Is Jotform HIPAA compliant? Yes, as long as you’re on the right plan and set it up properly. That matters because most business websites collect leads with a WordPress form plugin. For a quote request or a newsletter signup, that’s fine. When a form collects health information, signatures, ID documents or bank statements, a standard WordPress form often isn’t the right tool. Here’s how we decide when a client should move to Jotform, with three real examples from our own clients: a 52-office dental group, a roller skating rink and a payment company that serves peptide brands.
Snazzy Solutions is a Jotform partner
We build and brand Jotform forms, embed them on our clients’ websites, turn on HIPAA features and route every submission to the right inbox. Then we test each form with a real submission. Jotform links in this post use our partner code.
Is Jotform HIPAA compliant?
Yes, on the Gold or Enterprise plan with HIPAA features turned on and a signed Business Associate Agreement. The free, Bronze and Silver plans don’t include HIPAA features.
Jotform’s HIPAA page says HIPAA features are available “either under the Gold or Enterprise plan,” and that eligible customers with those features turned on can sign a BAA with Jotform. Its pricing page lists HIPAA features as not available on the Starter (free), Bronze and Silver plans.
Once HIPAA features are on, Jotform says all data is encrypted in transit and at rest, and access to your data is tracked and kept in logs. You can also mark fields as protected health information (PHI) so their answers are left out of notification and autoresponder emails. Staff get an alert that a new submission came in and read the details inside Jotform, not in an inbox.
Jotform gives you a secure place to collect and store the data. Whether you’re following the rules still comes down to your setup: which fields are marked as PHI, who has a login, where the emails go and what’s running on the page around the form.
What is a BAA, and do you need one?
A Business Associate Agreement is a contract where a vendor promises to protect your patients’ health information. Healthcare providers need one with any vendor that handles that data.
The U.S. Department of Health and Human Services explains that a covered entity (a healthcare provider, health plan or clearinghouse) can share PHI with a vendor only after getting written assurances, called a business associate agreement, that the vendor will safeguard it. A form tool that receives patient intake or appointment details is one of those vendors.
On Jotform, the account owner can request a BAA signed by Jotform from the Data page of their account. If you’re not a healthcare business, you don’t need one. Jotform’s BAA itself says it has no legal effect if the customer isn’t a covered entity. You can still use Jotform for its security, as two of our three examples below do.
Are WordPress forms HIPAA compliant?
Not on their own. A WordPress form saves entries in your website’s database and emails them in full, so your host, email provider and backups all end up holding the data.
We build a lot of WordPress sites and we like WordPress form plugins. But think about where one submission goes after a patient presses Send:
- Your website database. Every entry is stored on your web server, next to your pages and plugins.
- Your email. The notification usually contains every answer, so it sits in several inboxes (and their phones) for years.
- Your uploads folder. Many plugins save uploaded files in a folder on the server. Unless someone locks that folder down, a file can open for anyone who has the link.
- Your backups. Every nightly backup copies all of the above to another server.
- Your plugins. Any plugin on the site, including a hacked one, can read the database.
Building HIPAA compliant WordPress forms is possible, but every one of those places needs its own safeguards: a host that will sign a BAA, encrypted email, locked upload folders, strict logins and careful plugin choices. Most small practices don’t have that, and it’s easy for one update or one new plugin to undo it. Moving the form to Jotform takes the data off your website entirely. The form still sits on your page, but the answers go straight to Jotform’s servers.
The page around the form matters too. Ad and analytics tracking on patient pages has been a big source of lawsuits and federal guidance. We covered that in why small businesses are getting sued over their websites.
Stay tuned: we’re writing a full guide to HIPAA and your website, covering privacy notices, tracking on patient pages and cookie consent. We’ll link it here as soon as it’s live.
When is a WordPress form still the right choice?
When the form collects nothing sensitive: a contact form, a quote request or a newsletter signup. A good WordPress form is faster to build and keeps leads in your site.
We don’t move every form to Jotform. A plumber’s “request a quote” form or a restaurant’s catering inquiry doesn’t need it. Our test: if this submission landed in the wrong inbox, would it hurt someone? If the answer is yes, because it includes health details, a signature on a legal document, a Social Security number or a bank statement, it belongs in a secure form tool.
Why did Lane & Associates Family Dentistry need Jotform?
Their patients send appointment requests with insurance details, and other dentists send referrals with patient records. That’s protected health information, so it needed HIPAA features and a signed BAA.
Lane & Associates Family Dentistry runs 52 offices across North Carolina, and we built and manage their website. Their forms have a few jobs that make them tricky:
- Appointment requests ask about insurance, including Medicaid, and patients often add health details in the message box.
- Referrals come from other dental offices and can include patient files.
- Each request has to reach the right office. On Jotform, that’s more than 250 routing rules across seven forms, so a patient in Raleigh never lands in the Greensboro inbox.
We rebuilt all seven forms in Jotform, styled them to match the site and set up every routing rule. Their team turns on HIPAA features and signs the BAA, and then the forms go live across the site. A single form template covers about 113 pages, so one change updates every office, service and city page at once.
Patients type health details into any box you give them, even a general “Any questions?” form, so we leave out free-text boxes a form doesn’t really need.
Why does a roller skating rink need Jotform?
Round-A-Bout Skating Center needs signed liability waivers from every skater, often parents signing for kids. A waiver is a legal record, so it has to be stored safely and easy to find.
Round-A-Bout has three rinks in North Carolina: two in Fayetteville and one in Goldsboro. Today their website links to a printable waiver. That means paper at the front desk, forms that get lost and no easy way to find the waiver for a skater who got hurt last month.
A waiver isn’t health information, so HIPAA doesn’t apply. But it does collect children’s names, parent contact details and a legal signature. That’s not something we’d want sitting in a WordPress database and a shared inbox. The plan:
- One Jotform account with one waiver form per rink, so each rink sees only its own skaters.
- A signature field, so parents can sign on their phone before they arrive.
- An email to that rink for each new waiver, and every signed waiver saved and searchable in Jotform.
How does Tyche Pay use Jotform to collect documents securely?
Tyche Pay helps high-risk stores like peptide brands accept card payments. Each merchant uploads business and bank documents, and a Jotform upload form keeps those files out of email.
Tyche Pay provides card processing for high-risk stores, and many of its merchants sell peptides. Before a processor approves a merchant, it wants proof of who they are: business formation papers, tax ID letters, the owner’s ID and bank statements. Nobody should be sending those as email attachments, and a WordPress upload field would park them on a web server.
Instead, merchants upload everything through a Jotform form. The files stay in Jotform, and Jotform lets you require a Jotform login to open uploaded files, so a forwarded link alone doesn’t expose anything. We added an automatic check on top: every new upload gets reviewed, and the team gets a message listing which documents are still missing, so nobody chases merchants by hand.
If you’re starting a peptide store, the paperwork side is a big part of getting approved. Our guides on how to start a peptide business and whether it’s legal to sell peptides cover the rest.
What should a secure form setup include?
The right plan, protected fields left out of emails, logins on uploaded files, two-factor login, no ad tracking on the form page and a real test submission before launch.
These are the checks we run on every secure form project. Several come from problems we ran into ourselves:
- Pick the plan that matches the data. Health information needs the Gold plan or higher with HIPAA features on and a signed BAA.
- Mark sensitive fields as PHI so the answers stay out of every email.
- Require a login to open uploads, and turn on two-factor login for everyone with access.
- Keep ad pixels off pages with sensitive forms. A cookie banner “Accept” isn’t permission to share health data.
- Plan for conversion tracking. Jotform’s thank-you message shows inside its own frame, so your analytics may not see it. A redirect to a thank-you page on your site fixes that.
- Test with a real browser submission. Jotform doesn’t send notification emails for submissions created through its API, so a scripted test can look fine while the real emails never go out. We submit each form ourselves and read the email that arrives.
Can you put a Jotform form on a WordPress website?
Yes. You embed the form on any WordPress page and style it to match your brand. Visitors fill it out on your site, and the answers go straight to Jotform.
The form loads inside your page, uses your fonts and colors, and sends the visitor to your own thank-you page. The only difference is where the data ends up. That’s how all three projects above work: the website stays on WordPress, and only the sensitive forms move.
Frequently asked questions
Does Jotform sign a BAA?
Yes. On the Gold or Enterprise plan with HIPAA features turned on, the account owner can request a BAA signed by Jotform from the Data page of their account.
Is the free Jotform plan HIPAA compliant?
No. HIPAA features aren’t available on the free Starter plan, or on Bronze or Silver. You need the Gold plan or Enterprise.
Do I need HIPAA features if I’m not a healthcare business?
No. HIPAA applies to healthcare providers, health plans and their vendors. Businesses like a skating rink or a payment company can still use Jotform for signatures and secure uploads without a BAA.
Can Jotform forms match my website’s design?
Yes. Jotform forms can use your fonts, colors and button styles, and they embed right on your WordPress pages, so they look like part of your site.
Are Jotform file uploads secure?
Uploaded files stay in Jotform, not on your website. You can require a Jotform login to open them, so someone who only has the link can’t download the file.
Need secure forms on your website?
If your forms collect health information, signatures or private documents, we can move them to Jotform, match them to your brand, set up HIPAA features and the BAA where you need them, and test every one before launch. Your website stays exactly where it is. Contact us here or call (919) 444-2005.
