Is Typeform HIPAA compliant?
Only on Typeform's enterprise-level plans, after you tell Typeform in advance and it agrees to sign, on the ordinary self-serve plans Typeform's own terms bar you from collecting patient information.
Applies to Typeform forms and surveys. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Be on an enterprise-level plan. Typeform states it can currently provide the agreement for customers on Enterprise or its custom growth plan only.
- Notify Typeform first. Its usage policy requires you to say you intend to collect information covered by HIPAA so it can assess whether it can offer compliant services.
- Request the agreement from Typeform sales, supplying the organization name and the account email it will apply to.
- Wait for signature. Until the agreement is signed and attached to your master agreement you are contractually barred from submitting this information.
- If you are not on an eligible plan, use Typeform's HIPAA pricing request route and move onto one before collecting anything.
- Review any AI insights feature, which Typeform says is governed by a third-party provider's terms.
Does Typeform sign a business associate agreement?
Yes. Typeform offers one. Enterprise, or the sales-negotiated custom growth plan. Ask sales: the latter does not appear on public pricing. Eligible customers request it from Typeform sales with the organization name and account email. Everyone else must move onto an eligible plan first.
What this means in practice
Typeform's answer is yes, but only at the top of its price list. The help centre states it can currently provide the agreement for enterprise-level customers, and there is no self-serve route on the ordinary paid tiers.
Typeform's usage policy goes further than most vendors. It requires you to tell Typeform in advance that you intend to collect information covered by HIPAA, so it can assess whether it can offer compliant services at all. Until an agreement is signed and attached to your master agreement, you are contractually barred from submitting that information, and Typeform disclaims any liability for the service meeting HIPAA obligations.
Practically, treat this as a sales-led decision. A small practice on a monthly self-serve plan would need to renegotiate onto an enterprise contract before a single patient answer could go in.
How organizations get this wrong
- Collecting patient answers on a self-serve Typeform plan. The usage policy bars submitting covered information until an agreement is signed.
- Skipping the advance notification. Typeform requires you to tell it you intend to collect covered information so it can assess whether it can serve you.
- Treating Typeform's security certifications as a substitute for the agreement: it disclaims HIPAA liability entirely where none exists.
- Leaving AI insight features active, which Typeform says are governed by a third-party provider's terms rather than by your agreement.
What the agreement does not cover
- Every self-serve plan.
- Any collection of patient information before signature: the usage policy bars it outright.
- Typeform's representations about the service meeting HIPAA obligations, which it disclaims where no agreement exists.
- Feature-level scope. Typeform publishes no list of which features are in or out once signed.
Alternatives
Comparable form-building on a published tier, with the agreement signed in-product rather than through sales
Covered by the Workspace amendment at no extra cost if you already run Workspace
Keep a record of your Typeform agreement
Sources
- Business Associate Agreement (BAA): Typeform. Read July 29, 2026.
- Usage Policy: Typeform. Read July 29, 2026.
Typeform can change these terms at any time. If something here no longer matches what Typeform tells you, tell us.