Jotform
Forms
Hosted forms you embed or link. HIPAA features and the BAA come with Gold or Enterprise.
Forms
Formstack and your treatment center website
Hosted forms for your website. ePHI belongs on the Formstack for Healthcare plan, which limits integrations to a vetted list.
- Read against the vendor's own pages
- BAA on specific plans
- Checked October 15, 2026
What it is
A form builder with a Formstack for Healthcare plan for organizations that collect electronic protected health information.
How it connects to a website
- Embed
Formstack forms can be embedded on a website. Formstack notes the form stays secured even if the page around it is not, but the page will not show as HTTPS.
What KhanWork does with it
- Embed the Formstack form on an HTTPS page and test it on a phone.
- Connect it only to integrations on Formstack's healthcare list, such as Salesforce, where your CRM is one of them.
- Track a completed submission as a count in analytics, with no field values.
Setup, as the vendor documents it
- Contact Formstack support to activate a Formstack for Healthcare plan for your organization.
- Build the form, then connect only integrations on the healthcare plan list, using Formstack's setup instructions for each.
- Set up SMTP for form data emails, which Formstack makes mandatory on the healthcare plan.
Source: Formstack help center. Menus and labels change; follow what you see in your account.
What to watch out for
Where patient details can slip out with Formstack, and what the vendor's own documents say to switch on, switch off or ask for.
The healthcare plan narrows integrations
Formstack limits healthcare plan integrations to a list: Authorize.Net, Box, Dropbox, Formstack Documents, PayPal (not PayPal Pro), Salesforce, Salesforce Marketing Cloud, Smartsheet, Stripe and four Google services. If your CRM is not on it, plan another route.
Responsibility ends at the edge of Formstack
Formstack says it keeps your data encrypted inside Formstack and when passed to an integration, and that HIPAA compliance across the rest of your process, including integrations, rests with your organization.
Email works differently
The healthcare plan requires your own SMTP for form data, restricts email recipients and allows no attachments in submissions. Expect admissions alerts to change.
Serve the page over HTTPS anyway
Formstack notes an embedded form stays secure on a non-HTTPS page, but the address bar will not show it. Families read that as unsafe.
Frequently asked questions
Formstack says healthcare customers collecting ePHI should opt for the Formstack for Healthcare plan, as of March 26, 2024.
Formstack lists a commitment to sign a Business Associate Agreement with each customer on its healthcare offering.
Yes. Salesforce and Salesforce Marketing Cloud are on Formstack's list of healthcare plan integrations. HubSpot is not on that list.
Sources
- Formstack help center, Maintaining HIPAA Compliance with Formstack (opens in a new tab) (checked )
- Formstack help center, Healthcare Compatible Integrations (opens in a new tab) (checked )
- Formstack help center, Building a Form with a Formstack For Healthcare plan (opens in a new tab) (checked )
- Formstack help center, embedded forms and SSL (opens in a new tab) (checked )
- Formstack developer docs, API overview (opens in a new tab) (checked )
Not legal advice. This page reports what the vendor publishes. Nothing here implies a partnership with Formstack. Confirm plans and the BAA in writing with the vendor, and let your compliance lead or counsel decide what counts as PHI in your workflows. For the terms, see BAA, PHI, HIPAA and 42 CFR Part 2 in the glossary.
