HIPAA Compliant Forms: Form Builders That Sign a BAA

HIPAA compliant forms rest on three things: a business associate agreement (BAA) with every vendor that receives the answers, submissions stored and emailed only with vendors that have signed one, and form answers kept out of the ad pixels and tags on the page. Cognito Forms, Formstack, Jotform and Typeform each say they sign a BAA on specific plans, and Gravity Forms says it will not. Curve Forms from Curve Compliance is a form builder hosted by Curve under a BAA signed on every plan, so a submission never passes through a third-party form tool, each lead arrives with its ad and campaign attached, and the conversion reaches Meta and Google Ads server-side without the answers.

Book a call. Curve Compliance hosts your intake and lead forms, attaches the ad and campaign to every lead, sends each conversion to Meta and Google Ads server-side, and signs a BAA on every plan. Book a call with Curve.

What makes a web or intake form HIPAA compliant

Healthcare forms often ask about symptoms, treatments or insurance. The same rules apply to HIPAA compliant online forms, web forms on your own site and intake forms for new patients. Three things decide whether the answers stay protected.

1. A BAA with the form vendor. A form vendor that stores answers on your behalf needs a signed BAA before patient data flows. Formstack puts it this way: "HIPAA compliance regulations require a written contract for every business associate." Most form builders sign only on certain plans, and some need HIPAA features switched on first, so check the plan you will actually buy.
2. Where submissions are stored and emailed. Answers rarely stay in one database. They go out in notification emails, spreadsheet exports and integrations with other tools. Each copy is another place the data lives, so each should sit with a vendor that has signed a BAA with you. Gravity Forms, for example, says it does not host or store your form data, and that the BAA conversation is one to have with your website host or data services provider.
3. Answers kept out of ad pixels and tags. A BAA with a form vendor covers the answers that vendor stores. It does not cover a Meta pixel or Google tag that fires when the form is submitted, and none of the ad platforms is a party to that BAA. The conversion should reach your ad platforms without the answers.

Which form builders sign a BAA, and on what terms

The table summarizes what each form builder says on its own pages, as recorded in Curve's BAA Directory with a quote and source link for each. The entries were checked between September 29 and October 1, 2026. Plans and terms change, so confirm with the vendor before you sign up.

Form builder	Signs a BAA?	Terms, as the vendor states them
Cognito Forms	Yes, Enterprise plan	Cognito Forms says your organization must be on its Enterprise plan, and not a trial, to enter into a BAA.
Formstack	Yes, HIPAA plans	Formstack says it offers its Standard BAA to Formstack Forms HIPAA plan customers and will evaluate custom BAA requests.
Gravity Forms	No	Gravity Forms says it will not sign a BAA because it does not host or store your form data, and points you to your website host or data services provider.
Jotform	Yes, Gold and Enterprise	Jotform says it offers HIPAA compliance features on the Gold plan and Jotform Enterprise, and that a covered entity that has turned them on can request a BAA signed by Jotform.
Typeform	Yes, Enterprise and Growth Custom	Typeform says it can provide a BAA for customers on its Enterprise or Growth Custom plans.
Unbounce	No public statement found	Unbounce's terms say that if you collect sensitive or personal information about identifiable people, you agree to do so only in line with applicable law. No BAA statement was found on its pages.
Google Forms, in Google Workspace	Yes, as a covered service	Google offers a HIPAA Business Associate Addendum for Google Workspace, and its list of covered services includes Google Forms as part of Google Drive.
Curve Forms	Yes, every plan	Curve Compliance signs a BAA on every plan. Forms are hosted by Curve, and the conversion tracking runs under the same BAA.

Jotform and HIPAA

Jotform says its HIPAA compliance features are offered on the Gold subscription and on Jotform Enterprise. Once they are turned on, a covered entity can request a BAA signed by Jotform, and you sign it from the Data page in your account. That BAA covers the answers Jotform stores. It does not reach a pixel on the page where the form is embedded. Is Jotform HIPAA compliant? goes deeper, and separate guides cover Gravity Forms, Typeform and Unbounce.

Google Forms

Google Forms and Google Sheets are on the covered list in Google's Workspace BAA. Google Ads and Google Analytics are separate products, and the Workspace BAA does not extend to them. See the Google Ads and Google Analytics 4 entries.

Curve Forms: forms hosted under Curve's BAA

Curve Forms is a form builder inside Curve Compliance. Forms are hosted by Curve, under the BAA Curve signs on every plan, so a submission never passes through a third-party form tool. Each submission is tracked like any other Curve event, and the visitor's ad and campaign are attached to the lead automatically.

1. Hosted by Curve. The form, its submissions and the conversion it creates stay with one vendor under one BAA.
2. The ad and campaign on every lead. Each lead arrives with the visitor's attribution, so you can see which ad and which campaign produced it.
3. Conditional logic. Show or hide fields, and route people to different outcomes, based on earlier answers. Build a stacked form or a guided flow with one step per card.
4. Embed code or a public URL. Use the script embed, which resizes itself, a basic iframe for locked-down CMS areas, or a public URL and QR code to share directly.
5. A leads inbox and email notifications. Every submission lands in the form's Leads inbox with the answers, the attribution and your team's notes. Notification emails go to the recipients you list, and Curve can also send notifications that carry no patient details and only link to the inbox.
6. A conversion that reaches Meta and Google Ads. Each submission fires a form event, and Curve's server-side forwarding sends it to Meta and Google Ads through your event mappings, like any other conversion. The form answers are never sent to the ad platforms.

Forms also come with design presets, a custom domain, a thank-you page and A/B experiments.

The ad tracking side: keeping answers out of pixels

A form submission is a lead conversion, so teams want it counted in Meta and Google Ads, usually through a pixel on the form page or the thank-you page. That is where answers can leak. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and a thank-you page pixel or a form integration can pass the form's context along with the conversion. None of those platforms is a party to your BAA with the form vendor.

Server-side tracking moves the conversion off the browser. Curve replaces the pixels with one script, and conversions leave from Curve's servers to Meta Conversions API, Google Ads, TikTok, Microsoft Advertising and LinkedIn. The Curve script does not read form fields on its own, and Curve sets up form events to send the milestone, "form submitted", never the answers. Events can use neutral names, so the conversion says that a form was sent, not what the form was about.

Each platform then gets only a fixed list of fields, and anything else is stripped before sending. For a form conversion, that looks like this:

Field	Sent to Meta	Sent to Google Ads
Event name and time	Yes	Yes, as a conversion action
The platform's own click ID	fbclid and Meta cookies	gclid, gbraid or wbraid
Page address	Site address only, no page path or query string	No
Email and phone	Off by default, SHA-256 hashed if enabled	Off by default, SHA-256 hashed if enabled
Page title, free text, form answers	Never	Never

Two more safeguards apply. Before a page address leaves the browser, the script redacts parts that look like contact, health, search or quiz data. At the moment of sending, any value that looks like an email address or a Social Security number is dropped wherever it appears. If an event arrives carrying PHI-like values, Curve flags it on Compliance Info so the field can be stopped at the source, and Event Logs show what Curve sent to each platform and what the platform accepted.

If you keep Jotform, Typeform or another builder under its own BAA, Curve carries the conversion to your ad platforms separately, under Curve's own BAA. The free compliance scanner lists the pixels and trackers on any page, and the Curve Compliance FAQ covers the tracking in more depth.

Book a call. Curve's team will go through what your form pages send to Meta, Google and TikTok with you, show what is likely to trigger a flag, and set up forms and server-side conversions that keep every campaign measured. Book a call with Curve.

How to choose a HIPAA compliant form builder

1. A BAA on your plan. Confirm the vendor signs a BAA on the plan you will buy, and whether HIPAA features must be turned on first.
2. Where answers live and travel. List the database, emails, exports and integrations, and check each has a BAA behind it.
3. What fires on the page. Scan the form page and the thank-you page for pixels and tags with the free scanner.
4. How the conversion reaches your ads. Look for server-side sending, a neutral event name and a fixed field list that leaves the answers out.
5. Attribution on each lead. Each lead should carry the ad and campaign that brought it in.
6. Logic, layout and install. Check for conditional logic, multi-step flows, and an embed or public URL.
7. Who does the setup. With Curve Compliance, Curve's team does the setup, typically live in about a week.

This is a practical checklist, not legal advice. Talk to your counsel about your own setup.

Frequently Asked Questions

What makes a form HIPAA compliant?

A signed BAA with the form vendor, submissions stored and emailed only with vendors that have signed one, and form answers kept out of ad pixels and tags. Curve Forms from Curve Compliance covers all three: forms hosted by Curve under a BAA signed on every plan, and conversions sent server-side without the answers.

Which form builders sign a BAA?

Based on each vendor's own pages: Cognito Forms (Enterprise, not a trial), Formstack (HIPAA plans), Jotform (Gold and Enterprise, with HIPAA features on), Typeform (Enterprise and Growth Custom) and Google Forms through the Google Workspace BAA. Gravity Forms says it will not, and no BAA statement was found for Unbounce. Curve Compliance signs a BAA on every plan.

Is Jotform HIPAA compliant?

Jotform says it offers HIPAA compliance features on the Gold subscription and on Jotform Enterprise, and a covered entity that turns them on can request a BAA signed by Jotform. That BAA covers what Jotform stores, not a pixel that fires when the form is submitted.

Is Google Forms HIPAA compliant?

Google offers a HIPAA Business Associate Addendum for Google Workspace, and its list of covered services includes Google Forms. Google Ads and Google Analytics are separate products, and the Workspace BAA does not extend to them.

Can I put a Meta pixel or Google tag on a HIPAA compliant form?

A pixel sends data from the visitor's browser straight to the ad platform, and the platform is not a party to your BAA with the form vendor, so a pixel on the form or thank-you page can pass the form's context along. Sending the conversion server-side, under a neutral name and without the answers, keeps the signal and leaves the answers out.

What is the best HIPAA compliant form builder for healthcare marketing?

For forms that feed ad campaigns, Curve Forms from Curve Compliance is built for it: hosted by Curve under a BAA on every plan, with the ad and campaign attached to every lead and the conversion sent to Meta and Google Ads server-side without the answers.

Can I embed a Curve form on my website?

Yes. The Publish screen gives you a script embed that resizes itself, a basic iframe for locked-down CMS areas, and a public URL with a QR code. It also shows whether Curve has seen traffic from the published form.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the setup, typically live in about a week. Book a call to get started.