Is Typeform HIPAA compliant?
Only on Typeform's enterprise-level plans, after you tell Typeform in advance and it agrees to sign — on the ordinary self-serve plans Typeform's own terms bar you from collecting patient information.
Applies to Typeform forms and surveys. Last reviewed against Typeform's own documentation. Next review January 10, 2027.
Reviewed by Margaret O'Brien — HIPAA Privacy Officer.
What you must do
- Be on an enterprise-level plan. Typeform states it can currently provide the agreement for customers on Enterprise or its custom growth plan only.
- Notify Typeform first. Its usage policy requires you to say you intend to collect information covered by HIPAA so it can assess whether it can offer compliant services.
- Request the agreement from Typeform sales, supplying the organization name and the account email it will apply to.
- Wait for signature. Until the agreement is signed and attached to your master agreement you are contractually barred from submitting this information.
- If you are not on an eligible plan, use Typeform's HIPAA pricing request route and move onto one before collecting anything.
- Review any AI insights feature, which Typeform says is governed by a third-party provider's terms.
Does Typeform sign a business associate agreement?
Yes. Typeform offers one. Enterprise, or the sales-negotiated custom growth plan. Ask sales — the latter does not appear on public pricing. Eligible customers request it from Typeform sales with the organization name and account email. Everyone else must move onto an eligible plan first.
What this means in practice
Typeform's answer is yes, but only at the top of its price list. The help centre states it can currently provide the agreement for enterprise-level customers, and there is no self-serve route on the ordinary paid tiers.
Typeform's usage policy goes further than most vendors. It requires you to tell Typeform in advance that you intend to collect information covered by HIPAA, so it can assess whether it can offer compliant services at all. Until an agreement is signed and attached to your master agreement, you are contractually barred from submitting that information, and Typeform disclaims any liability for the service meeting HIPAA obligations.
Practically, treat this as a sales-led decision. A small practice on a monthly self-serve plan would need to renegotiate onto an enterprise contract before a single patient answer could go in.
How organizations get this wrong
The specific mistakes we see with Typeform, not generic advice.
- Collecting patient answers on a self-serve Typeform plan. The usage policy bars submitting covered information until an agreement is signed.
- Skipping the advance notification. Typeform requires you to tell it you intend to collect covered information so it can assess whether it can serve you.
- Treating Typeform's security certifications as a substitute for the agreement — it disclaims HIPAA liability entirely where none exists.
- Leaving AI insight features active, which Typeform says are governed by a third-party provider's terms rather than by your agreement.
What the agreement does not cover
- Every self-serve plan.
- Any collection of patient information before signature — the usage policy bars it outright.
- Typeform's representations about the service meeting HIPAA obligations, which it disclaims where no agreement exists.
- Feature-level scope. Typeform publishes no list of which features are in or out once signed.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
Comparable form-building on a published tier, with the agreement signed in-product rather than through sales
Covered by the Workspace amendment at no extra cost if you already run Workspace
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Typeform, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Typeform’s own published documentation, read on the date shown.
- Business Associate Agreement (BAA) — Typeform. No publication date given. Read July 29, 2026.
- Usage Policy — Typeform. No publication date given. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Typeform’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.