HIPAA compliant survey tools: how to tell which ones really are
The short answer: almost any survey tool can be part of a HIPAA-regulated workflow if the vendor will sign a BAA covering the plan you actually buy — and a great many will not, on the plan you were looking at. That single question decides more than any feature list.
Methodology last reviewed 9 August 2026
How this table is built, and why most are not
Search for HIPAA compliant survey tools and you will find a dozen listicles with a tidy grid of green ticks. Those grids are the least trustworthy part of the page. BAA availability is plan-specific, changes without announcement, and is routinely flattened into a single yes that was true for one enterprise tier eighteen months ago. Buyers act on the tick, discover the truth during procurement, and start again.
So we apply one rule: no vendor fact appears here unless it comes from that vendor’s own official documentation and carries the date it was checked. Where a vendor does not publish an answer, the cell says so rather than guessing. Every row below was read from the linked page on 10 August 2026.
That is also why the table is shorter on certainty than the ones you have been reading. Two of the seven do not publish which plan carries a BAA at all. Treat this as a starting shortlist and a set of questions — not as an answer. Confirm in writing before you send a single patient response.
| Tool | BAA offered? | On which plan | What the documentation actually says |
|---|---|---|---|
| SurveyMonkey | Yes | Enterprise only | “HIPAA-enabled accounts are only available with SurveyMonkey Enterprise.” Feature restrictions under HIPAA mode are not stated publicly. surveymonkey.com |
| Jotform | Yes | Gold or Enterprise | A signed BAA is provided to Covered Entity customers who enable the HIPAA features. Which integrations are disabled under HIPAA mode is not stated on that page. jotform.com |
| Typeform | Yes, on request | Enterprise or Growth Custom | Requested through Sales rather than self-serve. Not available on the lower published plans. help.typeform.com |
| Google Forms (Workspace) | Yes, via Business Associate Amendment | Not stated on the compliance page | Google Forms appears on the HIPAA Included Functionality list. Note the explicit carve-out: “Third-party applications including add-ons are not included in the Included Functionality covered by the BAA.” workspace.google.com |
| Qualtrics | Signs BAAs with covered-entity customers | Not stated publicly | Holds HITRUST CSF certification, which the company describes as integrating HIPAA among other standards. No plan or tier condition is published; confirm against your own contract. qualtrics.com |
| Formstack | Standard BAA; custom requests case-by-case | Healthcare plan | Documents a 15-minute session timeout on HIPAA plans. Integration availability differs on healthcare accounts — ask for the current compatible list. formstack.com |
| Alchemer | Not stated publicly | Not stated publicly | The security page describes configuring an account for HIPAA-compliant surveys but does not address BAA availability or which plan carries it. Treat as unanswered until Sales confirms in writing. alchemer.com |
Checked 10 August 2026against each vendor’s own documentation. Plans and conditions change without notice, and none of this is a substitute for the vendor confirming your specific plan in writing. DocRepute is not affiliated with any tool listed.
The criteria below are what the table cannot settle for you: the exact wording to send a vendor, and an honest account of what DocRepute does and does not offer. Run this against any shortlist and you will reach a better answer than a grid of ticks would have given you.
The five questions that decide it
Ask these of every tool on your shortlist. The answers separate genuine candidates from tools that merely mention healthcare on a landing page.
Is a BAA offered at all, and on which plan?
This is the question that eliminates most candidates. Many survey tools will sign a Business Associate Agreement only on a specific enterprise or healthcare tier, not on the plan whose price attracted you. A vendor that says yes on its marketing page and no on your plan has not answered the question.
Is the BAA available without a sales negotiation?
Some vendors publish a standard BAA you can execute. Others treat it as a bespoke contract item. Neither is wrong, but the second means a longer procurement and a real possibility that the answer changes depending on your seat count.
Which features remain usable once PHI is involved?
A tool can be covered by a BAA and still disable the integrations, notifications, or exports you were planning to rely on. Ask specifically which functionality is restricted under the healthcare configuration, because the restriction list is where the useful detail lives.
Where does the response data live, and for how long?
Hosting region, retention defaults, deletion controls, and who inside the vendor can access responses. These are answerable facts, and a vendor that cannot answer them quickly has told you something.
What happens to free-text comments?
Patients write identifiable things in comment boxes whether or not you ask them to. Understand how free-text is stored, whether it is used for model training, and whether support staff can read it.
What to verify before you send a single patient response
Ask for the BAA in writing, naming the exact plan you intend to buy — not the product family.
Ask which features are disabled or restricted once the healthcare configuration is switched on.
Ask where response data is hosted, what the default retention period is, and how deletion works.
Ask whether free-text responses are used for model training or product improvement, and how to opt out.
Ask who at the vendor can read survey responses, and under what circumstances.
Get the answers by email rather than from a chat widget, and keep them with your vendor file.
Re-check before renewal. Plan structures and BAA terms change more often than buyers expect.
What happens when you actually send those questions
A practice manager at a four-provider clinic shortlists two well-known survey tools. Both marketing pages say HIPAA. She emails the five questions to each, naming the specific plan she intends to buy.
The first replies in two days: a BAA is available, but only one tier above the plan she priced, and two integrations she had counted on are unavailable under the healthcare configuration. That is a usable answer — the cost is simply higher than the pricing page suggested, and she can decide with open eyes. The second sends a link to a trust page that never mentions plans, and a follow-up asking to book a call. Three emails later she still does not have a plan-level answer in writing.
She has learned more in a week than any comparison grid would have told her, and the second vendor effectively removed itself. This is the exercise. It is not glamorous, it takes about an hour of writing emails, and it is the only thing that reliably separates tools that support HIPAA-regulated workflows from tools that mention healthcare in their copy.
Standard surveys and conversational surveys are not the same purchase
A standard survey asks fixed questions in a fixed order and gives you structured answers that are easy to compare week to week. A conversational or agentic survey adapts inside approved paths, asking a follow-up when an answer is vague, and tends to produce far more free text — which is usually where the reason behind a score is hiding.
That richness changes your diligence rather than removing it. More free text means more chance a patient writes something identifiable, so the questions about storage, retention, access, and model training matter more for a conversational tool than for a five-question form. Ask them again specifically about the conversational feature, since it is often newer than the rest of the product and occasionally sits outside the same terms.
Our own answers to the same five questions
It would be poor form to publish this checklist and dodge it. DocRepute is HIPAA-focused and built for HIPAA-compliant workflows, designed for HIPAA-regulated patient intake, with a BAA planned to be available at launch. DocRepute is pre-launch and in early access, so for several of the questions above our own honest answer today is not yet — and we would rather say so than imply a production service is already running.
What is settled is the shape of the product. Standard patient surveys are core and free to start, with 50 completed patient actions each month and no charge for building or publishing a survey. Conversational surveys and AI sentiment analysis are paid capabilities. Survey responses stay private and are never copied into a public review, and every eligible patient receives the same neutral review invitation regardless of what they told you.
DocRepute does not offer validated clinical instruments, benchmarking against national datasets, or clinical-outcome claims. If your requirement is a validated instrument with published norms, that is a different category of product and you should buy that instead.
Questions buyers ask us
Which patient survey tools can support HIPAA-regulated workflows?
Any survey tool that will sign a Business Associate Agreement covering the plan you actually buy, and that can tell you where responses are stored and who can read them, can potentially support a HIPAA-regulated workflow. The category matters far less than the plan-level answer, which is why a generic list of tool names is a poor way to make this decision.
Which plans offer a BAA and under what conditions?
The table above records what each vendor's own documentation said on 10 August 2026. The pattern is consistent: where a BAA is offered, it is restricted to a specific healthcare or enterprise tier — SurveyMonkey names Enterprise only, Jotform names Gold or Enterprise, Typeform names Enterprise or Growth Custom. Two of the seven do not publish a plan condition at all. Because this is plan-dependent and changes without announcement, the only answer you should act on is the one a vendor gives you in writing, naming your exact plan.
What should a healthcare buyer verify before sending PHI?
Six things: that a BAA covers your specific plan, which features are restricted under the healthcare configuration, where data is hosted, what the retention and deletion defaults are, whether free-text responses are used for model training, and who at the vendor can read responses. Get all of it in writing before the first real patient response is collected.
How do standard surveys differ from conversational or agentic survey workflows?
A standard survey asks a fixed set of questions in a fixed order and returns structured answers. A conversational or agentic survey adapts within approved paths, asking follow-ups when an answer is vague, which usually produces richer free-text. That richer text is more useful and also more likely to contain identifiable detail, so the data questions above matter more, not less.
Which product facts are unknown or plan-dependent?
Treat BAA availability, feature restrictions under a healthcare configuration, hosting region, retention defaults, and model-training policy as unknown until a vendor confirms them for your plan in writing. Any comparison that presents these as settled yes or no answers without a source and a date is guessing on your behalf.
See how the DocRepute survey workflow works, how neutral review requests connect to it, or draft questions with the survey question generator. New here? Start from the DocRepute overview.