Is SurveyMonkey HIPAA compliant? Does it sign a BAA?
The answer
Signs a BAA on specific plans
Yes, for Enterprise customers. SurveyMonkey offers a BAA to Enterprise customers and only permits PHI in a HIPAA-enabled account with a BAA in place.
Forms and landing pages. Checked on the vendor's own pages on .
Collecting patient details in a form? Curve Forms are HIPAA-hosted intake and lead forms with the ad that brought each person attached, covered by Curve Compliance's BAA on every plan. Book a call
On this page
What SurveyMonkey says
“Yes, SurveyMonkey offers a business associate agreement (BAA) to Enterprise customers.”
“SurveyMonkey only permits PHI to be collected by regulated entities if it is done through a “HIPAA-enabled account” with a business associate agreement (BAA) in place.”
“SurveyMonkey offers a standard form BAA which meets the requirements of HIPAA.”
What the BAA covers and excludes
Excludes or limits, in SurveyMonkey's words:
- "we do not permit users to store PHI in regular accounts, and regular accounts are not covered by a BAA"
What this means for ad tracking
Patient surveys, intake questions and feedback forms often sit one click from an ad, and the answers can name a condition, a treatment or a visit.
SurveyMonkey's BAA covers HIPAA-enabled accounts. It says regular accounts are not covered by a BAA, and for surveys that collect PHI it recommends a Web Link Collector over an Email Invitation Collector (SurveyMonkey).
A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing a BAA, so a completed survey you count as a conversion should reach them with no answers attached. Our guides to HIPAA compliant survey tools and HIPAA-compliant form builders compare the options.
Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.
A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare form builders, see our guide to HIPAA compliant forms.
How Curve helps
- Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep SurveyMonkey for what it does well.
- Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
- Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
- Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
- Event Logs show what Curve sent to each platform and what the platform accepted.
- Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Does SurveyMonkey sign a BAA?
Yes, for Enterprise customers. In SurveyMonkey's words: “Yes, SurveyMonkey offers a business associate agreement (BAA) to Enterprise customers” (SurveyMonkey). We checked SurveyMonkey's own pages on October 26, 2026.
Is SurveyMonkey HIPAA compliant?
SurveyMonkey says regulated entities may collect PHI only through a HIPAA-enabled account with a BAA in place, and that once an account is HIPAA-enabled it cannot be reverted to a non-HIPAA account (SurveyMonkey).
How do I get a BAA from SurveyMonkey?
SurveyMonkey says to contact its sales team, and that existing Enterprise customers can contact their Customer Success Manager (SurveyMonkey). It offers “a standard form BAA which meets the requirements of HIPAA” (SurveyMonkey).
What does Curve Compliance do for ad tracking?
Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.
Sources
- SurveyMonkey, HIPAA-Compliant Surveys & Forms, FAQ: Does SurveyMonkey offer a BAA?
- SurveyMonkey Help Center, HIPAA Compliance and SurveyMonkey
Last checked . Vendors change their plans and terms, so confirm the current terms with SurveyMonkey before you send it patient data.
Related tools
- Does Typeform sign a BAA?Signs a BAA on specific plans. Enterprise and Growth Custom plans.
- Does Jotform sign a BAA?Signs a BAA on specific plans. Gold and Enterprise, with HIPAA features enabled.
- Does Google Forms sign a BAA?Signs a BAA on specific plans. Google Workspace accounts, after an administrator accepts Google's BAA.
- Does Microsoft Forms sign a BAA?Signs a BAA on specific plans. Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum.
- Does Wufoo sign a BAA?No public statement. No Wufoo BAA statement found; PHI barred without a separate BAA.
- Does Qualtrics sign a BAA?Signs a BAA. On request, for customers who are covered entities.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
- Does Curve Compliance sign a BAA?Signs a BAA. Every plan: Compliance, Growth and Enterprise.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call