Independent vendor compliance review
Is Formstack HIPAA Compliant?
Formstack publishes a HIPAA path for Formstack Forms Healthcare accounts with a BAA. Do not extend that coverage to every Formstack product or ordinary plan. Confirm account activation, contracted services, notification routing and each integration before collecting PHI.
Direct compliance answer
Formstack HIPAA, BAA, PHI, and SOC 2 snapshot
Last checked: 2026-10-29 | Confidence: Medium
| Direct answer | Formstack publishes a HIPAA path for Formstack Forms Healthcare accounts with a BAA. Do not extend that coverage to every Formstack product or ordinary plan. Confirm account activation, contracted services, notification routing and each integration before collecting PHI. |
|---|---|
| BAA availability | The Healthcare help guide describes signing a BAA and contacting Support to activate a Healthcare plan. Obtain the executed agreement for your account and services; public documentation is not your contract. |
| Can it handle PHI? | Submission answers can leave the form through email, actions, integrations and downloaded files. Validate each copy with synthetic data first. |
| SOC 2 caveat | A BAA or HIPAA marketing statement does not establish SOC 2 report scope. Request the current report for the contracted product. |
| What to verify | Ask Support to identify the exact Healthcare plan, activation state and BAA-covered Forms services in writing. Trace a synthetic submission through storage, SMTP notifications, uploads, actions, exports and deletion. |
Scope of this profile
Evaluate Formstack Forms Healthcare activation, SMTP and supported integrations. Review other suite products separately.
Independent research view
Formstack plan and data-path decision checks
Use these checks with the official sources below before choosing or migrating an intake workflow.
| Review area | Vendor public signal | Buyer verification |
|---|---|---|
| Plan and agreement | The Healthcare help guide describes signing a BAA and contacting Support to activate a Healthcare plan. Obtain the executed agreement for your account and services; public documentation is not your contract. | Ask Support to identify the exact Healthcare plan, activation state and BAA-covered Forms services in writing. |
| Workflow boundary | Conditional: the public security page limits its HIPAA commitment to Forms HIPAA plan customers. | Trace a synthetic submission through storage, SMTP notifications, uploads, actions, exports and deletion. |
| Destinations and copies | The Forms security page describes encrypted submission storage and uploads. | Confirm the destination agreement and configuration for each supported integration; review Documents, Sign and Salesforce products separately. |
HIPAA status signal
Conditional — Forms Healthcare
BAA public signal
Healthcare plan BAA — verify account
SOC 2 evidence signal
Verify current product report
PHI warning: Submission answers can leave the form through email, actions, integrations and downloaded files. Validate each copy with synthetic data first.
Search query answers
Is Formstack HIPAA compliant?
Formstack describes a conditional path for Forms HIPAA/Healthcare accounts. Confirm the plan, activation and executed BAA, then test the full intake data path.
Does Formstack offer a BAA?
Its Healthcare help guide describes a BAA signing commitment. Contact Support to confirm the actual agreement and covered account before PHI use.
Are all Formstack integrations covered for PHI?
No blanket coverage follows from the integration catalog. Check the current Healthcare-compatible list and the agreement and configuration of every receiving system.
HIPAA, BAA, and SOC 2 summary
| HIPAA | Conditional: the public security page limits its HIPAA commitment to Forms HIPAA plan customers. |
|---|---|
| BAA | The Healthcare help guide describes signing a BAA and contacting Support to activate a Healthcare plan. Obtain the executed agreement for your account and services; public documentation is not your contract. |
| SOC 2 | A BAA or HIPAA marketing statement does not establish SOC 2 report scope. Request the current report for the contracted product. |
| PHI risk | Submission answers can leave the form through email, actions, integrations and downloaded files. Validate each copy with synthetic data first. |
| Category | HIPAA-Compliant Forms and Intake Software |
| Last checked | 2026-10-29 |
| Confidence | Medium |
Public evidence and open questions
What public sources say
- Healthcare accounts have specific email/SMTP and action restrictions.
- The Healthcare integration list is narrower than the general integration catalog. An integration listing does not establish its downstream BAA coverage.
- The Forms security page describes encrypted submission storage and uploads.
What remains unconfirmed
- Current account-specific pricing, executed BAA, add-ons and regional processing scope.
- Whether the intended SMTP provider and downstream systems may receive PHI.
What it may be used for
- Non-PHI questionnaires and vendor evaluation.
- Regulated intake only after the Healthcare account, agreement and complete workflow have been verified.
What not to use it for
- Assuming an ordinary Forms subscription or trial is HIPAA-enabled.
- Treating the full integration catalog or every product in the suite as BAA-covered.
What to verify with the vendor
- Ask Support to identify the exact Healthcare plan, activation state and BAA-covered Forms services in writing.
- Trace a synthetic submission through storage, SMTP notifications, uploads, actions, exports and deletion.
- Confirm the destination agreement and configuration for each supported integration; review Documents, Sign and Salesforce products separately.
Safer alternatives and related profiles
Safer alternatives to consider
- Jotform: compare HIPAA-enabled plan eligibility, BAA activation and workflow controls.
- Google Forms: review a managed Workspace account and included-functionality scope.
- Microsoft Forms: verify tenant, agreement and connected storage scope.
Google Forms
HIPAA: Conditional | SOC 2: Google public evidence
Microsoft Forms
HIPAA: Conditional | SOC 2: Microsoft audit evidence
Jotform
HIPAA: Conditional | SOC 2: Public evidence
Wix
HIPAA: Conditional | SOC 2: Verify with vendor
Typeform
HIPAA: Conditional — contract verification | SOC 2: Verify current product report
FAQ
Is Formstack HIPAA compliant?
Formstack describes a conditional path for Forms HIPAA/Healthcare accounts. Confirm the plan, activation and executed BAA, then test the full intake data path.
Does Formstack offer a BAA?
Its Healthcare help guide describes a BAA signing commitment. Contact Support to confirm the actual agreement and covered account before PHI use.
Are all Formstack integrations covered for PHI?
No blanket coverage follows from the integration catalog. Check the current Healthcare-compatible list and the agreement and configuration of every receiving system.
Will Formstack sign a BAA?
The Healthcare help guide describes signing a BAA and contacting Support to activate a Healthcare plan. Obtain the executed agreement for your account and services; public documentation is not your contract.
Can Formstack be used with PHI?
Do not use this vendor with PHI until your organization verifies BAA scope, covered services, configuration, access controls, data retention, and connected integrations.
Does SOC 2 mean Formstack is HIPAA compliant?
No. SOC 2 evidence can support security diligence, but it does not prove HIPAA compliance, confirm BAA coverage, or approve PHI use. Review HIPAA terms, BAA scope, covered services, configuration, and intended workflow separately.
What should buyers verify before using Formstack with PHI?
Ask Support to identify the exact Healthcare plan, activation state and BAA-covered Forms services in writing. Trace a synthetic submission through storage, SMTP notifications, uploads, actions, exports and deletion. Confirm the destination agreement and configuration for each supported integration; review Documents, Sign and Salesforce products separately.
Last checked and source notes
- Last checked
- 2026-10-29
- Confidence
- Medium
- Dataset rows
- 280 vendors
- Official public documentation checked October 29, 2026. Customer contracts and account settings were not inspected.
- The questions and data-path checks are ComplySaaS procurement guidance, not vendor certification.
- Formstack — Maintaining HIPAA Compliance
- Formstack — Healthcare Compatible Integrations
- Formstack — Forms Data Security