Independent vendor compliance review
Is Formsite HIPAA compliant?
Formsite’s current HIPAA Service help article says HIPAA service is no longer available to new Formsite customers and directs them to Formstack. Older marketing is not evidence of current new-customer eligibility. Existing customers should verify their own contract with Support.
Direct compliance answer
Formsite HIPAA, BAA, PHI, and SOC 2 snapshot
Last checked: 2026-11-04 | Confidence: Medium
| Direct answer | Formsite’s current HIPAA Service help article says HIPAA service is no longer available to new Formsite customers and directs them to Formstack. Older marketing is not evidence of current new-customer eligibility. Existing customers should verify their own contract with Support. |
|---|---|
| BAA availability | The current help notice does not establish the status of legacy contracts or their BAA terms. Existing customers need written account-specific confirmation; do not infer that all legacy coverage has ended. |
| Can it handle PHI? | Responses and attachments can leave the platform through notifications, exports and connected services. Trace each copy before introducing PHI. |
| SOC 2 caveat | Obtain the current SOC 2 report and scope for the contracted service; HIPAA or BAA eligibility alone is not SOC 2 evidence. |
| What to verify | For a new regulated project, review the linked Formstack research and its current Healthcare account requirements. For an existing deployment, ask Support to confirm the executed BAA, service continuity, renewal and migration options in writing. |
Scope of this profile
Separate the current new-customer service notice from unresolved legacy contracts. Review Formstack, the destination named by Formsite, as well as independent alternatives.
Independent research view
Formsite plan and BAA scope
Separate the current new-customer service notice from unresolved legacy contracts. Review Formstack, the destination named by Formsite, as well as independent alternatives.
On small screens, scroll the table horizontally to see buyer verification checks.
| Review area | Vendor public signal | Buyer verification |
|---|---|---|
| New customer | HIPAA service is no longer offered to new Formsite customers. | Do not assume an ordinary new subscription supports regulated intake. |
| Existing contract | The help notice does not define legacy BAA continuity. | Ask Support for written account, renewal and migration scope. |
| Alternative route | The official notice points to Formstack. | Review Formstack Healthcare scope and compare other intake workflows independently. |
HIPAA status signal
New customers: HIPAA unavailable
BAA public signal
New service unavailable; verify legacy BAA
SOC 2 evidence signal
Verify current product report
PHI warning: Responses and attachments can leave the platform through notifications, exports and connected services. Trace each copy before introducing PHI.
Search query answers
Is Formsite HIPAA compliant for new customers?
Its current HIPAA Service help article says the service is no longer available to new Formsite customers. It directs enquiries to Formstack.
Does Formsite still offer a BAA?
The new-customer service notice does not resolve existing agreements. Ask Support for written confirmation of your legacy account and BAA; do not rely on older marketing.
What should existing Formsite HIPAA customers check?
Confirm ongoing service and contract coverage, renewal conditions and migration options with Support before changing the workflow.
HIPAA, BAA, and SOC 2 summary
| HIPAA | Do not shortlist a new Formsite subscription as a current HIPAA service based on older feature pages. |
|---|---|
| BAA | The current help notice does not establish the status of legacy contracts or their BAA terms. Existing customers need written account-specific confirmation; do not infer that all legacy coverage has ended. |
| SOC 2 | Obtain the current SOC 2 report and scope for the contracted service; HIPAA or BAA eligibility alone is not SOC 2 evidence. |
| PHI risk | Responses and attachments can leave the platform through notifications, exports and connected services. Trace each copy before introducing PHI. |
| Category | HIPAA-Compliant Forms and Intake Software |
| Last checked | 2026-11-04 |
| Confidence | Medium |
Public evidence and open questions
What public sources say
- The current help notice redirects new HIPAA service enquiries to Formstack.
- Older secure-submission marketing still references HIPAA and BAA requests; resolve that difference before buying.
What remains unconfirmed
- Legacy customer eligibility, renewals and executed contract scope.
- Whether any historical account remains covered for the proposed workflow.
What it may be used for
- Non-PHI forms after ordinary privacy and security review.
- Legacy regulated workflows only with written confirmation of ongoing account and agreement coverage.
What not to use it for
- Collecting PHI on an unverified plan or assuming coverage extends to every integration.
What to verify with the vendor
- For a new regulated project, review the linked Formstack research and its current Healthcare account requirements.
- For an existing deployment, ask Support to confirm the executed BAA, service continuity, renewal and migration options in writing.
- Inventory existing submissions and recipients before moving records; test an export and deletion plan with synthetic data.
Safer alternatives and related profiles
Safer alternatives to consider
- Formstack: review Forms Healthcare activation, BAA and integration scope.
- Jotform: compare Gold and Enterprise eligibility, activation and workflow scope.
- Managed Google or Microsoft Forms: verify the relevant business agreement and connected systems.
Google Forms
HIPAA: Conditional | SOC 2: Google public evidence
Microsoft Forms
HIPAA: Conditional | SOC 2: Microsoft audit evidence
Jotform
HIPAA: Conditional | SOC 2: Public evidence
Wix
HIPAA: Conditional | SOC 2: Verify with vendor
Formstack
HIPAA: Conditional — Forms Healthcare | SOC 2: Verify current product report
FAQ
Is Formsite HIPAA compliant for new customers?
Its current HIPAA Service help article says the service is no longer available to new Formsite customers. It directs enquiries to Formstack.
Does Formsite still offer a BAA?
The new-customer service notice does not resolve existing agreements. Ask Support for written confirmation of your legacy account and BAA; do not rely on older marketing.
What should existing Formsite HIPAA customers check?
Confirm ongoing service and contract coverage, renewal conditions and migration options with Support before changing the workflow.
Is Formsite HIPAA compliant?
Formsite’s current HIPAA Service help article says HIPAA service is no longer available to new Formsite customers and directs them to Formstack. Older marketing is not evidence of current new-customer eligibility. Existing customers should verify their own contract with Support.
Will Formsite sign a BAA?
The current help notice does not establish the status of legacy contracts or their BAA terms. Existing customers need written account-specific confirmation; do not infer that all legacy coverage has ended.
Can Formsite be used with PHI?
Do not use this vendor with PHI until your organization verifies BAA scope, covered services, configuration, access controls, data retention, and connected integrations.
Does SOC 2 mean Formsite is HIPAA compliant?
No. SOC 2 evidence can support security diligence, but it does not prove HIPAA compliance, confirm BAA coverage, or approve PHI use. Review HIPAA terms, BAA scope, covered services, configuration, and intended workflow separately.
What should buyers verify before using Formsite with PHI?
For a new regulated project, review the linked Formstack research and its current Healthcare account requirements. For an existing deployment, ask Support to confirm the executed BAA, service continuity, renewal and migration options in writing. Inventory existing submissions and recipients before moving records; test an export and deletion plan with synthetic data.
Last checked and source notes
- Last checked
- 2026-11-04
- Confidence
- Medium
- Dataset rows
- 280 vendors
- Official public plan and BAA sources checked November 4, 2026; no private account or contract was inspected.
- Workflow verification steps are ComplySaaS procurement guidance.
- Formsite — current HIPAA Service notice
- Formsite — secure-submission marketing (compare with current notice)