On this page
Jotform offers a dedicated HIPAA environment on its Gold subscription and Jotform Enterprise, so the case for an alternative rests on plan fit, branding or ad tracking, not on a missing BAA (Jotform). Typeform, Cognito Forms, Formstack, Google Forms through Google Workspace and Curve Compliance's HIPAA intake forms are the usual shortlist. Curve Compliance checked every vendor page below on November 9, 2026.
Book a call. Running ads to a patient form? Curve Compliance hosts your intake forms under the BAA it signs on every plan, attaches the ad and campaign to every lead, and never sends form answers to ad platforms. Curve's team does the setup, typically live in about a week. Book a call with Curve.
Jotform alternatives that sign a BAA
Every form builder below offers a BAA, but on different plans and accounts. Check the plan you would actually buy.
| Form builder | What its own page says | Plan or account | Directory entry |
|---|---|---|---|
| Jotform | “The dedicated HIPAA environment is available as an upgrade for eligible customers on the Gold subscription and on Jotform Enterprise” (Jotform) | Gold or Enterprise; a Covered Entity that has enabled HIPAA features “can request a BAA signed by Jotform” (Jotform) | Jotform |
| Typeform | “we can currently provide a BAA for customers on our Enterprise or Growth Custom plans” (Typeform) | Enterprise or Growth Custom | Typeform |
| Cognito Forms | “Cognito Forms offers HIPAA compliance through business associate agreements” (Cognito Forms) | “Your organization must be on the Cognito Forms Enterprise plan (and not a trial) in order to enter into a BAA” (Cognito Forms) | Cognito Forms |
| Formstack | “Obtain consent with Formstack’s Standard BAA, or let us evaluate your custom BAA requests” (Formstack) | “Formstack Forms HIPAA plan customers” (Formstack) | Formstack |
| Google Forms | Google Drive, “including Google Docs, Google Forms,” is among the Workspace services included in Google's BAA (Google Cloud) | Google Workspace or Cloud Identity, after an administrator accepts the BAA (Google) | Google Forms |
| Curve Forms | Hosted by Curve under the BAA Curve signs on every plan; a submission never passes through a third-party form tool | Every Curve plan | Curve Forms |
For the wider field, see HIPAA compliant forms: form builders that sign a BAA. Weighing the two most common picks? See Jotform vs Google Forms for healthcare.
What "HIPAA forms" means: the BAA plus what the form sends
A form builder's BAA covers that vendor's handling of submissions. Each vendor then sets conditions on what else can touch the data. Jotform says that in its HIPAA environment it “will only allow certain widgets and integrations” (Jotform). Cognito Forms says “Email notifications should be reviewed to ensure they are HIPAA-compliant” (Cognito Forms). Google says “Third-party applications including add-ons are not included in the Included Functionality covered by the BAA” (Google). Formstack sets a 15-minute timeout for its Forms HIPAA plan users (Formstack).
Notifications, add-ons and integrations are where answers most often leave the form tool, so review each one before you switch builders. Whether a given form collects PHI depends on what it asks and who offers it, so talk to your counsel about your own forms. For a checklist, see what makes an online intake form HIPAA compliant.
Form answers and ad pixels
HHS gives a booking example that applies to forms too: “tracking technologies might collect an individual's email address, or reason for seeking health care typed or selected by an individual, when the individual visits a regulated entity's webpage and makes an appointment with a health care provider” (HHS). A pixel on the page that hosts the form, or on the thank-you page, reports to the ad platform that made it, and that platform isn't a party to your BAA with the form vendor.
- Keep pixels off form pages. That includes the thank-you page, which often names the service in its address.
- Keep answers out of redirects. A redirect address that carries answers can be read by any tag on the next page.
- Send the lead as a neutral event. Report a form submission or a qualified lead from a server, with a fixed list of fields and no answers.
For how tracking code picks this up, see what website tracking sends from a health site.
Screening and routing patients before they book
Many clinics use the form to decide who books: a minimum age, a service area or an accepted insurance. Curve Forms can screen people out by age (date of birth rules), service area (for example a state answer) or insurance, each with its own custom end screen, and screened-out submissions send no conversion to ad platforms, so the platforms learn from eligible leads. A crisis outcome has its own end screen and sends no conversion either.
Logic shows or hides fields based on earlier answers and routes people to different outcomes, and after submit you can redirect eligible people to a booking or checkout page. If that booking page is Calendly or Acuity, see Calendly vs Acuity for healthcare. For which fields to include, see the patient intake form template.
Five questions to ask before you switch
- Which plan carries the BAA? Typeform names Enterprise or Growth Custom, Cognito Forms names Enterprise and rules out trials, and Jotform names Gold and Enterprise (Typeform; Cognito Forms; Jotform). Compare the plan that carries the BAA, not the entry plan.
- What happens to your existing forms? Jotform says that when you enable its HIPAA environment, “all your data is migrated to the dedicated environment,” and its wizard lists widgets and integrations it finds unsuitable (Jotform). Cognito Forms says copied forms keep certain settings “but disabled until you re-enable them” (Cognito Forms).
- What do notification emails include? Check whether answers appear in the email your team receives, and whether you can switch to a notice without details.
- Where does the lead go next? A CRM, an EHR or a scheduler each needs its own BAA review, so list every system the submission reaches.
- How does the lead reach your ad reports? If the answer is a pixel on the thank-you page, plan a server-side event instead, so the ad platform learns about the lead without the answers.
How Curve Compliance helps
Curve Forms are HIPAA-hosted intake and lead forms. Every form is hosted by Curve, so a submission never passes through a third-party form tool, and submissions are stored under the BAA Curve Compliance signs on every plan. Each lead arrives in the Leads inbox with its answers, UTMs and ad click ID. Form events (form started, step progress, form submission completed, lead qualified and lead converted) reach Meta, Google Ads and your other destinations server-side through your event mappings, while form answers, page titles and free text are never sent.
Curve Forms include separate checkboxes for privacy consent and marketing consent, guided flows that show one step per card with a progress bar, and file uploads. They embed with a script that resizes itself, an iframe, a hosted link, a QR code or a custom domain, and you can brand them with your colors, fonts and logo. Curve is SOC 2 Type II, and its team does the setup, typically live in about a week. Book a call to see your intake form tracked from ad click to qualified lead.
Sources, checked November 9, 2026: Jotform How to Enable the HIPAA Environment and How to Receive a BAA; Typeform, Business Associate Agreement; Cognito Forms, HIPAA Compliance; Formstack HIPAA forms and data security; Google HIPAA Compliance with Google Workspace and Cloud Identity and HIPAA compliance on Google Cloud and Google Workspace; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
Frequently Asked Questions
What are the best Jotform alternatives for healthcare?
Typeform, Cognito Forms, Formstack and Google Forms inside Google Workspace each offer a BAA on specific plans or accounts (Typeform; Cognito Forms; Formstack; Google). If the form feeds your ads, Curve Forms are hosted by Curve under the BAA it signs on every plan and never send form answers to ad platforms.
Is Jotform HIPAA compliant?
Jotform offers a dedicated HIPAA environment on Gold and Enterprise, and a Covered Entity that has enabled HIPAA features can request a BAA signed by Jotform (Jotform; Jotform). See our Jotform verdict.
Can I use Google Forms instead of Jotform for patient forms?
Only inside Google Workspace after an administrator accepts Google's BAA. Google says “Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services,” and lists Google Forms within Google Drive among the services its BAA includes (Google; Google Cloud).
Does Typeform sign a BAA?
Yes, for customers on its Enterprise or Growth Custom plans (Typeform).
Does Cognito Forms sign a BAA?
Yes, on the Enterprise plan: your organization must be on Enterprise “(and not a trial)” to enter into a BAA (Cognito Forms).
Can form answers be sent to Meta?
They shouldn't be. Send a neutral form event instead: with Curve Forms, the form event reaches Meta through your event mappings while form answers, page titles and free text are never sent.
Which form builder is best for patient intake?
The one with a BAA on your plan, the logic your intake needs, and a clean path to your ad reports. Our guide to the best HIPAA-compliant form builders for telehealth intake compares them side by side.
Talk to Curve Compliance
Book a call. Want intake forms that keep answers away from Meta and Google but still credit every lead to its ad? Curve Forms are hosted by Curve under the BAA it signs on every plan, attach the ad and campaign to every lead, and send only neutral form events. Curve's team does the setup, typically live in about a week. Book a call with Curve.