Is Jotform HIPAA compliant?

Jotform, like any online form builder, cannot be HIPAA compliant or noncompliant in isolation. HIPAA places obligations on covered entities and their business associates, so the useful question is narrower. Can your organization use this tool for the specific information your form collects, under a signed business associate agreement, with the account set up to protect that information? A form tool is never HIPAA compliant on its own. This guide shows you how to answer the question for your situation.

This article does not rely on Jotform’s own documentation, so it makes no claim about which Jotform plans, features or agreements exist today. Confirm those directly with Jotform, in writing, before you build. The guidance below applies to any form vendor you are evaluating. It is practical buyer guidance, not legal advice, and it does not replace review by your privacy lead or counsel.

The short answer

When people ask whether a form tool is HIPAA compliant, they usually want to know whether they can put it on their website and stop worrying. You can’t get that from a vendor’s marketing page. The answer depends on three things. We recommend settling them in the order below, because each answer shapes the next one:

1. Your role under HIPAA. The rules attach to covered entities and business associates. A healthcare company that is neither may still have privacy obligations, but they come from different rules.
2. The data the form collects. A newsletter signup and an intake questionnaire carry very different risks, even when they are built in the same tool.
3. The signed agreement and settings. If protected health information is involved, you need a business associate agreement with the vendor and an account configured to support your safeguards.

If any of these is unclear, we recommend treating the form as sensitive until someone qualified has looked at it.

Who HIPAA applies to

The HIPAA definitions define a covered entity as a health plan, a health care clearinghouse, or “a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter” (45 CFR 160.103). A practice or clinic may fall into that third group if it transmits health information electronically in a covered transaction. A healthcare company such as a device maker or a software vendor selling to hospitals may not, depending on what it does. Ask counsel which description fits you.

The same section defines a business associate as a person who, on behalf of a covered entity and outside its workforce, “creates, receives, maintains, or transmits protected health information” for a regulated function or activity. The definition also includes a subcontractor that does those things on behalf of a business associate (45 CFR 160.103). Read against that wording, a vendor that stores form submissions containing protected health information for a covered provider fits the pattern the definition describes. Ask your counsel to confirm how it applies to your arrangement.

Protected health information is individually identifiable health information that is transmitted or maintained in electronic media or in any other form, with listed exclusions. Individually identifiable health information includes demographic information collected from an individual when it relates to a health condition, the provision of care or payment for care, and either identifies the person or gives a reasonable basis to believe it could (45 CFR 160.103). That is why a form asking only for a name and phone number can still matter if it sits on a page that requests care.

Healthcare companies that are not covered entities should not assume they are free of obligations. The FTC’s Health Breach Notification Rule applies to vendors of personal health records, PHR related entities and third party service providers, and it states that it does not apply to HIPAA-covered entities or to an entity acting as a business associate of one (16 CFR 318.1). Its definitions describe health care services or supplies as including “any online service such as a website, mobile application, or internet-connected device” that provides mechanisms to track a range of health matters (16 CFR 318.2). Whether that rule reaches your product is a legal question; we recommend raising it before you design any signup or tracking form.

What the business associate agreement must cover

If your form vendor will handle protected health information for you, the regulations specify what the contract has to say. Under 45 CFR 164.504(e)(2), a contract between a covered entity and a business associate must, among other things:

• establish the permitted and required uses and disclosures of protected health information by the business associate;
• provide that the business associate will not use or further disclose the information other than as the contract permits or as required by law;
• provide that it will use appropriate safeguards and comply, where applicable, with the security rule subpart for electronic protected health information;
• provide that it will report uses or disclosures not provided for by the contract, including breaches of unsecured protected health information;
• require that subcontractors handling the information agree to the same restrictions and conditions;
• require return or destruction of the information at termination, if feasible, and authorize the covered entity to terminate for a material violation.

The security rule adds that the contract must provide that the business associate will comply with the applicable security requirements, flow those obligations down to subcontractors, and report any security incident it becomes aware of (45 CFR 164.314(a)(2)(i)).

The agreement is not something to sign and file away. Section 164.504(e)(1)(ii) says a covered entity is not in compliance if it knew of a pattern of activity by the business associate that amounted to a material breach and did not take reasonable steps to cure it or, if those failed, terminate where feasible (45 CFR 164.504). We recommend naming someone in your organization to own that relationship.

Questions we recommend putting to Jotform or any other form vendor, and getting answered in writing:

• Do you sign a business associate agreement, and on which plan or account type?
• Which features and data flows does the agreement cover, and which are excluded?
• How are subcontractors handled under the agreement?
• What happens to submissions when we close the account?

Settings still matter after signing

A signed agreement covers the vendor’s obligations. Your own obligations for how the account is used remain. The technical safeguards section requires a covered entity or business associate to implement access control so that only persons or software granted access rights can reach electronic protected health information, including unique user identification, which is marked Required (45 CFR 164.312(a)). Automatic logoff and encryption and decryption appear as Addressable implementation specifications. The section also sets standards for audit controls, integrity, person or entity authentication and transmission security (45 CFR 164.312).

In practice, we recommend you check at least these points in any form account that will receive sensitive submissions:

• every staff member has their own login, with no shared passwords;
• only the people who need submissions can see them;
• notification emails do not carry the full submission content unless your privacy lead has approved that;
• you know how long submissions are kept and who deletes them;
• you can see a record of who accessed or exported data, if the vendor offers one.

Four questions before a health form goes live

Work through these in order. Each answer changes what the next one needs to settle.

1. Are you a covered entity or business associate? If neither, ask counsel whether another rule, such as the FTC rule above or state law, applies to your form.
2. Does the form collect protected health information? List every field, including free text boxes, uploads and hidden fields. Consider the page context too: a request on a page for a specific service may reveal more than the fields alone suggest.
3. Will the vendor sign a business associate agreement? If the answer is no, or the agreement does not cover the features you plan to use, we recommend not collecting protected health information in that tool.
4. Is the account configured with safeguards? Map each control in the previous section to an owner before launch, and recheck when staff change.

A useful scope tradeoff sits at question two. We recommend removing any field you don’t need, because each one you drop narrows what you have to protect. A shorter form with a callback request may serve a practice better than a long intake questionnaire on a public marketing site, with fuller intake handled later inside a clinical system the practice already manages.

Three hypothetical forms

Hypothetical: a practice appointment request

A small multi-provider practice wants a request form with name, phone, email, preferred day and a box labeled “reason for visit.” That free text box invites people to describe their health. The practice decides with its privacy lead whether the form needs a vendor under a business associate agreement, or whether a simpler callback form, without the free text box, fits its needs better. Even then, the definition of individually identifiable health information covers demographic details tied to care, so the simpler form still deserves review.

Hypothetical: a medical device company demo request

A device manufacturer collects company name, job title and work email from hospital buyers. Nothing on the form concerns anyone’s own health or care. This is likely ordinary lead capture, though the company should still confirm its role with counsel and avoid adding fields that ask about patients.

Hypothetical: a digital health signup

A consumer wellness app asks new users about symptoms and sleep on a website signup form. The company is not a covered provider. Its question is less about HIPAA and more about whether the FTC Health Breach Notification Rule applies, which needs legal review before the form is designed.

Where the website platform fits

Form tools are usually embedded in a site built on WordPress, Webflow, Framer or something similar. The website build affects the risk, so ask your developer these questions.

Where does the submission go? Ask whether an embedded form sends data straight to the form vendor or whether anything passes through or is stored by the website itself, for example in a WordPress plugin’s entries table.

Who can change the embed? WordPress documentation describes the unfiltered_html capability as allowing a user to “post HTML markup or even JavaScript code in pages, posts, comments and widgets,” and warns that enabling it for untrusted users may result in malicious or poorly formatted code (WordPress Roles and Capabilities). We recommend limiting who holds roles that can alter form pages.

Is the CMS being used for something it wasn’t meant for? Webflow describes a CMS Collection as “a database where you can store content to reference throughout your site” (Webflow Help Center). Framer’s developer documentation says plugins can read and write to the Framer CMS, and that Managed Collections can sync data between Framer and a third party (Framer Developers). Those are publishing tools. We recommend keeping patient submissions out of any website CMS.

What else loads on the form page? Ask for a list of every script on pages that host sensitive forms, and decide with your privacy lead whether each one belongs there.

Who owns each step of a form decision

The split below is our recommendation for how to assign the work, not a statement of legal duties. We suggest working through it in the order shown, since the rules that apply shape what the form should collect, and both shape what the vendor and developer are asked to do. The order reflects sequence, not seniority.

Party	Suggested responsibility
Legal or privacy advisor	Confirms which rules apply and reviews the agreement before data is collected
Covered entity or health company	Decides what the form collects, signs agreements, owns access and retention
Form vendor	Meets the obligations in any signed agreement and documents what its service covers
Website developer	Implements the embed, limits editing access and reports every script on form pages

In order:

1. Legal or privacy advisor: confirms which rules apply
2. Covered entity or health company: decides what the form collects
3. Form vendor: meets the obligations in any signed agreement
4. Website developer: implements the embed and limits editing access

Health Site Works designs and builds healthcare marketing websites, redesigns and migrations on Framer, WordPress and Webflow, for both healthcare companies and practices. Clinical systems, patient portals and sensitive intake need separate scope and provider review, and Health Site Works does not guarantee compliance outcomes. You can read about our services, see how pricing is set case by case after scoping, or send an inquiry through the contact page. More planning guides, including “Healthcare website redesign: what to include in the project brief,” are on our Insights page.

FAQs

Does a signed business associate agreement make our form compliant?

No single document does that. The agreement addresses the vendor’s obligations. How you configure the account and control staff access ties back to the safeguards in 45 CFR 164.312, such as access control and unique user identification. We also recommend that you set your own retention period and keep the fields you collect to what you need.

Can we add a note telling people not to enter health details?

You can, but people may not read or follow such notes. We recommend designing the form so it doesn’t invite health details, rather than relying on a disclaimer.

Is every contact form on a healthcare company website covered by HIPAA?

Not necessarily. HIPAA attaches to covered entities and business associates as defined in 45 CFR 160.103. A company outside those roles should still ask whether other rules apply.

Does encryption settle the question?

Encryption is one Addressable specification among several standards in the technical safeguards section. Access control, audit controls, integrity, authentication and transmission security are separate standards there (45 CFR 164.312).

Should we switch away from Jotform?

That depends on what Jotform will agree to in writing for your account, what your form collects and whether your team can maintain the settings. We recommend comparing vendors against the same four questions instead of switching on reputation alone.