Is Formstack HIPAA compliant?
Yes, if Formstack moves you onto one of its healthcare plans, which comes with a signed agreement but restricts your integrations, email and attachments.
Applies to Formstack Forms. Last reviewed against Formstack's own documentation. Next review January 9, 2027.
Reviewed by Margaret O'Brien — HIPAA Privacy Officer.
What you must do
- Get onto a healthcare plan. Formstack directs customers to contact support to activate one; it is not a self-serve upgrade.
- Accept Formstack's standard agreement, or ask it to evaluate your own — it evaluates custom requests case by case.
- Send notifications through your own mail server. The healthcare configuration makes SMTP mandatory and restricts which recipients can be used.
- Turn on database encryption in security settings. Formstack states it is required when collecting sensitive data, and only users who know the encryption password can then read submissions.
- Expect constraints on submit actions and webhooks, and no attachments in submissions.
- Limit yourself to the healthcare integration allowlist.
- Turn on two-factor authentication for users.
Does Formstack sign a business associate agreement?
Yes. Formstack offers one. A Formstack healthcare plan, provisioned by Formstack rather than bought self-serve. Contact Formstack support or your account representative to convert onto a healthcare plan. The standard agreement comes with it; custom requests are evaluated case by case.
What this means in practice
Formstack does not sell this as a checkbox. Support or your account representative converts you onto a healthcare plan, and the protection arrives as a set of restrictions rather than as a feature you switch on.
Those restrictions matter more than the marketing copy. Notification emails must go through your own mail server, recipients are limited, submit actions and webhooks are constrained, and file attachments are removed from submissions. Integrations are cut back to a short allowlist, and PayPal Pro is excluded where ordinary PayPal is allowed.
You must also turn on database encryption yourself; Formstack says it is required when collecting sensitive data, and afterwards only users holding the encryption password can read submissions. Formstack is explicit that it is one piece of your process and not liable for the rest of it.
How organizations get this wrong
The specific mistakes we see with Formstack, not generic advice.
- Buying a standard Formstack plan and asking for the agreement afterwards. The healthcare configuration is a different plan Formstack must provision.
- Connecting an integration outside the healthcare allowlist. The restricted list is the security control, so anything else defeats the design.
- Leaving database encryption switched off. Formstack states it is required when collecting sensitive data, and it is not on by default.
- Expecting attachments and data-rich notification emails to behave as on an ordinary account — the healthcare configuration removes both.
What the agreement does not cover
- Any integration outside the healthcare allowlist.
- PayPal Pro, explicitly excluded where ordinary PayPal is allowed.
- File attachments in submissions.
- Your wider workflow — Formstack states it is one piece of your process and is not liable for the rest of it.
- Ordinary Formstack accounts that have not been converted to a healthcare plan.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
A published tier you can buy and enable yourself, with the agreement signed in-product the same day
Already covered if you run Google Workspace, at no additional cost for simple intake
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Formstack, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Formstack’s own published documentation, read on the date shown.
- Maintaining HIPAA Compliance with Formstack — Formstack. No publication date given. Read July 29, 2026.
- Healthcare Compatible Integrations — Formstack. No publication date given. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Formstack’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.