HIPAA-Compliant Online Forms for Small Practices, With a Signed BAA From Day One
By William Heath, Founder · Last updated
Patients fill out your forms on their phone. Their answers stay in a locked-down healthcare system, and none of it lands in anyone's inbox.
No agency certifies forms as HIPAA compliant. An online form can be used for patient information when the vendor storing the answers signs a Business Associate Agreement with your practice and protects the data with access controls, audit logs and safeguards for storage and transmission. GetDocsSigned healthcare accounts are covered by our BAA and start at $199 a month per practice.
| Covered by our BAA (healthcare accounts only) | Not covered, never use for patient information |
|---|---|
| Healthcare forms and their submissions | E-signature envelopes and their signed documents |
| Patient records and files | Document packets |
| Fax: sending, inbox and matching to orders | Payments |
| Physician order and authorization tracker | The AI form builder (blank templates only) |
| Every regular or free GetDocsSigned account |
From $199 a month per practice, unlimited staff users. We set up your forms from your blank PDFs.
What makes an online form HIPAA compliant?
A form is HIPAA compliant when the company storing the answers signs a Business Associate Agreement (BAA) with you and protects the data the way HIPAA's Security Rule requires. No government body certifies software as HIPAA compliant, so a "HIPAA compliant" badge proves nothing on its own. These are the things to check:
| Requirement | Where it comes from | What to ask the vendor |
|---|---|---|
| A signed BAA on the plan you buy | 45 CFR 164.502(e) and 164.504(e) | Will you sign a BAA on this plan, or only a higher one? |
| A separate login for every staff member | Security Rule, unique user identification, 164.312(a)(2)(i) | Does each person get their own login, or do we share one? |
| A record of who opened what | Security Rule, audit controls, 164.312(b) | Is every view and change of patient data logged? |
| Encryption in transit and at rest (an "addressable" safeguard) | Security Rule, 164.312(a)(2)(iv) and (e)(2)(ii) | Are answers and uploaded files encrypted when sent and when stored? |
| No patient answers in email notices | Not a rule: email providers aren't covered by your form vendor's BAA | Does the "new submission" email contain any answers? |
| Every connected tool covered or off | Each service that receives the data is a business associate too | Which integrations, add-ons and trackers touch the answers? |
| Your practice's own risk analysis | Security Rule, 164.308(a)(1)(ii)(A) | Not a vendor question: your practice documents how it protects patient data, including the form tool |
HIPAA sets the safeguards; it doesn't approve products. A vendor's security practices help your practice meet the rule, but the BAA and your own risk analysis are what make using the tool compliant.
Two traps catch most practices. First, many form builders sign a BAA only on their top plans, so the free or starter plan you tried can't be used for patients. Second, the BAA covers only the form vendor. An add-on, a spreadsheet sync or an analytics script on the form page can send patient answers somewhere the BAA doesn't reach.
How does GetDocsSigned meet each requirement?
Healthcare accounts run on a separate system built only for patient data, on a dedicated Amazon Web Services account. We sign our own BAA with your practice, and every AWS service that holds patient data is a HIPAA-eligible service covered by Amazon's BAA. Here is how it answers each question above:
| Requirement | How a GetDocsSigned healthcare account handles it |
|---|---|
| Signed BAA | We sign one with every healthcare account before any patient fills out a form. Healthcare accounts are set up by hand; there is no self-serve signup. |
| Separate logins | Every staff member gets their own login, with unlimited staff users at no extra cost. |
| Access record | Every view and change of patient data is logged with who did it and when. The log itself holds no patient answers. |
| Encryption | Answers and uploaded files are encrypted in transit and at rest. |
| Email notices | The "new submission" email says a form came in and links to it. It never contains answers. |
| Connected tools | Patient form pages live on their own site with no analytics or tracking scripts. Faxes go through Sinch under its own BAA, set not to keep copies. |
Each practice's data is walled off from every other practice's at the database level. Patients fill out forms on their phone, and staff download each completed form as a PDF to file in the EHR.
The same account also holds patient records and files, sends and receives faxes and matches returned faxes to orders, and tracks physician order and insurance authorization renewals. For therapy practices, see how it works for speech therapy.
The coverage box at the top of the page lists exactly what our BAA covers and what it doesn't.
How does GetDocsSigned compare with other HIPAA form tools?
Every tool below can be used for patient forms, but most sign a BAA only on a paid or top-tier plan. The real differences are which plan you need, what it costs and what comes with it.
| Tool | BAA available on | Lowest listed price with a BAA | Signatures on forms under the BAA | Good to know |
|---|---|---|---|---|
| GetDocsSigned | Healthcare accounts only | $199 a month per practice | Signature and initials fields, saved in the form's PDF; separate e-signature envelopes aren't covered | Unlimited staff users; form setup, fax and an order and authorization tracker included |
| Jotform | Gold and Enterprise plans | $99 a month billed yearly, $129 month to month | Yes | Jotform's pricing FAQ calls Enterprise its only multi-user plan |
| Cognito Forms | Enterprise plan | $129 a month billed yearly, $174 month to month | Yes | Calculations and payment fields |
| HIPAAtizer | Every plan, including the free Developer Sandbox | Free Developer Sandbox; paid plans from $29 a month billed yearly | Yes; e-signatures listed from the Gold plan | AI turns PDF or Word forms into online forms; WordPress plugin |
| FormDr | Its Complete plan; a custom BAA on Enterprise | Quoted by practice size | Yes | Intake packets and automated appointment reminders |
| IntakeQ | All plans | $29.90 a month, capped at 10 submissions | Yes | Priced per practitioner; practice management plans also available |
| Google Forms | Google Workspace, after your admin accepts Google's BAA | Included in Workspace | No signature field | Add-ons aren't covered |
Verified October 2026 against each vendor's own pricing page. Confirm the plan and BAA terms with the vendor before you buy. Compare HIPAA intake tools for therapy practices
Where the others win: if you need one simple form and already pay for Workspace, Google Forms costs nothing extra. If you're a solo clinician with low volume, HIPAAtizer and IntakeQ cost less. GetDocsSigned is built for practices with several staff who also handle faxes and physician orders.
Who is GetDocsSigned built for, and who should look elsewhere?
It's built for small outpatient practices that keep their EHR and want the paperwork around it handled: intake forms, faxes and order renewals. Therapy practices that renew physician orders and insurance authorizations get the most from it.
A good fit if you:
- have several staff who all need to see completed forms
- still fax orders and records to physicians’ offices
- track order or authorization renewals in a spreadsheet today
- want one flat price instead of a per-clinician fee
Look elsewhere if you:
- need intake answers written straight into your EHR; GetDocsSigned gives you a PDF to file
- want copays collected or e-signature envelopes sent inside the HIPAA system
- want automated text or email reminders sent to patients
- are a solo clinician with a few forms a month; a cheaper tool in the table will do
Who uses it today?
A speech therapy practice in Wilmington, North Carolina runs its intake forms, patient records, faxes and order renewals on a GetDocsSigned healthcare account. It moved everything over in October 2026.
What else do people ask?
Is there a HIPAA certification for form software?
No. The U.S. Department of Health and Human Services doesn't certify software as HIPAA compliant. Look for a signed BAA and a clear description of the vendor's safeguards instead. GetDocsSigned holds no SOC 2 report or other third-party certification.
Does HIPAA require forms to be encrypted?
The Security Rule lists encryption as "addressable," which means you must use it or document why an equal safeguard is reasonable. In practice, any form tool that stores patient answers should encrypt them in transit and at rest.
Is Google Forms HIPAA compliant?
Only in a Google Workspace account whose administrator has accepted Google's BAA. A personal Google account has no administrator to accept it, so it can't be used for patient data. Read more
Is Jotform HIPAA compliant?
Only on its Gold or Enterprise plan, with HIPAA features turned on and its BAA signed. Read more
Do patients need an account to fill out a form?
No. Patients open a link and fill out the form on their phone or computer.
Can you turn our paper forms into online forms?
Yes. Send us your blank PDFs and we set up the online versions; it's included in the price. Never send forms a patient has already filled out.
Can I try it on a free account first?
Not with patient information. Free and regular GetDocsSigned accounts aren't covered by a BAA. Healthcare accounts are set up by hand after a short call.
How much does it cost?
Healthcare accounts start at $199 a month per practice, with unlimited staff users. That includes the BAA and setting up your forms from your blank PDFs. Practices with several locations get a quote.
How do we get started?
Tell us about your practice with the form below, and we'll set up a short call. If you want to read our BAA first, say so in the form and we'll email it before the call.
- On the call, we look at your current forms and walk you through pricing, which starts at $199 a month.
- We sign a BAA with your practice and set up your forms from your blank PDFs.
- You send patients the link, and completed forms show up for your staff.
Please don't include patient information in this form. Healthcare accounts are set up by us with a signed BAA, so don't enter patient data into a regular trial account.
Sources: 45 CFR 164.502 (eCFR); 45 CFR 164.504 (eCFR); 45 CFR 164.308 (eCFR); 45 CFR 164.312 (eCFR); HHS: misleading marketing claims; HHS: Are we required to certify our compliance?; Jotform HIPAA pricing; Jotform pricing; Jotform HIPAA; Cognito Forms pricing; Cognito Forms HIPAA compliance; Cognito Forms features; HIPAAtizer; HIPAAtizer pricing; FormDr pricing; IntakeQ pricing; Google Workspace: HIPAA compliance; Google Workspace: HIPAA Included Functionality; Google Forms question types. Checked October 2026.