Online Form Software

Google Forms offers security and privacy configurations that could be made to comply with HIPAA regulations. Covered entities can set the access and visibility of folders and files, as well as grant specific collaborators sharing and editing capabilities.When configuring Google Forms, administrators should set the sharing permissions to manage data visibility and access. Additionally, admins should disable third-party applications that don’t meet HIPAA privacy standards. Software compliance depends on how the software is used, which is why administrators should adjust privacy settings properly before and while using Google Forms to collect and manage patient information. Other possible HIPAA safeguards include encryption to protect sensitive information, user authentication, and audit controls that track information access.If a covered entity uses Google Forms to collect protected health information (PHI), it must have a business associate agreement (BAA) in place before collecting PHI through this tool. Google may offer a signed business associate agreement (BAA) that covers Google Forms as well as other Google Workspace services such as Gmail, Docs, Sheets, Calendar, and Slides.

Your company can easily enable HIPAA compliance by using Jotform’s helpful tools and secure forms. Sign a Business Associate Agreement (BAA) with Jotform and enjoy forms that make HIPAA compliance easier.Jotform’s HIPAA-friendly online forms encrypt your data as soon as your forms start being populated. Sensitive information collected through your forms is also encrypted during transfer and in storage. Jotform has many integrations with other HIPAA-friendly services such as Google Drive, Dropbox, etc. You can also accept online payments with HIPAA-friendly online forms. Jotform offers many different payment gateway integrations.

Typeform provides data-collection services through online forms, and has integrated security features to meet HIPAA security and privacy requirements.Both physical security and network security features are in place, including access control, penetration testing, multiple levels of encryption, and other data protection measures. Typeform has an information security department that’s responsible for overseeing all security administration.Since the service offers protection for data and information, it seems that covered entities have the option to use this service for protected health information (PHI). Collecting PHI is part of HIPAA compliance, which means that Typeform is a business associate. Covered entities using this service to gather, store, or transmit PHI should contact Typeform customer service to ensure they have a business associate agreement (BAA) in place.

According to the Dubsado Help Center, Dubsado does not enable HIPAA compliance. Additional safeguards would have to be put in place in order for the platform to comply with HIPAA rules. The website states that Dubsado has no immediate plans to make the changes necessary to enable HIPAA compliance. A look at its roadmap portal confirms no plans have been published. There is also no mention of Business Associate Agreements (BAA) on the website.

According to its website, Formsite offers a solution that enables HIPAA compliance for users who need to collect and process Protected Health Information (PHI). The website also confirms that Formsite will enter into a Business Associate Agreement (BAA) with organizations so they can collect PHI using Formsite forms.  Per Formsite’s pricing page, HIPAA compliance features are offered only to users on the Enterprise plan. 

To enable HIPAA compliance, software must include physical, administrative, and technical safeguards to protect PHI, among other safeguards. While Wufoo offers security features, it doesn’t appear to offer all of the features necessary for HIPAA compliance.

Gravity Forms, a widely used WordPress plug-in designed to create online forms, has stated that it can be HIPAA-compliant, but it does not come pre-configured with HIPAA compliance features. Instead, it offers functionalities that can be used to develop forms that adhere to HIPAA standards, as long as users take specific precautions and comply with essential security protocols.According to Gravity Forms, data collected through its plug-in is stored in tables within the user's WordPress database, which is hosted by the user’s chosen hosting provider. Gravity Forms then uses the existing infrastructure provided by WordPress to ensure that the collected data is securely stored within the user’s database environment. This approach ensures that the data remains under the user’s control and within the parameters of their selected hosting provider. Keep in mind that Gravity Forms states, “By default, [t]he data collected by Gravity Forms is not encrypted during storage. If required, encryption of data at rest would need to be provided by an add-on or the custom code.” Because Gravity Forms has stated that it does not host or store collected form data on your behalf and that it does not sign Business Associate Agreements, you must do this with your website host or data services provider.