Why a health-history form is a HIPAA question
If your consent or intake form asks about medications, allergies or past procedures, it is collecting health information. Whether HIPAA applies to that form starts with one question about your practice.
Under the HIPAA rules, a health care provider is a covered entity when it sends health information electronically in connection with a transaction the rules cover. Whether that describes your med spa depends on how you run the business, and that is a question for your lawyer or compliance advisor, not a blog post.
If you are covered, the company behind your form matters too. The rules call a company a business associate when it creates, receives, maintains or transmits protected health information on behalf of a covered entity. A form service that collects intake answers and stores them for you fits that description. The contract between you and that company is the business associate agreement, or BAA, and the rules say what it has to require.
If you are still sorting out which of your forms collect health information at all, start with the med spa page. This post is about the other side: the vendor and its agreement.
What a BAA with a form vendor has to say
Some form companies, Formstack among them, offer a standard BAA. You can still read it for three of the things the HIPAA rules require.
- Safeguards. The contract must require the vendor to use appropriate safeguards for electronic protected health information.
- Reporting. The vendor must report back to you any use or disclosure of the information that the contract does not allow, once it becomes aware of it.
- The end. When the contract ends, the vendor must return or destroy the protected health information it holds for you, where that is feasible.
The last one matters more than it looks. If you switch form tools later, every intake answer from the old account is still sitting there. Ask how you get your records out, in what format, and how the vendor confirms the rest is gone.
Which form tools say they sign one
Each of these comes from the vendor's own page, read on November 5, 2026. Plans change, so confirm the plan with the vendor before you pay for an upgrade.
Jotform
Jotform says customers with HIPAA features turned on can sign a BAA with it. Its page places that inside its HIPAA environment, on the Gold or Enterprise plan. If your account is on another plan today, ask Jotform what moving to one of those two involves before health questions go on the form.
Typeform
Typeform's guide to medical forms says you need a BAA with Typeform in place before you build any medical form. Ask Typeform which plan the BAA comes with, and get the answer in writing before you build.
Cognito Forms
Cognito Forms says your organization has to be on its Enterprise plan, and not on a trial, to sign a BAA. So do not put a health form live during a trial and plan to sort out the agreement afterward.
Formstack
Formstack says it offers a standard BAA and will look at a custom BAA if you ask. Ask Formstack which plan or add-on includes it, and what that costs, before you sign up.
Google Forms
Google lists Google Forms, under Google Drive, among the Workspace services its HIPAA BAA covers, on a page last updated October 28, 2026. A Workspace admin has to review and accept the BAA first. Until that is done, Google says a customer must not put protected health information in Workspace. If you are not sure who set up your Google account or whether anyone accepted the BAA, assume nobody did and check.
Where intake answers slip out: email notifications
Most form tools can email you each new submission. That email is where a health history can end up outside the system your BAA covers, on a phone, in a shared inbox, in a forward to the front desk.
Cognito Forms advises marking health answers as protected so they are not sent by email, unless the patient has signed a waiver allowing email. The same idea works in any tool: the notification says a new form came in, and you sign in to read it.
Google's rule points the same way, since protected health information belongs in Workspace only after the BAA is accepted. If form answers land in an inbox outside that account, they have left the covered system.
If you would rather have patients fill in forms and see their own records in one signed-in place, that is the job client portals are built for.
What to do
These are the questions to put to any form company before health questions go on a form. They are not legal advice, and your lawyer or compliance advisor should read the BAA itself.
- Ask your lawyer or compliance advisor whether your med spa is a covered entity.
- Ask the vendor: will you sign a BAA, and on which plan? Get the plan name in writing, since the ones above were read on November 5, 2026.
- Ask: does the BAA cover the e-signature and file-upload parts of the form?
- Ask: which add-ons and integrations stay under the BAA, and which send answers to companies outside it?
- Ask: what do notification emails contain, and can I mark health answers so they stay out of email?
- Ask: what happens to the answers when I cancel, and how do I get them before they are returned or destroyed?
- Ask: how, and how fast, will you tell me about a use or disclosure the contract does not allow?
- Send yourself a test submission today and read the notification it produces.
When we build an intake page for you, you own the code and the accounts from the first day.