5 Best HIPAA-Compliant Form Builders: Plans, BAAs, and Fit

Compare five HIPAA-capable form builders by workflow, BAA eligibility, and plan cost. See where Jotform, Cognito Forms, Formstack, PlatoForms, and FormDr fit.
Katie Woon Last modified: September 16, 2026
Reading time: 8 minutes.

Jotform, Cognito Forms, Formstack, PlatoForms, and FormDoctor logos on white cards with a pale mint background.

Quick answer

Compare the cost of a HIPAA-enabled intake setup for your whole team, from patient completion to staff review and record storage. The eligible plan, Business Associate Agreement (BAA), staff access, and document workflow all matter. This guide focuses on collecting patient information and handling the resulting forms and PDFs.

PlatoForms is a fit for practices that want to keep existing PDF layouts, collect answers through mobile-friendly questions, or reuse patient details across several documents. Jotform offers broad form building, Cognito Forms emphasizes logic and review workflows, Formstack combines forms with document generation and signing, and FormDr offers clinic-focused intake with assisted setup.

Compare HIPAA Plans, Intake Features, and Team Costs

The five builders offer overlapping capabilities. Compare the HIPAA-eligible plan and staff access alongside the intake features you need; the list is not a scored ranking.

Builder Intake and document features Required HIPAA setup Eligible plan and billing
Jotform Web forms and templates, approval workflows, and PDF output Gold or Enterprise; enable HIPAA features and complete the BAA arrangement Gold: $129/month, or $1,188/year ($99/month equivalent). Enterprise: custom quote
Cognito Forms Conditional questions, calculations, and staff review workflows Paid Enterprise organization with a BAA; the trial is not eligible Enterprise: $174–$199/month, or $1,548–$1,788/year ($129–$149/month equivalent), depending on the pricing schedule offered; BAA included
Formstack Form collection; Suite adds document generation, approval routing, and e-signatures HIPAA add-on for Forms or Suite; confirm the covered products and BAA Forms: $99/month or $996/year ($83/month equivalent). Suite: $299/month or $3,000/year ($250/month equivalent). HIPAA add-on costs extra; quote required
PlatoForms Original-layout PDF forms or responsive questions, new web forms, online signing, shared answers across PDFs, and staff approvals Silver or Gold; the Team Admin activates the relevant team and obtains the BAA Silver: $36/month total or $360/year total ($30/month equivalent) for up to 20 team members; 20 published forms and 10,000 submissions/month shared across the team
FormDr Medical intake packets, electronic signatures, and assisted conversion of existing forms Signed BAA listed among included services Custom quote based on practice size, volume, and intake needs; confirm included conversion work

Prices checked September 16, 2026, in USD; annual equivalents require annual billing. Cognito’s official page currently lists two Enterprise schedules ($129/$174 and $149/$199 for annual-equivalent/monthly billing); confirm the one offered at signup. Formstack prices above are the base subscription, not the HIPAA-inclusive total. Taxes, promotions, and additional services may change the amount paid.

At the listed annual rates, PlatoForms Silver costs $360/year for up to 20 team members—$828 less than Jotform Gold, or about 70% lower. HIPAA team activation and a BAA are available on Silver. This is an entry-price comparison, not a claim of identical features or allowances.

Team access changes the comparison. Jotform identifies Enterprise as its multiuser plan. Cognito Enterprise lists 20 users, while FormDr lists assistant users and offers a tailored quote. PlatoForms Silver includes 20 members in one subscription, with shared form and submission allowances; use form and submission permissions to assign the access each colleague needs. Formstack lists one builder user on Forms and three on Suite; include any additional staff access and the HIPAA add-on in your quote.

1. Jotform: Broad Form Building and Approvals

Jotform suits organizations that need several kinds of forms, including patient intake. It offers a template-based builder, approval workflows, and Smart PDF output.

Its HIPAA pricing lists Gold and Enterprise as eligible. Gold is an individual account; distinguish staff administering the system from people participating in approvals. Check the Enterprise arrangement if you need multiuser administration.

Our PDF-focused Jotform comparison also covers shared account access and document handling.

2. Cognito Forms: Logic and Review Workflows

Cognito Forms suits intake processes with branching questions, calculated values, and internal review. Its plan comparison includes workflows and approvals, with HIPAA availability on Enterprise.

Its HIPAA support guide requires a paid Enterprise organization and a BAA; a trial is insufficient. Use sample data during evaluation. The guide also explains how signing the BAA enables authenticated access for public-role workflow links and Save & Resume links.

3. Formstack: Coordinated Form and Document Processes

Formstack is worth evaluating when several departments need collection, document generation, and signing under an organizational rollout. Its Healthcare & HIPAA Guide covers encryption, notifications, and plan-specific workflow options.

The plan comparison places document generation, approval routing, and e-signatures in Suite. Request a quote that includes the required products, staff access, and HIPAA add-on.

Check its healthcare-compatible integrations before planning a downstream connection. An integration available on an ordinary account may require a different configuration for PHI.

4. PlatoForms: PDF-Based Patient Intake and Staff Review

PlatoForms lets patients complete an existing PDF in its original layout or through a mobile-friendly web form whose answers populate the original PDF. For new paperwork, build a web form from scratch or use PDF Document Creator to create a document and turn it into an online form.

Use Master Forms when the same patient details belong on several PDFs, such as an intake form and consent packet. Map the shared fields so patients enter those details once. Conditional logic can show relevant follow-up questions based on their answers.

Patients can sign online. Signature certificates provide additional evidence when enabled for tracked invitations or Workflow steps. Public-link submissions do not generate certificates.

Team setup: Silver includes the members and shared allowances shown above; Gold provides higher limits. A Team Admin must request HIPAA activation for the relevant team and obtain the BAA before collecting PHI. Subscribing alone does not activate every team on an account. The activation also adds security measures such as automatic locking and team audit logs.

PlatoForms: Activate HIPAA team → Collect form entries → Retain PDF layout
PlatoForms supports HIPAA-enabled collection on eligible teams with a BAA; review notifications and connected services separately.

PlatoForms handles forms and the documents they generate. It does not replace the practice’s clinical record or billing system; choose how completed intake records will reach the system your staff use.

5. FormDr: Clinic Forms with Assisted Setup

FormDr focuses on medical intake. Its plans and pricing page describes form packets, document signing, assisted setup, and HIPAA support with a BAA. Pricing is quoted according to practice size, volume, and intake needs.

Assisted conversion suits clinics without time to rebuild their forms. The page advertises free conversion, but its FAQ also lists conversion and training charges, so confirm the work included in your quote. If you need an EHR connection, check the supported records, transfer direction, and integration cost.

From Patient Submission to Staff Review and Storage

After a patient submits, staff need to review the answers, retrieve documents, and store the records. Use the stages below to compare providers; the final column shows the corresponding PlatoForms setup.

Intake stage What your practice needs How to set it up in PlatoForms
Patient completion A working form link or website embed for the HIPAA-enabled team Follow the HIPAA team activation guide to update existing links and embed scripts before sharing the form with patients
Staff access Give each colleague access to the forms and patient responses their role requires Set form-editing and submission-viewing permissions; Team Admins can review access activity in the team audit log
Review and corrections Let staff approve a submission or return it for correction Add an Approval step and connect its Sent back path to the earlier form for corrections. Add a participant form step for staff entries or signatures
Completed records Retrieve the filled PDFs and structured response data Use submission exports for PDFs and CSV data. Choose recipients and attachments in form notification settings
Cloud delivery Save generated PDFs to the folder your team uses Set up Cloud Drive integration with a destination folder and optional subfolders named from submission values. Check the storage service’s BAA and staff access before sending PHI
Record retention Keep records for the period your practice requires, including exported copies The data retention policy lists “Forever” for HIPAA accounts. Maintain a backup policy and manage downloaded, emailed, and cloud-stored copies separately

PlatoForms’ BAA does not automatically cover the other services you connect. Review the receiving email and storage services before sending patient information; HHS cloud guidance explains the relevant BAA requirements. The platform’s “Forever” setting is not a legal retention requirement: HHS distinguishes medical-record retention from HIPAA rules. See the PlatoForms Trust Center for documented security controls.

Keep AI Setup Separate from Patient Data

Use blank paperwork and sample data with AI field detection, AI Form Generator, and AI-assisted document design. Review generated questions, PDF mappings, logic, and translations before using the form with patients.

Some AI features process data through external services. Voice Filling and MCP-connected assistants are off by default for HIPAA teams, and their processing is outside PlatoForms’ BAA. AI in Insights requires explicit consent in HIPAA workspaces before sending data to a third-party AI provider. Its report questions and summaries use aggregated numbers, while field analysis reads distinct answer values. Consent alone does not extend the BAA to that external processing.

Which Builder Fits Your Practice?

Shortlist PlatoForms when you need to keep existing PDF paperwork and give several staff members access under one HIPAA-eligible plan. Use the comparison table to check the price, form limits, and team allowance against your practice’s workload.

If your selection also depends on appointment reminders or EHR connections, see the patient intake software comparison for those broader requirements.

Frequently asked questions

Why consider PlatoForms for HIPAA-enabled PDF forms?

PlatoForms turns existing PDFs into online forms with the original layout or mobile-friendly questions that populate the PDF. It also supports new web forms. Patients can sign online and enter shared details once for several linked PDFs through Master Forms. Use Approval steps for staff decisions and Workflow participant forms for additional entries or signatures.

Which PlatoForms plans support HIPAA-enabled teams?

Silver and Gold support HIPAA-enabled teams. The Team Admin requests HIPAA team activation; PlatoForms emails the signed BAA once activation is complete. Complete both before collecting PHI.

How can AI help prepare patient forms in PlatoForms?

Use AI field detection to identify fields on blank intake PDFs, or AI Form Generator to draft a new web form from a description. AI can also suggest conditional rules and translations. Review the generated questions, field mappings, and wording against the clinic’s approved paperwork. Keep patient information out of setup prompts and sample documents. Before analyzing collected responses, review the AI in Insights privacy guidance.

Try PlatoForms with Your Clinic’s Paperwork

Start with a blank intake PDF or a healthcare form template. Use sample data to check patient completion, staff access, and the resulting PDF. Before collecting PHI, complete HIPAA team activation, obtain the BAA, and review the services connected to the form.

Create your free PlatoForms account →

About the Author

Katie Woon

Katie Woon is the Head of Marketing at PlatoForms with experience across B2B and B2C marketing at companies including Detmold Group and Midea Group. At PlatoForms, she focuses on digital workflow solutions, creating content and campaigns that help businesses transition from paper-based to automated document processes.


Stay in the Loop!

Subscribe to our blogs for exclusive insights, tips, and updates.

Related Content Read more