Independent vendor compliance review
Is Cognito Forms HIPAA compliant?
Cognito Forms offers a BAA for paid Enterprise organizations, not trial organizations. An authorized organization Owner signs in Settings → Plan & Billing → Compliance. Verify the executed agreement and submission workflow before collecting PHI.
Direct compliance answer
Cognito Forms HIPAA, BAA, PHI, and SOC 2 snapshot
Last checked: 2026-11-04 | Confidence: Medium
| Direct answer | Cognito Forms offers a BAA for paid Enterprise organizations, not trial organizations. An authorized organization Owner signs in Settings → Plan & Billing → Compliance. Verify the executed agreement and submission workflow before collecting PHI. |
|---|---|
| BAA availability | The official help guide describes an in-account BAA signing process without an additional BAA fee beyond Enterprise. Retain the executed agreement for the correct organization. |
| Can it handle PHI? | Responses and attachments can leave the platform through notifications, exports and connected services. Trace each copy before introducing PHI. |
| SOC 2 caveat | Obtain the current SOC 2 report and scope for the contracted service; HIPAA or BAA eligibility alone is not SOC 2 evidence. |
| What to verify | Confirm paid Enterprise status, authorized Owner signature and the downloaded BAA. Use synthetic records to test access, uploads, notification content, workflow links, exports and deletion. |
Scope of this profile
Check paid Enterprise eligibility and organization-level BAA activation; distinguish a trial from an activated regulated workflow.
Independent research view
Cognito Forms plan and BAA scope
Check paid Enterprise eligibility and organization-level BAA activation; distinguish a trial from an activated regulated workflow.
On small screens, scroll the table horizontally to see buyer verification checks.
| Review area | Vendor public signal | Buyer verification |
|---|---|---|
| Paid organization | Enterprise is required; trial organizations are excluded. | Confirm organization billing and eligibility before enabling PHI fields. |
| BAA signature | An authorized Owner signs the organization BAA in account settings. | Retain the executed document and verify the organization identity. |
| Response journey | Notifications and workflow access need configuration review. | Test access, recipients, copies and deletion using synthetic data. |
HIPAA status signal
Conditional — paid Enterprise
BAA public signal
Enterprise, non-trial BAA
SOC 2 evidence signal
Verify current product report
PHI warning: Responses and attachments can leave the platform through notifications, exports and connected services. Trace each copy before introducing PHI.
Search query answers
Is Cognito Forms HIPAA compliant?
It has a conditional BAA path for paid Enterprise organizations. The account, agreement and complete workflow still require verification.
Can a Cognito Forms trial sign a BAA?
The official HIPAA guide excludes trial organizations. Do not use a trial to collect PHI.
How do you obtain a Cognito Forms BAA?
An authorized organization Owner signs through the Compliance section in Plan & Billing. Save the executed agreement and verify the organization settings.
HIPAA, BAA, and SOC 2 summary
| HIPAA | Enterprise eligibility is a prerequisite; a trial or lower plan does not establish BAA coverage. |
|---|---|
| BAA | The official help guide describes an in-account BAA signing process without an additional BAA fee beyond Enterprise. Retain the executed agreement for the correct organization. |
| SOC 2 | Obtain the current SOC 2 report and scope for the contracted service; HIPAA or BAA eligibility alone is not SOC 2 evidence. |
| PHI risk | Responses and attachments can leave the platform through notifications, exports and connected services. Trace each copy before introducing PHI. |
| Category | HIPAA-Compliant Forms and Intake Software |
| Last checked | 2026-11-04 |
| Confidence | Medium |
Public evidence and open questions
What public sources say
- The help guide excludes trial organizations from BAA eligibility.
- After BAA activation, review protected fields, email notifications and authenticated workflow access.
What remains unconfirmed
- Account-specific contract terms, processing locations and optional service coverage.
- Whether the proposed recipients and connected systems are authorized for PHI.
What it may be used for
- Non-PHI evaluation using synthetic records.
- Regulated workflows only after account-specific agreement and configuration verification.
What not to use it for
- Collecting PHI on an unverified plan or assuming coverage extends to every integration.
What to verify with the vendor
- Confirm paid Enterprise status, authorized Owner signature and the downloaded BAA.
- Use synthetic records to test access, uploads, notification content, workflow links, exports and deletion.
- Document each downstream service, responsible owner and agreement before enabling a regulated workflow.
Safer alternatives and related profiles
Safer alternatives to consider
- Formstack: review Forms Healthcare activation, BAA and integration scope.
- Jotform: compare Gold and Enterprise eligibility, activation and workflow scope.
- Managed Google or Microsoft Forms: verify the relevant business agreement and connected systems.
Google Forms
HIPAA: Conditional | SOC 2: Google public evidence
Microsoft Forms
HIPAA: Conditional | SOC 2: Microsoft audit evidence
Jotform
HIPAA: Conditional | SOC 2: Public evidence
Wix
HIPAA: Conditional | SOC 2: Verify with vendor
Formstack
HIPAA: Conditional — Forms Healthcare | SOC 2: Verify current product report
FAQ
Is Cognito Forms HIPAA compliant?
It has a conditional BAA path for paid Enterprise organizations. The account, agreement and complete workflow still require verification.
Can a Cognito Forms trial sign a BAA?
The official HIPAA guide excludes trial organizations. Do not use a trial to collect PHI.
How do you obtain a Cognito Forms BAA?
An authorized organization Owner signs through the Compliance section in Plan & Billing. Save the executed agreement and verify the organization settings.
Will Cognito Forms sign a BAA?
The official help guide describes an in-account BAA signing process without an additional BAA fee beyond Enterprise. Retain the executed agreement for the correct organization.
Can Cognito Forms be used with PHI?
Do not use this vendor with PHI until your organization verifies BAA scope, covered services, configuration, access controls, data retention, and connected integrations.
Does SOC 2 mean Cognito Forms is HIPAA compliant?
No. SOC 2 evidence can support security diligence, but it does not prove HIPAA compliance, confirm BAA coverage, or approve PHI use. Review HIPAA terms, BAA scope, covered services, configuration, and intended workflow separately.
What should buyers verify before using Cognito Forms with PHI?
Confirm paid Enterprise status, authorized Owner signature and the downloaded BAA. Use synthetic records to test access, uploads, notification content, workflow links, exports and deletion. Document each downstream service, responsible owner and agreement before enabling a regulated workflow.
Last checked and source notes
- Last checked
- 2026-11-04
- Confidence
- Medium
- Dataset rows
- 280 vendors
- Official public plan and BAA sources checked November 4, 2026; no private account or contract was inspected.
- Workflow verification steps are ComplySaaS procurement guidance.
- Cognito Forms — HIPAA compliance and BAA
- Cognito Forms — plan comparison