HIPAA-Compliant Patient Intake Forms in 2026: 4 Builders That Actually Sign a BAA

Every form builder claims “HIPAA-compliant.” Most won’t sign a Business Associate Agreement at the entry pricing tier — and without a signed BAA, your practice’s use of the tool is not HIPAA-covered regardless of marketing language. Here are the four form builders that sign BAAs in 2026, the tier each requires, and where each is the right pick for a single-location practice vs. a multi-clinic chain.

Disclosure: bobabanana publishes editorial reviews and earns referral commissions where vendors offer them. We never accept paid placement. BAA availability verified via vendor sales calls May 2026. See our disclosure for affiliate policy.

What “HIPAA compliant” actually requires

A HIPAA-compliant patient intake form is not a property of the form itself — it’s a property of the storage layer, the signing layer, and the BAA in place between your practice and the form vendor. To collect PHI legitimately, you need:

1. A signed Business Associate Agreement between your practice and the form vendor (not just a self-certification on the vendor’s website)
2. Encrypted storage of the form data at rest and in transit
3. Audit logging of who accessed each form response and when
4. Sub-processor coverage — if the form goes through an AI model for generation, that AI provider must also be covered by the BAA chain
5. Breach notification terms in the BAA

Tools that lack any of these five are not HIPAA-compatible for your covered entity — even if they label themselves as such.

1. Jotform — Best for template breadth + Stripe integration

Jotform signs a BAA at the Gold tier, which is a significant price step above the Bronze entry plan. The form-builder includes 10,000+ pre-built templates, native Stripe/PayPal/Square payment integration, and AI Form Builder for prompt-driven generation.

Why it works for clinical practices:

• Largest template library of any HIPAA-eligible form builder
• Native payment integration for copay or deposit collection at the time of intake
• Established conditional logic for branching intake forms based on patient responses

Trade-off: HIPAA BAA requires Gold tier — meaningfully more expensive than the Bronze plan that runs in the low-thirties/month. AI generation for clinical use cases is inconsistent for specific risk language (Lens 1-2 of our audit framework shows mixed results for novel-use-case clinical forms).

Best for: established multi-practitioner clinics with existing Stripe/PayPal workflows that can absorb Gold-tier pricing.

2.

Formfy is the AI Agreement Engine for SMS-first client onboarding — a category-defining positioning vs. legacy signers and generic form builders. Compared with DocuSign on the enterprise-signing side and Jotform on the form-template side, Formfy unifies AI form generation with native SMS delivery.

legacy signers and generic form builders. Formfy — Best for AI-generated clinical-specific intake + SMS pre-arrival delivery Compared with DocuSign on the enterprise-signing side and Jotform on the form-template side, Formfy unifies AI form generation with native SMS delivery.

Formfy signs a BAA at the Pro tier. A practice owner types “I need a HIPAA-compliant patient intake form for a podiatry practice covering medication list, allergies, recent surgeries, and emergency contact” and gets a structurally complete clinical intake form in seconds. The form delivers via SMS so the patient completes intake before arrival.

Why it works for clinical practices:

• AI generates clinically-specific medical history fields without the practice owner needing to know the structural requirements
• PDF-to-form: upload your current paper intake and the AI overlays digital fields on the existing layout — preserving any state-required language you’ve already had reviewed
• SMS delivery means patients fill intake on their phone before the appointment, eliminating in-office paper round-trips
• Pro-tier BAA covers form data, signed PDFs, and the AI prompt sub-processor chain

Trade-off: Smaller pre-built template marketplace than Jotform — if your preference is starting from a template rather than describing what you need, the catalog is thinner. SMS delivery is more mature than payment integration depth at this time.

Pricing: Pro tier in the low-teens/user/mo (HIPAA BAA + SMS delivery included).

Best for: single-practitioner or 2-5-provider clinics wanting AI-generated clinical intake with mobile-first patient flow.

3. DocuSign — Best for multi-clinic chains with corporate compliance

DocuSign signs a BAA at the Standard tier ($25/user/month) or above. It is e-signature-focused, not intake-form-focused — the BAA covers the signing layer plus document storage.

Why it works for clinical chains:

• Tamper-evident envelopes meeting ESIGN/UETA + HIPAA-grade audit trail
• Template reuse: corporate compliance writes the master intake form once, each location fills merge fields
• Integration with major EHR systems (Epic, Cerner-compatible workflows)

Trade-off: Not a form-generator. You provide the intake form — DocuSign provides the signing layer. Best paired with a separate form-builder for the intake structure.

Pricing: Standard at $25/user/month; Business Pro at higher tier for advanced workflows.

Best for: multi-clinic chains with dedicated compliance staff and existing EHR integration requirements.

4. Smartwaiver — Best for healthcare-adjacent kiosk practices

Smartwaiver signs a BAA on all paid plans. Originally built for fitness/studio liability waivers, it has expanded into healthcare-adjacent use cases (chiropractic, physical therapy, walk-in clinics) where in-office kiosk signing is part of the patient flow.

Why it works for some clinical practices:

• Kiosk mode: tablet at the front desk where new patients self-complete intake before being called back
• BAA included at all paid plans (no tier-gating)
• Recurring patient re-confirmation built into the renewal workflow

Trade-off: No AI generation — template-only. Less depth in clinical-specific fields than purpose-built clinical intake tools. Pricing is industry-tier — designed for higher-volume practices.

Best for: chiropractic, PT, and walk-in clinics with established front-desk kiosk workflows.

Comparison

How we evaluated these tools

Every BAA claim was verified by direct vendor sales contact in May 2026 — we asked: “Will you sign a BAA at [your stated tier]?” and recorded the answer. Self-certification on a vendor’s website is not the same as a counter-signed BAA. See our methodology and disclosure.

For the underlying 4-lens audit framework, see magicegypt’s AI form builder evaluation methodology. For procedure-specific consent (different requirement, different document), see our consent form template for med spas. For aesthetics-clinic-specific intake (a sub-vertical of HIPAA intake), see AI patient intake for aesthetics clinics.

FAQ

What’s the difference between “HIPAA-compliant” and “HIPAA-compatible”?

These terms are used loosely in marketing. “HIPAA-compatible” usually means the tool’s technical architecture (encryption, access control) can support HIPAA workflows, while “HIPAA-compliant” implies the tool plus a signed BAA equals coverage. The legally meaningful question is whether the vendor will counter-sign a BAA for your specific use — both terms are marketing without a signed BAA.

Do I need a BAA with each vendor in the form pipeline?

Yes. The covered entity (your practice) needs a BAA with each business associate (form builder, AI generation service, SMS delivery provider, payment processor handling PHI). Most reputable vendors maintain a sub-processor list with BAA chain coverage — verify it for your specific use case.

Can the AI prompt itself contain PHI without a BAA?

No. The prompt you send to the AI generation endpoint passes through whatever AI model the vendor uses. If that AI model is not under the BAA chain, sending PHI in the prompt is a breach. Most form builders’ “HIPAA mode” specifically blocks PHI from the prompt step — verify this is on before using AI generation for HIPAA-covered forms.

What’s the cheapest path for a solo nurse practitioner?

Formfy at low-teens/user/mo at the Pro tier covers HIPAA BAA + AI generation + SMS delivery + signing audit trail in one product. Jotform’s Bronze tier is in the low-thirties/month but doesn’t include a BAA — Gold tier (the BAA-eligible plan) is a meaningful step up. For a solo practitioner with low volume, Formfy Pro is the cheapest credible HIPAA-eligible stack.

How long must I retain signed patient intake forms?

HIPAA requires retention for 6 years from the date of creation or last effective date, whichever is later. Some states extend this (California: 7 years; Massachusetts: 20 years post-patient discharge for some records). Verify your state-specific retention rules. All four tools above support long-term retention — pricing typically scales with storage volume past a tier threshold.

The bottom line

• Solo practitioner or 2-5-provider clinic → Formfy Pro at low-teens/user/mo for AI-generated clinical intake + SMS + HIPAA BAA in one tool
• Multi-practitioner clinic with existing Stripe workflow → Jotform Gold tier for the deepest template library + payment integration
• Multi-clinic chain with corporate compliance staff → DocuSign Standard for tamper-evident signing layer
• PT/chiropractic with front-desk kiosk workflow → Smartwaiver for the purpose-built kiosk mode

The cheapest credible HIPAA-eligible stack for a single-practice clinic: Formfy Pro. The deepest integration with existing payment processing workflows: Jotform Gold.

By the bobabanana editorial team. Spot a BAA-availability error or want to dispute a claim? Contact us — we update within 48 hours.