On this page
The best Typeform alternatives for healthcare are form builders that sign a BAA on a plan you can use, such as Jotform, Cognito Forms, Formstack, Google Forms inside Google Workspace and Curve Compliance's HIPAA intake forms, because Typeform says it can “currently provide a BAA for customers on our Enterprise or Growth Custom plans” (Typeform). Plan fit is only half of the choice: the form also has to keep patient answers away from the ad pixels on the page. Curve Forms are hosted by Curve under the BAA Curve signs on every plan, and form answers are never sent to ad platforms.
Book a call. Want a Curve Forms demo, or a review of the intake funnel you run today? Curve Compliance hosts HIPAA intake forms under the BAA it signs on every plan and never sends form answers to ad platforms. Curve's team does the setup, typically live in about a week. Book a call with Curve.
Typeform alternatives that sign a BAA
Each row quotes the vendor's own page, opened November 9, 2026. Plans and terms change, so confirm the BAA in writing with the vendor before you collect patient answers.
| Form builder | BAA available? | What its own page says |
|---|---|---|
| Typeform | On the Enterprise or Growth Custom plans | “we can currently provide a BAA for customers on our Enterprise or Growth Custom plans” (Typeform; Directory entry) |
| Jotform | On the Gold subscription and Jotform Enterprise, with the HIPAA environment turned on | “The dedicated HIPAA environment is available as an upgrade for eligible customers on the Gold subscription and on Jotform Enterprise” (Jotform). A covered entity that has enabled the HIPAA features “can request a BAA signed by Jotform” (Jotform BAA; Directory entry) |
| Cognito Forms | On the Enterprise plan | “Your organization must be on the Cognito Forms Enterprise plan (and not a trial) in order to enter into a BAA” (Cognito Forms; Directory entry) |
| Formstack | On a Formstack HIPAA account | “Obtain consent with Formstack's Standard BAA, or let us evaluate your custom BAA requests” (Formstack; Directory entry) |
| Google Forms | Inside Google Workspace, after an administrator accepts Google's BAA | Google lists “Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides, and Google Vids)” among the Workspace services in its BAA (Google Cloud), and says “Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services” (Google Workspace; Directory entry) |
| Curve Forms | On every plan | Hosted by Curve under the BAA Curve signs on every plan; form answers are never sent to ad platforms (Curve Forms) |
For a wider list, see HIPAA compliant forms: builders that sign a BAA and the best HIPAA form builders for telehealth intake.
Where Typeform stands for patient forms
Typeform's help center says: “If your organization is an HIPAA Covered Entity, you may need to sign a Business Associate Agreement (BAA) for Typeform to process your data” (Typeform). On the Enterprise or Growth Custom plans, that BAA is available on request from Typeform's sales team. On any other plan, Typeform points you to a contact form, so patient answers should wait until a BAA is signed. For the full verdict, see is Typeform HIPAA compliant.
A BAA settles who may hold the answers. It does not decide what the rest of the page sends, and it does not cover any other vendor. Whether your practice is a covered entity, and what your state adds on top of HIPAA, are questions to talk to your counsel about before you move forms.
One question at a time: guided flows
If your team likes forms that ask one question per screen, keep that pattern when you switch. Curve Forms can run as a stacked form or as a guided flow that shows one step per card with a progress bar. Logic shows or hides fields based on earlier answers and routes people to different outcomes, and brand presets (Clean Clinical, Soft Referral and Campaign Focus) plus your colors, fonts, logo and custom CSS keep the form on brand.
Guided flows suit intake that branches: a weight loss consult that checks eligibility first, or a therapy intake that routes by state. See multi-step telehealth intake funnels for layouts, and telehealth intake form questions for what to ask.
Logic and screening before the booking
Screening is where a healthcare form differs most from a survey tool. Curve Forms can screen people out by age (date of birth rules), service area (for example a state answer) or insurance, each with its own custom end screen. Screened-out submissions send no conversion to ad platforms, so the platforms learn from eligible leads. A crisis outcome has its own end screen and sends no conversion either.
After an eligible submission, a redirect can send the person straight to your booking or checkout page, or to a custom thank-you page. For a full walk-through, see telehealth eligibility screening forms.
Form answers and ad pixels
HHS gives a direct example in its tracking guidance. When a patient “makes an appointment through the website of a covered health clinic” and that site uses third-party tracking, the HHS bulletin says “the website might automatically transmit information regarding the appointment and the individual's IP address to a tracking technology vendor.” In that case, “the tracking technology vendor is a business associate, and a BAA is required” (HHS).
The same logic applies to a form page. Swapping Typeform for another builder does not help if the new page still loads ad tags that see what patients do. The safe pattern: host the form under a BAA, keep the answers in the form tool, and send ad platforms only a neutral event that a form was completed.
With Curve Forms, form events (form started, step progress, form submission completed, lead qualified and lead converted) reach Meta, Google Ads and your other destinations server-side through your event mappings. Form answers, page titles and free text are never sent, and step labels are stripped from step events. See the safe path from website forms to ad platforms.
How Curve Compliance helps
Curve Forms gives clinics and telehealth teams HIPAA-hosted intake and lead forms with ad attribution attached. Every lead arrives in the Leads inbox with its answers, UTMs and ad click ID, attribution and staff notes, and you can mark lead stages such as qualified and converted. Your team gets a notification email with Reply-to set to the respondent, separate checkboxes record privacy consent and marketing consent, and every view or export of submissions is logged. Forms embed with a script that resizes itself, an iframe, a hosted link, a QR code or a custom domain.
Behind the form, Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve is SOC 2 Type II, signs a BAA on every plan, and its team does the setup, typically live in about a week. Collecting consent for virtual visits? See the telehealth consent form template. Built your site with an AI tool? See is Lovable HIPAA compliant.
Sources, checked November 9, 2026: Typeform, Business Associate Agreement (BAA); Jotform How to Enable the HIPAA Environment and How to Receive a BAA; Cognito Forms, HIPAA compliance; Formstack, forms for HIPAA compliant organizations; Google Workspace, HIPAA compliance; Google Cloud, HIPAA compliance (Workspace services in the BAA); HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What are the best Typeform alternatives for healthcare?
Jotform, Cognito Forms, Formstack, Google Forms inside Google Workspace and Curve Forms each offer a BAA on a plan or setup named on their own pages. Pick the one whose BAA covers the plan you can use and whose forms keep answers away from your ad pixels.
Is Typeform HIPAA compliant?
Typeform says its “data protection standards are HIPAA compliant” and that it can “currently provide a BAA for customers on our Enterprise or Growth Custom plans” (Typeform). On other plans, hold patient answers until a BAA is signed.
Can I use Typeform for telehealth intake?
Yes, on an Enterprise or Growth Custom plan with a signed BAA, as long as the page around the form keeps answers away from ad tags. Without that plan, use a form builder that signs a BAA on the plan you have.
Can I use Google Forms instead of Typeform for patient forms?
Only inside Google Workspace after an administrator accepts Google's BAA. Google says customers without one “must not use PHI in Google Workspace or Cloud Identity services” (Google Workspace).
Do one-question-at-a-time forms convert better?
It depends on your audience and offer, so test it on your own traffic. Curve Forms runs A/B experiments from the Publish screen and shows a step-by-step funnel, so you can see where people drop off.
Can form answers be sent to Meta?
They should not be. Curve's BAA Directory lists Meta as not signing a BAA, and HHS says a tracking vendor that receives appointment details from a clinic site is a business associate that needs a BAA (HHS). Curve Forms never sends form answers to ad platforms; it sends neutral form events server-side.
Does Curve Compliance sign a BAA?
Yes. Curve signs a BAA on every plan, and Curve Forms are hosted by Curve under that BAA.
Talk to Curve Compliance
Book a call. Comparing Typeform alternatives for patient intake? See a Curve Forms demo and get a review of your intake funnel: HIPAA-hosted forms, form answers never sent to ad platforms, and a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.