Independent vendor compliance review
Is Typeform HIPAA Compliant?
Typeform publishes a sales-led BAA path, but its official pages differ on eligible plan wording. The BAA article lists Enterprise or Growth Custom; the Enterprise guide names Growth Custom in its HIPAA section. Obtain written confirmation of your exact plan and covered features before collecting PHI.
Direct compliance answer
Typeform HIPAA, BAA, PHI, and SOC 2 snapshot
Last checked: 2026-10-29 | Confidence: Medium
| Direct answer | Typeform publishes a sales-led BAA path, but its official pages differ on eligible plan wording. The BAA article lists Enterprise or Growth Custom; the Enterprise guide names Growth Custom in its HIPAA section. Obtain written confirmation of your exact plan and covered features before collecting PHI. |
|---|---|
| BAA availability | Ask Sales for the BAA and written confirmation of the account, plan, features and processing scope. Do not assume a self-service subscription includes this agreement. |
| Can it handle PHI? | Survey responses, URL parameters and hidden fields can expose health context. Keep PHI out of tracking URLs and unsupported analytics or integration destinations. |
| SOC 2 caveat | A BAA or HIPAA marketing statement does not establish SOC 2 report scope. Request the current report for the contracted product. |
| What to verify | Give Sales a field-level description of the proposed survey and request written plan and BAA scope confirmation. Map question answers, hidden fields, upload locations, notification content, exports and retention. |
Scope of this profile
Resolve Typeform contract and plan scope for the intended questionnaire before PHI use.
Independent research view
Typeform plan and data-path decision checks
Use these checks with the official sources below before choosing or migrating an intake workflow.
| Review area | Vendor public signal | Buyer verification |
|---|---|---|
| Plan and agreement | Ask Sales for the BAA and written confirmation of the account, plan, features and processing scope. Do not assume a self-service subscription includes this agreement. | Give Sales a field-level description of the proposed survey and request written plan and BAA scope confirmation. |
| Workflow boundary | Conditional: public plan wording is inconsistent, so an Enterprise label alone is insufficient evidence of coverage. | Map question answers, hidden fields, upload locations, notification content, exports and retention. |
| Destinations and copies | The Enterprise guide instead mentions Growth Custom in its HIPAA section. Resolve this discrepancy in the signed order and agreement. | Review each analytics script, embedded host and downstream integration separately before enabling it on a PHI workflow. |
HIPAA status signal
Conditional — contract verification
BAA public signal
Sales-led BAA — resolve plan scope
SOC 2 evidence signal
Verify current product report
PHI warning: Survey responses, URL parameters and hidden fields can expose health context. Keep PHI out of tracking URLs and unsupported analytics or integration destinations.
Search query answers
Is Typeform HIPAA compliant?
Typeform offers a conditional BAA path through Sales. Its official plan descriptions differ, so verify the exact account, agreement and features before introducing PHI.
Which Typeform plans offer a BAA?
The dedicated BAA article lists Enterprise or Growth Custom, while the Enterprise guide refers to Growth Custom. Request written clarification and the executed BAA; do not rely on a plan name alone.
Can Typeform surveys collect patient information?
Only after your organization verifies agreement coverage, configuration and the full response data path, including notifications, uploads, exports, scripts and connected tools.
HIPAA, BAA, and SOC 2 summary
| HIPAA | Conditional: public plan wording is inconsistent, so an Enterprise label alone is insufficient evidence of coverage. |
|---|---|
| BAA | Ask Sales for the BAA and written confirmation of the account, plan, features and processing scope. Do not assume a self-service subscription includes this agreement. |
| SOC 2 | A BAA or HIPAA marketing statement does not establish SOC 2 report scope. Request the current report for the contracted product. |
| PHI risk | Survey responses, URL parameters and hidden fields can expose health context. Keep PHI out of tracking URLs and unsupported analytics or integration destinations. |
| Category | HIPAA-Compliant Forms and Intake Software |
| Last checked | 2026-10-29 |
| Confidence | Medium |
Public evidence and open questions
What public sources say
- The dedicated BAA article identifies Enterprise and Growth Custom and directs customers to Sales.
- The Enterprise guide instead mentions Growth Custom in its HIPAA section. Resolve this discrepancy in the signed order and agreement.
What remains unconfirmed
- Which current commercial offer covers the intended account and feature set.
- Contractual coverage of uploads, notifications, enrichment, AI, analytics and connected applications.
What it may be used for
- Non-PHI surveys and product research.
- A regulated questionnaire only after the contracted account and every data destination have been verified.
What not to use it for
- Collecting patient health details on an unverified self-service plan.
- Assuming an executed BAA covers every optional feature or external recipient.
What to verify with the vendor
- Give Sales a field-level description of the proposed survey and request written plan and BAA scope confirmation.
- Map question answers, hidden fields, upload locations, notification content, exports and retention.
- Review each analytics script, embedded host and downstream integration separately before enabling it on a PHI workflow.
Safer alternatives and related profiles
Safer alternatives to consider
- Jotform: compare HIPAA-enabled plan eligibility, BAA activation and workflow controls.
- Google Forms: review a managed Workspace account and included-functionality scope.
- Microsoft Forms: verify tenant, agreement and connected storage scope.
Google Forms
HIPAA: Conditional | SOC 2: Google public evidence
Microsoft Forms
HIPAA: Conditional | SOC 2: Microsoft audit evidence
Jotform
HIPAA: Conditional | SOC 2: Public evidence
Wix
HIPAA: Conditional | SOC 2: Verify with vendor
Formstack
HIPAA: Conditional — Forms Healthcare | SOC 2: Verify current product report
FAQ
Is Typeform HIPAA compliant?
Typeform offers a conditional BAA path through Sales. Its official plan descriptions differ, so verify the exact account, agreement and features before introducing PHI.
Which Typeform plans offer a BAA?
The dedicated BAA article lists Enterprise or Growth Custom, while the Enterprise guide refers to Growth Custom. Request written clarification and the executed BAA; do not rely on a plan name alone.
Can Typeform surveys collect patient information?
Only after your organization verifies agreement coverage, configuration and the full response data path, including notifications, uploads, exports, scripts and connected tools.
Will Typeform sign a BAA?
Ask Sales for the BAA and written confirmation of the account, plan, features and processing scope. Do not assume a self-service subscription includes this agreement.
Can Typeform be used with PHI?
Do not use this vendor with PHI until your organization verifies BAA scope, covered services, configuration, access controls, data retention, and connected integrations.
Does SOC 2 mean Typeform is HIPAA compliant?
No. SOC 2 evidence can support security diligence, but it does not prove HIPAA compliance, confirm BAA coverage, or approve PHI use. Review HIPAA terms, BAA scope, covered services, configuration, and intended workflow separately.
What should buyers verify before using Typeform with PHI?
Give Sales a field-level description of the proposed survey and request written plan and BAA scope confirmation. Map question answers, hidden fields, upload locations, notification content, exports and retention. Review each analytics script, embedded host and downstream integration separately before enabling it on a PHI workflow.
Last checked and source notes
- Last checked
- 2026-10-29
- Confidence
- Medium
- Dataset rows
- 280 vendors
- Official public documentation checked October 29, 2026. Customer contracts and account settings were not inspected.
- The questions and data-path checks are ComplySaaS procurement guidance, not vendor certification.
- Typeform — Business Associate Agreement
- Typeform — Enterprise plan and HIPAA wording