Is Jotform HIPAA Compliant? Eligible Plans, Setup Steps, and the BAA

Jotform offers HIPAA features on its Gold and Enterprise plans, and it says it will sign a Business Associate Agreement (BAA) with covered entities that turn those features on. The Starter, Bronze, and Silver plans don’t include them.

That tells you what Jotform offers. It doesn’t make your practice compliant. Jotform’s own HIPAA page tells customers to “follow the HIPAA rules to ensure that your handling of personal health information complies with HIPAA.” A form tool covers one piece of that, and the rest depends on how you use it.

This is a guide to what Jotform’s own published documentation says about its HIPAA features, as of October 13, 2026. It covers the product and its settings. It doesn’t explain what HIPAA requires of your organization, it isn’t legal advice, and we haven’t tested a HIPAA-enabled account. Before you collect patient data, have whoever handles compliance for your practice review Jotform’s BAA and your setup.

What you need before Jotform’s HIPAA features apply

Three things have to be in place, according to Jotform’s help center:

A Gold or Enterprise plan. Jotform’s setup wizard checks your subscription first and stops if you’re on a lower plan.
HIPAA features turned on for the account. They’re off by default. You start the upgrade wizard from the Data page in your account settings.
A signed BAA. After the wizard finishes, a covered entity can sign the BAA from the same Data page and download a copy.

Until all three are done, the account isn’t set up the way Jotform’s HIPAA documentation describes for protected health information (PHI). A Gold subscription by itself doesn’t change how your data is handled.

One detail about the BAA: every Jotform page we read describes it as available to “Covered Entity customers,” and the BAA template Jotform publishes names the customer as the “Covered Entity.” We didn’t find a statement about customers in any other position. If you aren’t sure the term describes your organization, ask Jotform and your compliance adviser before you rely on its BAA.

Where to read about the legal side

Business associate agreements are part of the HIPAA rules, and the U.S. Department of Health and Human Services (HHS) publishes guidance on them. See the HHS page on business associates.

We don’t interpret those rules here. Whether you need a BAA with Jotform, and what else HIPAA requires of your organization, depends on your own situation. That is a question for whoever handles compliance or legal matters for you.

What Jotform says it provides

These are Jotform’s descriptions of its HIPAA environment, taken from its help center and HIPAA FAQ. We haven’t verified them independently.

A separate system. Jotform says HIPAA accounts are “served from an isolated HIPAA system,” and that turning the features on migrates all your forms and submissions there.
Encryption. Its HIPAA documentation says data is “encrypted in transit, end to end, and at rest,” including log data.
Access controls and tracking. Access defaults to none, and access requests, changes, and approvals are tracked and retained.
Monitoring and auditing. Network requests are logged, and Jotform says it runs intrusion detection and regular vulnerability scans.
Backups. Customer data is backed up every 24 hours, with seven days of rolling backups.
A restricted set of add-ons. Jotform says it will “only allow widgets and integrations that help with HIPAA compliance” in forms on a HIPAA account.
A signed BAA for covered entities, as described above.

About Jotform’s BAA

Jotform publishes a template of its BAA, labeled version 2.0, at jotform.com/assets/pdf/Jotform_BAA_V2.pdf. According to Jotform’s setup guide, you sign the agreement electronically from the Data page of your account after the HIPAA wizard finishes, and you can download a copy afterward.

The template is seven pages. Its sections cover what Jotform may do with PHI, safeguards, subcontractors, how a HIPAA-enabled account is to be used, exported and shared data, third-party integrations, notifications to the customer, the customer’s obligations, and termination.

We aren’t summarizing its terms. What a clause means for your organization is a legal question, and the copy you sign is the one that counts. Read it in full and have it reviewed by someone qualified to do that.

What changes when you turn HIPAA features on

Enabling the features changes how the account behaves day to day. Plan for these before you switch.

Email notifications lose the health data. Jotform’s help center says fields marked as PHI are removed from notification and autoresponder emails. You’ll get an alert that a submission arrived and then log in to read it. Jotform explains why: email often isn’t a secure channel, and sharing PHI over one “may still result in HIPAA violations.”

You log in to see submissions. Jotform’s HIPAA FAQ says that unless you use an integration that supports HIPAA compliance, you’re “required to log into your Jotform account to view this data.”

Your existing forms get reviewed. The wizard checks every form and lists any widgets or integrations that aren’t allowed. Expect to remove or replace some.

Password rules tighten. The wizard requires a password of at least 8 characters with upper and lower case letters, a number, and a special character, different from your last six.

The whole account moves. The migration covers all forms and submissions on the account, not selected forms.

What stays your responsibility

Jotform’s HIPAA features cover Jotform’s system. These are the areas its documentation leaves to the customer, or where you’ll need an answer from Jotform.

Where the data goes next. Jotform’s FAQ names Google Sheets, Google Drive, Dropbox, and Infusionsoft as integrations “capable of enabling HIPAA compliance,” and adds that to make a piece of software HIPAA-enabled, “you must sign a Business Associate Agreement (BAA) with the company.” Jotform’s BAA template has its own section on third-party integrations. Whether a particular integration is acceptable for your data is something to settle with Jotform and your compliance adviser. We can’t tell you.
Which fields are marked as PHI. Jotform’s help center says every field is marked as PHI by default when you enable the features, and each field has a switch to turn that off. A field with protection off can appear in emails. Jotform says the stored data stays encrypted either way. Deciding which fields are safe to unprotect is up to you.
Who can log in. Jotform’s Gold plan is single-user, according to its help center, which says only Enterprise supports inviting team members. Jotform’s HIPAA documentation says access to data is tracked. If several staff members need to view submissions, ask Jotform how it expects a multi-person practice to work on Gold, or price Enterprise.
What you do with exports. Downloaded spreadsheets, PDFs, and printed submissions are no longer inside Jotform’s system. Jotform’s BAA template has a section on exported data. Read it.
Your other HIPAA obligations. Jotform’s HIPAA page tells customers to follow the HIPAA rules in how they handle health information. What those rules require of your organization is outside what a form tool, or this article, covers.

What it costs

HIPAA features are included in the Gold plan’s price. Jotform’s HIPAA FAQ says there is “no additional fee.”

Gold is $129 a month, or $1,188 a year, which works out to $99 a month. It includes 10,000 submissions a month and 100 forms. Enterprise pricing is by quote. The rest of the plan details are in our Jotform Pricing guide.

What we couldn’t confirm

These points matter for a compliance decision, and Jotform’s public pages either don’t settle them or disagree with each other.

Your signed BAA. We read the template Jotform publishes. We can’t confirm it matches the version you’ll be asked to sign, and we haven’t interpreted its terms.
Customers that aren’t covered entities. As noted, Jotform’s documentation refers only to covered entities.
Email content. Jotform’s HIPAA FAQ says “no submission data will be included in any notification emails.” Two of its help center articles say something narrower: fields marked as PHI are removed, and fields you’ve switched to unprotected still appear. The help center articles are more detailed and one was updated in June 2026, but we couldn’t tell which description matches current behavior. Send a test submission and check.
Plan wording. Some FAQ answers say HIPAA features are available “only with Gold plan,” and others say Gold or Enterprise. The setup guide and pricing page both say Gold and Enterprise.
Two-factor authentication on your account. Jotform’s security page describes two-factor authentication. We didn’t confirm how it applies to HIPAA accounts on Gold.
Other Jotform products. We didn’t verify how Jotform Sign, Jotform’s AI Agents, or its mobile app are covered under a HIPAA account.
Independent audits. Jotform says it has an audited disaster recovery plan and that customers can “inherit a lot of the work” from its audits. We didn’t find the audit reports themselves on the pages we read.

Jotform setup checklist

This list covers Jotform’s settings only, as its documentation describes them. It is not a HIPAA compliance checklist.

You’re on the Gold or Enterprise plan.
The HIPAA wizard has run to the end, and your forms and submissions have been migrated.
The BAA has been signed from the Data page, and you’ve downloaded your copy.
Any widgets or integrations the wizard flagged have been removed or replaced.
Each form’s fields have been checked, so you know which are marked as PHI and which you’ve switched off.
You’ve sent a test submission and looked at exactly what arrives by email.
You know who will log in to read submissions, and you’ve asked Jotform about access for more than one person if you need it.

If you’re considering Jotform for patient data, read its own HIPAA documentation before anything else. Read Jotform’s HIPAA information

If Jotform isn’t the right fit

Other form builders list HIPAA features too, usually on higher tiers. Cognito Forms and Typeform list them on Enterprise plans, and Formstack lists HIPAA as an add-on. We didn’t review those vendors’ HIPAA terms or agreements. Our Jotform Alternatives guide has the starting points.

FAQ

Is Jotform HIPAA compliant? Jotform offers HIPAA features and a BAA on its Gold and Enterprise plans. That describes the product. Whether your organization’s use of it complies with HIPAA is a separate question that depends on things Jotform doesn’t control.

Does Jotform’s free plan include HIPAA features? No. Jotform says HIPAA features are available only on Gold and Enterprise, and its pricing page says the free plan excludes them.

Does Jotform sign a BAA? Jotform says covered entity customers that have enabled HIPAA features can sign one from their account’s Data page. It publishes a template of the agreement.

Does HIPAA cost extra on Jotform? Jotform’s FAQ says it’s included in the Gold plan with no additional fee.

Will I still get submissions by email? You’ll get a notification. Jotform’s help center says fields marked as PHI are removed from the email, and its HIPAA FAQ says no submission data is included at all. Either way, plan to log in to read submissions, and send a test to see what your account does.

Can I connect a HIPAA form to Google Sheets? Jotform’s FAQ lists Google Sheets among integrations “capable of enabling HIPAA compliance,” and says that making a piece of software HIPAA-enabled requires a BAA with that company. Whether that setup is acceptable for your data is a question for Jotform and your compliance adviser.