For a medical practice one criterion overrides every other: a signed Business Associate Agreement and HIPAA-grade handling of protected health information. A beautiful intake form that is not covered by a BAA is a breach waiting to be reported. We reweighted the rubric to put compliance first, verified which tools actually sign a BAA and at what tier, then ranked the six — and named the tools that are lovely and entirely wrong for PHI.
The deciding criterion is HIPAA compliance backed by a signed BAA — without it, nothing else on the form matters because you cannot legally collect PHI. We weighted security and compliance far above design, then patient ease and value, and treated any tool without a BAA as disqualified for clinical use no matter how good the editor. See the full rubric →
HIPAA compliance + BAA40%
Security & access controls20%
Patient ease of use18%
Value12%
Integrations (EHR / e-sign)10%
01
RANK
★ Editor’s Choice
Jotform
Best for medical practices
The most complete HIPAA option for a practice. A signed BAA is included on the Gold tier and Enterprise, the healthcare template library and e-signature are the deepest in the field, and access controls, encryption and audit features meet the standard. The cost of compliance is the tier: HIPAA features sit on Gold at $99/mo (annual), not the cheaper plans. For a clinic that needs intake, consent and e-sign in one place, it is the safe default.
The cheapest credible path to a signed BAA. HIPAA compliance is available on the Team plan at $39/mo and Enterprise at $129/mo — well below Jotform's HIPAA tier — with strong conditional logic, payments and signature fields. The template library is thinner and the brand quieter, but for a small practice that wants a BAA without paying Gold-tier prices, this is the value winner.
Built for organizations that run real workflows on their forms — document generation, e-signature, routing and approvals — with HIPAA available on the higher Suite tier. It is the most capable here for multi-step clinical intake and back-office automation, and also the most expensive, starting around $113/user/mo before the HIPAA-enabled bundle. Right for a group practice with process to automate; overkill for a solo office.
Free Google Forms is never HIPAA-eligible. On a paid Google Workspace plan, however, an administrator can accept Google's BAA — which covers Forms — and, configured correctly, collect PHI. It is the cheapest route if you already run Workspace (Business Standard/Plus, roughly $14–22/user/mo), but the form features are spartan and the compliance burden of correct configuration sits entirely on you.
Capable for surveys and patient-experience work, but HIPAA compliance exists only on the Enterprise tier at custom pricing — there is no way to add a BAA to the Team or individual plans. For a practice that needs PHI collection it is an expensive, sales-gated path, and the form model is built for research rather than clinical intake.
On this list to name the trap. Tally is genuinely delightful and nearly free, and it will not sign a BAA — which means any PHI you collect through it is unprotected and any breach is reportable. No price justifies that risk for a clinical form. Use it for a staff lunch poll, never for a patient.
Two things together: the vendor signs a Business Associate Agreement (BAA) taking on legal responsibility for the PHI you collect, and the product enforces the safeguards — encryption in transit and at rest, access controls, audit logging and restricted data handling. A tool can be technically secure and still not be usable for PHI if the vendor will not sign a BAA. Always confirm both, at the specific plan tier you are buying.
Which is cheaper for a small practice, Jotform or Cognito Forms?+
Cognito Forms. Its BAA is available on the Team plan at $39/mo, whereas Jotform gates HIPAA to its Gold tier at $99/mo (annual). If your practice needs the deeper healthcare template library, e-signature breadth or enterprise controls, Jotform earns the premium; if you mainly need compliant intake and consent forms, Cognito Forms is the value winner.
Is Google Forms HIPAA compliant?+
Only on a paid Google Workspace plan where an administrator has accepted Google's BAA in the Admin console and configured access correctly — and Google's BAA does cover Forms. Free, personal Google Forms is never HIPAA-eligible. It is the cheapest option if you already run Workspace, but the configuration and ongoing compliance burden is entirely yours.
Can I use Typeform or Tally for patient intake?+
No. On their standard plans neither signs a BAA, so collecting PHI through them is non-compliant and exposes the practice to a reportable breach. They are excellent for non-PHI uses — staff surveys, marketing — but for anything touching patient health information, use a tool with a signed BAA such as Jotform or Cognito Forms.