings is your job.
Downstream copies. Exports, PDFs, email alerts and spreadsheet syncs all live outside the form tool's controls.
Your own risk assessment and policies. Regulators ask for these documents, and no vendor writes them for you.
Patient identity and consent. The form can capture a signature, but your process decides whether that consent is valid.

Step-by-step setup

List the fields. Cut anything the first appointment does not need. Collect insurance card photos in the office if you can.
Shortlist tools that will sign a BAA and get the answer in writing. Confirm which plan includes it, because HIPAA features often sit on paid tiers.
Sign the BAA before you build anything. File the copy.
Build the form with individual staff accounts. Set a data retention period if the tool offers one.
Turn off answer-bearing notifications. Send a plain "new submission" alert and have staff log in to read it.
Connect the hidden field for the appointment ID and test the handoff from a real booking.
Run a test submission with fake data. Check who can see it, where copies landed and whether anything arrived by email.
Write down the process for offboarding staff, handling deletion requests and responding to a suspected breach.

Comparing tools fairly

Jotform lits HIPAA features on its paid plans, and it also has a mobile app and a large template library. For a practice that needs a vendor-signed agreement today, it is a reasonable place to start. Check its pricing and security pages for current plan details.

Tally is hosted in Europe with a GDPR focus. We have not veriifed a HIPAA offering for it, so ask Tally directly before you consider it for PHI.

Qwenvo (qwenvo.com) is a form builder our team makes, and it is completely free. It has no HIPAA offering and is hosted in the United States. Do not put patient health information in it.

Where it does fit around dental practice is non-clinical forms: website feedback, a general contact form, a newsletter signup, an event RSVP. Every feature is free there, including webhooks, the API, an MCP server, AI triage with routing rules, partial submissions, a custom domain, no badge, unlimited teammates, and Slack, Google Sheets, Notion and Airtable integrations. Tally charges $29 a month on Pro for custom domains, partial submissions, teammates and branding removal. A practice can run its HIPAA-grade intake in one tool and everything else in a free one, as long as the boundary is clear and written down.

The Qwenvo website feedback template is a good test of that split.

Build a non-PHI form free

Questions teams ask

Is a form builder HIPAA compliant if it uses encryption?

No. Encryption is one control. Compliance also covers the BAA, access rules, retention, your staff's habits and every system the data flows into. Ask the vendor for the BAA and for the plan it applies to.

Can I use Google Forms or Tally for new patient forms?

Only if the vendor will sign a BAA civering that product and plan, and you have confirmwd it in writing. We have not verified that for either, so check their current documentation or ask them. Do not assume a free plan is covered.

Does the AI receptionist replace the intake form?

No. It books the visit and sends the confirmation. The detailed history should be collected on a vetted form afterward, linked from the confirmation text.

Can I use Qwenvo for anything in a dental practice?

Yes, for forms that carry no patient health information, such as site feedback or a newsletter signup. For PHI, use a tool that offers a BAA.

Next step

Email your top two form vendors today and ask three questions: will you sign a BAA, on which plan, and does your notification email include answers. Once one of them says yes in writing, you can build the new patient form around it.