Best HIPAA-Compliant Form Builders for Telehealth Intake

The best HIPAA-compliant form builder for telehealth intake is one that signs a business associate agreement (BAA) on the plan you will actually buy, runs multi-step flows that screen for eligibility, and gets each conversion to your ad platforms without the answers. Curve Forms from Curve Compliance is built for that funnel: forms are hosted by Curve under the BAA it signs on every plan, guided flows screen people out by age, service area or insurance, and form events reach Meta and Google Ads server-side without the answers. Most other builders below sign a BAA only on specific plans, and one says it will not.

Book a call. Curve's team will show you Curve Forms on your own intake funnel, from the screening questions to the conversion that reaches your ads. Book a Curve Forms demo.

What a telehealth intake funnel needs from a form builder

A telehealth intake form collects health information from the first screens: the reason for the visit, history, medications. If HIPAA applies to your business (see does HIPAA apply to cash-pay telehealth), the vendor that stores those answers needs a BAA. HHS says that when a covered entity uses a cloud service provider (CSP) "to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA" (HHS cloud computing guidance).

The Privacy Rule lets a covered entity allow a business associate to "create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information," documented in "a written contract or other written agreement or arrangement" (45 CFR 164.502(e)). That agreement is the BAA, and it heads the list of seven things a telehealth funnel needs from a form builder:

1. A BAA on the plan you would buy. Many builders sign only on certain plans, and some need HIPAA features switched on first.
2. Multi-step flows with logic. One question per screen, with the next question picked from the last answer. See how to build a telehealth intake funnel.
3. Eligibility screening. State, age and insurance questions early, and a clear end screen for people who do not qualify. See eligibility screening in intake forms.
4. File upload. For documents your clinicians ask for, such as an insurance card.
5. Embedding. A script, an iframe or a hosted link that works on the landing pages your ads point to.
6. Where submissions go. Answers travel on to emails, exports and your CRM, and each copy sits with a vendor that should have a BAA with you.
7. Ad conversion tracking that keeps answers out of ad platforms. A form vendor's BAA does not settle this, as explained below.

For what the form should ask, see what a telehealth intake form should ask. For the rules every intake form follows, see what makes an online intake form HIPAA compliant.

The form builders compared

Each row states what the vendor says about a BAA on its own pages, checked October 14, 2026. Terms change, so confirm before you sign up. Curve's guide to form builders that sign a BAA covers general-purpose forms.

Form builder	Signs a BAA?	Plan it names	Vendor source
Curve Forms	Yes. Forms are hosted by Curve under its BAA	Every plan	Curve BAA Directory entry
Jotform	Yes, once HIPAA compliance features are turned on	Gold and Jotform Enterprise	Jotform Help
Typeform	Yes	Enterprise or Growth Custom	Typeform Help Center
Formstack	Yes, its Standard BAA, or a custom BAA it evaluates	Formstack Forms HIPAA plans	Formstack; Formstack data security
Cognito Forms	Yes	Enterprise, not a trial	Cognito Forms Support
Formsort	Yes, "with enterprise clients"	Enterprise	Formsort plans and FAQ
Heyflow	Offers to sign one "when applicable"	No plan named on its help page	Heyflow Help Center
Gravity Forms	No	None; it points you to your website host or data services provider	Gravity Forms documentation

Each builder, in its own words

Curve Forms. The form builder inside Curve Compliance. Every form is hosted by Curve under the BAA Curve signs on every plan, so a submission never passes through a third-party form tool.

Jotform. Jotform says: "We are offering HIPAA compliance features on the Gold subscription and on Jotform Enterprise." Once they are on, you sign the BAA from the Data page (Jotform Help). More in is Jotform HIPAA compliant and its BAA Directory entry.

Typeform. Typeform says: "Typeform's data protection standards are HIPAA compliant and we can currently provide a BAA for customers on our Enterprise or Growth Custom plans." Those customers request it from its Sales team (Typeform Help Center). More in is Typeform HIPAA compliant.

Formstack. Formstack says it will "create a special account for you (or convert an existing account) with Forms features to support your HIPAA compliance obligations," and offers its Standard BAA or will evaluate a custom one (Formstack).

Cognito Forms. Cognito Forms says: "Your organization must be on the Cognito Forms Enterprise plan (and not a trial) in order to enter into a BAA" (Cognito Forms Support).

Formsort. Formsort says: "Yes, Formsort is HIPAA compliant and will sign a BAA with enterprise clients." It also says: "We store responder data in a secure S3 bucket for only three weeks from the time of submission, pending delivery to your integrations" (Formsort plans and FAQ). So plan where your answers land.

Heyflow. Heyflow's help center says: "Heyflow offers to sign a Business Associate Agreement (BAA) when applicable, as required under HIPAA." The page names no plan, so ask Heyflow how to request it and on which plan. It also says: "All data is hosted and processed exclusively in Europe" (Heyflow Help Center).

Gravity Forms. Gravity Forms says: "As we do not host or store your collected form data on your behalf, we will not sign any such agreements. This is a conversation to be had with your website host or data services provider" (Gravity Forms documentation). More in is Gravity Forms HIPAA compliant.

The part a form vendor's BAA does not reach: the ad pixel

A form vendor's BAA covers what that vendor stores. It does not cover a Meta pixel or Google tag on the same page, which sends data from the visitor's browser to the ad platform. HHS says tracking technologies on a regulated entity's unauthenticated page "that permits individuals to schedule appointments or use a symptom-checker tool without entering credentials may have access to PHI in certain circumstances." In its example, tracking technologies "might collect an individual's email address, or reason for seeking health care typed or selected by an individual" when someone makes an appointment, and then "the regulated entity is disclosing PHI to the tracking technology vendor, and thus the HIPAA Rules apply" (HHS bulletin on online tracking).

The HHS page notes that a June 20, 2024 court order vacated one part of the bulletin, on connecting an IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers (HHS bulletin). The intake example is about what a person types or selects, not that combination.

Ad platforms set their own rules too. Meta's Business Tools Terms have advertisers promise not to share data that "includes or is based on, directly or otherwise, health information," and say the names you choose for events and conversions "must not reflect, imply or be based on" that information (Meta Business Tools Terms). Curve's BAA Directory lists Meta and Google Ads as not signing a BAA. So ask any builder how the conversion reaches your ads: ideally a neutral event, sent server-side, with no answers attached. More in website forms to ad platforms: the safe path.

How Curve Forms helps

Curve Forms covers all seven needs in one product, with every form hosted by Curve under the BAA Curve signs on every plan:

1. BAA and hosting. Forms are hosted by Curve; submissions never pass through a third-party form tool.
2. Multi-step flows. Guided flows show one step per card with a progress bar, and logic shows or hides fields and routes people to different outcomes.
3. Screening. Screen people out by age (date of birth rules), service area (for example a state answer) or insurance, each with its own end screen. Screened-out submissions send no conversion to ad platforms, so the platforms learn from eligible leads.
4. File upload. PDF, JPG, PNG, WEBP, HEIC, DOC and DOCX.
5. Embedding. A script that resizes itself, an iframe, a hosted link, a QR code or a custom domain, in your colors, fonts and logo.
6. Where submissions go. The Leads inbox, with answers, UTMs, ad click ID, attribution and staff notes; notification emails with Reply-to set to the respondent, or a detail-free notification on request; and an Export API so a scheduled job on your side keeps your CRM current.
7. Ad conversion tracking. Form events (form started, step progress, form submission completed, lead qualified, lead converted) reach Meta, Google Ads and your other destinations server-side through your event mappings. Form answers, page titles and free text are never sent, and a step-by-step funnel shows where people drop off.

Add separate privacy and marketing consent checkboxes and a redirect to your booking or checkout page. Curve's team does the setup, and most customers are live in about a week. For how HIPAA applies to your own intake, talk to your counsel.

Sources, checked October 14, 2026: HHS bulletin on online tracking technologies; HHS guidance on HIPAA and cloud computing; 45 CFR 164.502; Meta Business Tools Terms; Jotform Help; Typeform Help Center; Formstack; Formstack data security; Cognito Forms Support; Formsort plans and FAQ; Heyflow Help Center; and Gravity Forms documentation.

Frequently Asked Questions

What is the best HIPAA-compliant form builder for telehealth intake?

One that signs a BAA on the plan you will buy, runs multi-step screening flows, and sends ad platforms a conversion without the answers. Curve Forms from Curve Compliance does all three, under a BAA Curve signs on every plan.

Which form builders sign a BAA for telehealth intake forms?

Per each vendor's own pages, checked October 14, 2026: Jotform (Gold and Enterprise, with HIPAA features on), Typeform (Enterprise or Growth Custom), Formstack (HIPAA plans), Cognito Forms (Enterprise, not a trial) and Formsort (enterprise clients). Heyflow says it offers one when applicable; Gravity Forms says it will not. Curve Compliance signs a BAA on every plan.

Does a form builder's BAA cover the Meta pixel on my intake page?

No. The BAA covers what the form vendor stores, while a pixel sends data from the browser to Meta. HHS says tracking on a HIPAA-regulated entity's page where someone books an appointment or types a reason for seeking care can disclose PHI (HHS bulletin).

Will Gravity Forms sign a BAA?

No. Gravity Forms says that because it does not host or store your form data, "we will not sign any such agreements" (Gravity Forms documentation).

Can a form builder screen out patients who are not eligible?

Yes, with logic that routes people by their answers. Curve Forms screens people out by age, service area or insurance, each with its own end screen, and sends no conversion for screened-out submissions.

Do form answers reach Meta or Google with Curve Forms?

No. Form events reach Meta, Google Ads and your other destinations server-side through your event mappings, and form answers, page titles and free text are never sent. Curve strips PHI before data reaches an ad platform.

Talk to Curve Compliance

Book a call. See Curve Forms with your own intake questions, or have Curve's team review your current intake funnel. Curve signs a BAA on every plan, and most customers are live in about a week. Book a Curve Forms demo.