HIPAA Compliant Survey Tools: Which Sign a BAA

HIPAA compliant survey tools are the ones whose vendor signs a business associate agreement (BAA) for the account you use: SurveyMonkey on HIPAA-enabled Enterprise accounts, Qualtrics for covered entity customers, Jotform, Typeform, Cognito Forms and Formstack on named plans, and Google Forms and Microsoft Forms inside Google Workspace and Office 365. SurveyMonkey puts it plainly: it "only permits PHI to be collected by regulated entities if it is done through a 'HIPAA-enabled account' with a business associate agreement (BAA) in place" (SurveyMonkey). For lead and intake forms that come from your ads, Curve Forms runs under the BAA Curve Compliance signs on every plan. Curve checked each vendor's own page on October 26, 2026.

Book a call. A survey tool's BAA covers the answers it stores, not the ad pixels on the page around it. Curve Compliance hosts HIPAA intake and lead forms under its BAA, sends each conversion to your ad platforms server-side, and strips PHI before data reaches an ad platform. Curve's team does the setup. Book a call with Curve.

Which survey tools sign a BAA?

Each row comes from the vendor's own page, fetched October 26, 2026. "Specific plans" means the vendor offers its BAA only on the plans or products it names.

Tool	Signs a BAA?	Plans or terms	How you get it	Source
SurveyMonkey	Specific plans	HIPAA-enabled accounts, available only on Enterprise	Contact sales, or your Customer Success Manager on Enterprise	SurveyMonkey Help
Qualtrics	Yes	Covered entity customers that allow Qualtrics to process PHI; the page names no plan	Through Qualtrics	Qualtrics support
Jotform	Specific plans	Gold and Jotform Enterprise, with HIPAA compliance features enabled	Sign the BAA from the Data page	Jotform help; BAA steps
Typeform	Specific plans	Enterprise or Growth Custom plans	Through Typeform	Typeform help
Cognito Forms	Specific plans	Enterprise plan, not a trial	Through Cognito Forms	Cognito Forms
Formstack	Specific plans	Formstack Forms HIPAA plans	Formstack's Standard BAA, or Formstack reviews a custom BAA	Formstack; data security
Google Forms	Specific plans	Google Workspace accounts; Forms is covered within Google Drive	An administrator accepts the BAA in the Admin console	Google Workspace Help; covered services
Microsoft Forms	Specific plans	Office 365 Commercial and GCC, where Forms is an in-scope service	By default, through Microsoft's Online Services Data Protection Addendum	Microsoft Learn

Tool names link to their BAA Directory entries where one exists, with the vendor's own words. For form builders compared on intake features, see form builders that sign a BAA.

SurveyMonkey and Qualtrics, in their own words

• SurveyMonkey plan. "Enterprise Feature: HIPAA compliant accounts are only available to customers on Enterprise." SurveyMonkey says it "offers a standard form BAA which meets the requirements of HIPAA," and you contact it to turn on HIPAA features (SurveyMonkey).
• No going back. "Once an account is HIPAA-enabled, it cannot be reverted to a non-HIPAA account." Surveys can move to a regular account, but SurveyMonkey warns that "regular accounts are not covered by a BAA" (SurveyMonkey).
• How to collect. "If you collect PHI in your survey, we recommend that you use a Web Link Collector." SurveyMonkey does not recommend email invitation collectors for PHI, because when respondents can edit their answers, a forwarded link could let someone else view a response (SurveyMonkey).
• Qualtrics. Qualtrics says "Individual tools are not HIPAA compliant or non-compliant," and that "we sign BAAs with our customers that are covered entities that allow us to process PHI" (Qualtrics).

Form builders that run surveys

• Jotform. "If you're a Covered Entity customer of Jotform that has enabled HIPAA compliance features in your account, you can request a BAA signed by Jotform." The HIPAA environment "is available as an upgrade for eligible customers on the Gold subscription and on Jotform Enterprise" (Jotform; Jotform).
• Typeform. Typeform says "we can currently provide a BAA for customers on our Enterprise or Growth Custom plans" (Typeform).
• Cognito Forms. "Your organization must be on the Cognito Forms Enterprise plan (and not a trial) in order to enter into a BAA." Cognito names "patient satisfaction surveys" among the medical forms its BAA supports (Cognito Forms).
• Formstack. Its HIPAA forms page lists "patient registrations, satisfaction surveys, and more," and says "Obtain consent with Formstack's Standard BAA, or let us evaluate your custom BAA requests" (Formstack).
• Google Forms. "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services," and "Third-party applications including add-ons are not included in the Included Functionality covered by the BAA," which matters for Forms add-ons (Google).
• Microsoft Forms. Microsoft's BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA," and Forms is in scope for Office 365 Commercial and GCC. Microsoft adds that "using Microsoft services doesn't on its own achieve HIPAA compliance" (Microsoft).

Patient feedback surveys vs intake forms

A survey vendor is a business associate when it "creates, receives, maintains, or transmits protected health information" for a covered entity (45 CFR 160.103). A satisfaction survey sent to your own patients, tied to their visits, often holds PHI. HIPAA's list of health care operations starts with "Conducting quality assessment and improvement activities" (45 CFR 164.501), which is why clinics run these surveys, and why the tool needs a BAA.

A survey set to anonymous is not automatically outside HIPAA. SurveyMonkey's Anonymous Responses option "lets you choose whether or not to track and store identifiable respondent information," yet "SurveyMonkey records respondent IP addresses in backend logs and deletes them after 13 months," and Web Links record IP addresses by default (SurveyMonkey). See whether IP addresses are PHI and the 18 HIPAA identifiers.

Intake forms and eligibility quizzes are different: they collect new patients' details, often right after an ad click. Those belong in a form tool hosted under a BAA, set up so that nothing from the answers reaches an ad platform. Whether a given survey holds PHI depends on what it asks and who it goes to, so talk to your counsel.

Surveys, quizzes and your ads

Clinics often put a survey or quiz on a landing page and send ad traffic to it. The survey tool's BAA covers the responses it stores. It does not cover an ad pixel on that page, which sends data to a different company, and Curve's BAA Directory lists Meta and Google Ads as not signing a BAA. Count a completed survey as a neutral conversion with no answers attached; see which ad platforms sign a BAA and what counts as PHI on a website.

How Curve Compliance helps

For forms that sit between an ad and a booking, Curve Forms is hosted by Curve under the BAA it signs on every plan. It runs guided flows with one step per card and a progress bar, logic that shows or hides fields based on earlier answers, screening outcomes by age, service area or insurance with their own end screens, and separate checkboxes for privacy consent and marketing consent. Every lead lands in the Leads inbox with its UTMs and ad click ID, and a step-by-step funnel shows where people drop off.

Form events reach Meta, Google Ads and your other destinations server-side, and form answers are never sent; screened-out submissions send no conversion, so the platforms learn from eligible leads. Across the rest of your site, Curve replaces browser ad pixels with one script, gives each platform a fixed list of fields, keeps contact identifiers off by default on Meta, Google Ads and TikTok, and strips PHI before data reaches an ad platform. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: SurveyMonkey HIPAA; SurveyMonkey anonymous responses; SurveyMonkey Terms of Use; Qualtrics data security and privacy; Jotform HIPAA; Jotform BAA; Typeform BAA; Cognito Forms HIPAA; Formstack HIPAA forms; Formstack data security; Google Workspace HIPAA; Google covered services; Microsoft HIPAA and HITECH; 45 CFR 160.103; 45 CFR 164.501.

Frequently Asked Questions

Which survey tools are HIPAA compliant?

Tools whose vendor signs a BAA for your account: SurveyMonkey on HIPAA-enabled Enterprise accounts, Qualtrics for covered entity customers, Jotform, Typeform, Cognito Forms and Formstack on named plans, and Google Forms and Microsoft Forms in Google Workspace and Office 365 (SurveyMonkey; Qualtrics; Google; Microsoft). Set the tool up within that BAA before collecting PHI.

Is SurveyMonkey HIPAA compliant?

It can be used in a HIPAA compliant way on an Enterprise account with HIPAA features turned on and a BAA in place. SurveyMonkey only permits regulated entities to collect PHI through a HIPAA-enabled account with a BAA (SurveyMonkey).

Is Qualtrics HIPAA compliant?

Qualtrics says individual tools are not HIPAA compliant or non-compliant, and that it signs BAAs with covered entity customers that allow it to process PHI (Qualtrics). Ask Qualtrics which products your BAA covers.

Is SurveyMonkey confidential?

You choose. Its Anonymous Responses option controls whether identifiable respondent information is tracked and stored, but SurveyMonkey still keeps respondent IP addresses in backend logs for 13 months, and Web Links record IP addresses by default (SurveyMonkey). For PHI, use a HIPAA-enabled account with a BAA (SurveyMonkey).

Which company owns SurveyMonkey?

SurveyMonkey's Terms of Use say customers in the USA contract with SurveyMonkey Inc., customers in Brazil with SurveyMonkey Brasil Internet Ltda., and everyone else with SurveyMonkey Europe UC (SurveyMonkey Terms of Use).

What online platforms are HIPAA compliant?

Ones whose vendor signs a BAA for the plan you use, set up within it. Curve's HIPAA compliant software list sorts the tools Curve has checked by category, and the BAA Directory quotes each vendor.

Which apps are HIPAA compliant?

An app is usable for PHI when its vendor signs a BAA with you for that app and you configure it the way the BAA expects. Consumer apps and ad platforms often do not; see the HIPAA compliant software list and which ad platforms sign a BAA.

Is Google Forms HIPAA compliant?

It can be, inside Google Workspace, once an administrator accepts Google's BAA; Google lists Forms within Google Drive on its covered services, and add-ons are not covered (Google; covered services).

Talk to Curve Compliance

Book a call. Keep patient feedback in a survey tool that signs a BAA. For the forms between your ads and your bookings, Curve Forms and Curve's server-side tracking run under the BAA Curve Compliance signs on every plan, with PHI stripped before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.