Independent vendor compliance review
Is SurveyMonkey HIPAA compliant?
SurveyMonkey’s Trust Center limits its HIPAA add-on to Enterprise customers and says it must be purchased separately. Regulated PHI collection requires a HIPAA-enabled account with a BAA in place. An Enterprise subscription alone does not establish coverage.
Direct compliance answer
SurveyMonkey HIPAA, BAA, PHI, and SOC 2 snapshot
Last checked: 2026-11-04 | Confidence: Medium
| Direct answer | SurveyMonkey’s Trust Center limits its HIPAA add-on to Enterprise customers and says it must be purchased separately. Regulated PHI collection requires a HIPAA-enabled account with a BAA in place. An Enterprise subscription alone does not establish coverage. |
|---|---|
| BAA availability | Contact SurveyMonkey for its standard BAA and account activation. Obtain a copy of the executed agreement and verify which team and services it covers. |
| Can it handle PHI? | Responses and attachments can leave the platform through notifications, exports and connected services. Trace each copy before introducing PHI. |
| SOC 2 caveat | Obtain the current SOC 2 report and scope for the contracted service; HIPAA or BAA eligibility alone is not SOC 2 evidence. |
| What to verify | Confirm the add-on purchase, HIPAA-enabled team/account and executed BAA before inviting respondents. Review collector links, sharing, exports, notifications and transfers with synthetic survey responses. |
Scope of this profile
Evaluate SurveyMonkey survey collectors, the separately purchased Enterprise HIPAA add-on and account lifecycle. Compare intake workflows separately from survey analytics.
Independent research view
SurveyMonkey plan and BAA scope
Evaluate SurveyMonkey survey collectors, the separately purchased Enterprise HIPAA add-on and account lifecycle. Compare intake workflows separately from survey analytics.
On small screens, scroll the table horizontally to see buyer verification checks.
| Review area | Vendor public signal | Buyer verification |
|---|---|---|
| Enterprise add-on | HIPAA is a separately purchased Enterprise add-on. | Confirm the order, enabled account/team and executed BAA. |
| Survey collection | Collector, sharing and export choices change the response data path. | Test recipient access and exported copies; do not put PHI in tracking URLs. |
| Account lifecycle | HIPAA-enabled accounts cannot revert to regular accounts. | Plan retention, controlled transfers and closure with Support before terminating the BAA. |
HIPAA status signal
Conditional — Enterprise HIPAA add-on
BAA public signal
Enterprise add-on + enabled account + BAA
SOC 2 evidence signal
Verify current product report
PHI warning: Responses and attachments can leave the platform through notifications, exports and connected services. Trace each copy before introducing PHI.
Search query answers
Is SurveyMonkey HIPAA compliant?
Conditionally: its Enterprise HIPAA add-on, HIPAA-enabled account and BAA are required for regulated PHI collection. Validate the survey workflow too.
Which SurveyMonkey plan offers a BAA?
The Trust Center describes a separately purchased Enterprise HIPAA add-on. Contact SurveyMonkey to confirm activation and the actual BAA for the account.
Can a HIPAA-enabled SurveyMonkey account downgrade to a regular account?
The help guide says it cannot revert to a regular account. Review closure, transfers and retention with Support before terminating the BAA.
HIPAA, BAA, and SOC 2 summary
| HIPAA | Scope the Enterprise HIPAA add-on, activated account and agreement together; do not extend coverage to ordinary survey plans or other products. |
|---|---|
| BAA | Contact SurveyMonkey for its standard BAA and account activation. Obtain a copy of the executed agreement and verify which team and services it covers. |
| SOC 2 | Obtain the current SOC 2 report and scope for the contracted service; HIPAA or BAA eligibility alone is not SOC 2 evidence. |
| PHI risk | Responses and attachments can leave the platform through notifications, exports and connected services. Trace each copy before introducing PHI. |
| Category | HIPAA-Compliant Forms and Intake Software |
| Last checked | 2026-11-04 |
| Confidence | Medium |
Public evidence and open questions
What public sources say
- The Trust Center describes HIPAA as a separately purchased Enterprise add-on.
- The help guide warns that a HIPAA-enabled account cannot revert to a regular account; terminating the BAA closes the account.
What remains unconfirmed
- Negotiated price, covered optional features and the buyer’s executed agreement.
- Account-specific recipients, data location and downstream service scope.
What it may be used for
- Non-PHI evaluation using synthetic records.
- Regulated workflows only after account-specific agreement and configuration verification.
What not to use it for
- Collecting PHI on an unverified plan or assuming coverage extends to every integration.
What to verify with the vendor
- Confirm the add-on purchase, HIPAA-enabled team/account and executed BAA before inviting respondents.
- Review collector links, sharing, exports, notifications and transfers with synthetic survey responses.
- Keep SurveyMonkey survey scope separate from Wufoo and other products; request explicit scope for optional AI and integrations.
Safer alternatives and related profiles
Safer alternatives to consider
- Formstack: review Forms Healthcare activation, BAA and integration scope.
- Jotform: compare Gold and Enterprise eligibility, activation and workflow scope.
- Managed Google or Microsoft Forms: verify the relevant business agreement and connected systems.
Google Forms
HIPAA: Conditional | SOC 2: Google public evidence
Microsoft Forms
HIPAA: Conditional | SOC 2: Microsoft audit evidence
Jotform
HIPAA: Conditional | SOC 2: Public evidence
Wix
HIPAA: Conditional | SOC 2: Verify with vendor
Formstack
HIPAA: Conditional — Forms Healthcare | SOC 2: Verify current product report
FAQ
Is SurveyMonkey HIPAA compliant?
Conditionally: its Enterprise HIPAA add-on, HIPAA-enabled account and BAA are required for regulated PHI collection. Validate the survey workflow too.
Which SurveyMonkey plan offers a BAA?
The Trust Center describes a separately purchased Enterprise HIPAA add-on. Contact SurveyMonkey to confirm activation and the actual BAA for the account.
Can a HIPAA-enabled SurveyMonkey account downgrade to a regular account?
The help guide says it cannot revert to a regular account. Review closure, transfers and retention with Support before terminating the BAA.
Will SurveyMonkey sign a BAA?
Contact SurveyMonkey for its standard BAA and account activation. Obtain a copy of the executed agreement and verify which team and services it covers.
Can SurveyMonkey be used with PHI?
Do not use this vendor with PHI until your organization verifies BAA scope, covered services, configuration, access controls, data retention, and connected integrations.
Does SOC 2 mean SurveyMonkey is HIPAA compliant?
No. SOC 2 evidence can support security diligence, but it does not prove HIPAA compliance, confirm BAA coverage, or approve PHI use. Review HIPAA terms, BAA scope, covered services, configuration, and intended workflow separately.
What should buyers verify before using SurveyMonkey with PHI?
Confirm the add-on purchase, HIPAA-enabled team/account and executed BAA before inviting respondents. Review collector links, sharing, exports, notifications and transfers with synthetic survey responses. Keep SurveyMonkey survey scope separate from Wufoo and other products; request explicit scope for optional AI and integrations.
Last checked and source notes
- Last checked
- 2026-11-04
- Confidence
- Medium
- Dataset rows
- 280 vendors
- Official public plan and BAA sources checked November 4, 2026; no private account or contract was inspected.
- Workflow verification steps are ComplySaaS procurement guidance.
- SurveyMonkey — Trust Center plan and add-on scope
- SurveyMonkey — HIPAA account, BAA and lifecycle