Formstack
Forms
Hosted forms for your website. ePHI belongs on the Formstack for Healthcare plan, which limits integrations to a vetted list.
Forms
Jotform and your treatment center website
Hosted forms you embed or link. HIPAA features and the BAA come with Gold or Enterprise.
- Read against the vendor's own pages
- BAA on specific plans
- Checked October 15, 2026
What it is
An online form builder with HIPAA features on its Gold and Enterprise plans.
How it connects to a website
- Embed
Jotform provides embed code for iframes, lightboxes or popup windows.
- Link-out
A Jotform form can also be linked directly instead of embedded.
What KhanWork does with it
- Embed the Jotform form on the site and check it on a phone, where most families fill it in.
- Make sure HIPAA features are on before the form goes live, and plan admissions around notification emails that carry no submission data.
- Connect Jotform integrations only to services that sign their own BAA.
- Track a completed submission as a count in analytics, with no field values.
Setup, as the vendor documents it
- On a Gold or Enterprise plan, open your account's Data page and choose Enable HIPAA Compliance to start the setup wizard.
- Agree to move your data to Jotform's HIPAA server. The wizard reviews every form and lists any widgets or integrations that are not allowed, then migrates the forms.
- Back on the Data page, choose Sign BAA, complete and submit the form, and wait for the signed copy by email.
- Copy the embed code Jotform provides (iframe, lightbox or popup) into the website page.
Source: Jotform help, How to Enable HIPAA Compliance and How to Receive a BAA for Your HIPAA Account. Menus and labels change; follow what you see in your account.
What to watch out for
Where patient details can slip out with Jotform, and what the vendor's own documents say to switch on, switch off or ask for.
Confirm the plan in writing
Jotform's HIPAA page and its setup guide name Gold and Enterprise, but one answer in its own FAQ says Gold only. Confirm which plan your account needs before you rely on it.
Integrations need their own BAA
Jotform's FAQ says that to make connected software HIPAA enabled, you must sign a BAA with that company too. Google Sheets or Dropbox on the other end is its own question.
Notifications will not show the answers
Under HIPAA, Jotform says no submission data is included in notification emails. Admissions staff log in to read inquiries, so plan the response workflow for that.
Ask fewer questions
Every health question on a website form is more PHI to protect. Keep the public form to what admissions needs to call back, and leave clinical questions to the intake process.
Frequently asked questions
Jotform offers HIPAA features on its Gold and Enterprise plans, and says covered entity customers who enable them receive a signed BAA.
Yes. Jotform provides embed code for iframes, lightboxes and popups. Your website should still run on HTTPS.
Not with HIPAA features on. Jotform says notification emails include no submission data, so staff read inquiries inside Jotform.
Sources
- Jotform, HIPAA compliant forms (opens in a new tab) (checked )
- Jotform, HIPAA FAQ (opens in a new tab) (checked )
- Jotform help, How to Enable HIPAA Compliance (opens in a new tab) (checked )
- Jotform help, How to Receive a BAA for Your HIPAA Account (opens in a new tab) (checked )
- Jotform, API documentation (opens in a new tab) (checked )
Not legal advice. This page reports what the vendor publishes. Nothing here implies a partnership with Jotform. Confirm plans and the BAA in writing with the vendor, and let your compliance lead or counsel decide what counts as PHI in your workflows. For the terms, see BAA, PHI, HIPAA and 42 CFR Part 2 in the glossary.
