Best Form Builders for Healthcare in 2026

For protected health information, the best form builder is FormAssembly, which carries HIPAA with a BAA alongside FedRAMP High and ISO 27001. Jotform is the cheapest compliant option at $99/month billed annually. Paperform is not HIPAA compliant, signs no BAAs, and should not be used for PHI.

Healthcare buying works backwards from every other form builder decision. The feature list, the editor and the price all come second to one binary question: will this vendor sign a Business Associate Agreement, and at what tier. Three of the seven tools ranked below will, three more will under specific conditions, and one will not at all. That last one is ours, and we have ranked it last accordingly.

We compared these seven on HIPAA and BAA availability, the real cost of the compliant tier, what happens to submission caps during an intake spike, how many integrations can carry data onward, and whether the payment and logic capabilities survive the move into a compliant plan. Pricing and compliance data was read live from each vendor on 22 September 2026.

One warning before the rankings. A signed BAA covers the form vendor, not your workflow. If a compliant form pushes a submission into a spreadsheet, an email inbox or an automation platform that has no BAA of its own, the compliant boundary ends at the edge of the form. Map the whole path before you buy.

For a broader shortlist that is not compliance-led, see our best form builders ranking, or the narrower guides for enterprises and schools.

#1 FormAssembly — Best for Regulated PHI Intake at Scale

FormAssembly holds the deepest compliance stack of any form builder here: HIPAA with a BAA on Atlas Enterprise, PCI DSS Level 1, ISO 27001, SOC 2, FedRAMP High, GLBA, FERPA and 21 CFR Part 11 for clinical research. No other vendor on this list clears that list, and for a hospital network, a research site or a payer, several of those are procurement gates rather than nice-to-haves. Data residency across North America, the EU and APAC is included at the same tier.

The product behind the certifications is built for exactly this job. Field-level masking hides sensitive values from staff who should not see them, identity authentication gates who can open a form, approval processes route submissions through a reviewer, and the Salesforce connector writes across multiple objects with prefill from existing records. That matters if patient data lands in Health Cloud. Forms, responses and storage are unlimited on every tier, so a vaccination drive or an enrolment window will not stop the form working.

The cost is opacity and seats. As of September 2026 FormAssembly publishes no price for any plan; all four route to a demo request. Seats are capped by tier at 1, 3 and 5 standard users, and integrations, unlimited workflows, document generation and the analytics suite are all sold as add-ons on top of the quoted figure. Budget for a procurement cycle, not a credit card. The 2026 Atlas relaunch added an agentic AI assistant and deeper Salesforce integration, which suggests the platform is being actively invested in rather than maintained.

• Pricing: No published prices. Atlas Explorer, Team, Enterprise and Gov Cloud all quote-only. 14-day trial, no card.
• Best for: Hospitals, research sites and payers with a formal compliance review and Salesforce behind the form.
• Key limitation: Opaque pricing, seat caps from 1 to 5, and most capabilities priced as add-ons.

#2 Jotform — Best for Clinics That Need Compliance Without a Procurement Cycle

Jotform is the cheapest route to a signed BAA on this list: HIPAA features unlock on the Gold plan at $99/month billed annually, with no sales call required. For a single practice or a small multi-site group, that is the difference between running compliant intake next week and running a three-month evaluation. Compliance also extends to PCI DSS Level 1, ISO 27001, SOC 2, FERPA and StateRAMP, and the healthcare template library is the largest going.

Payments are the other reason clinics land here. Jotform supports 40+ payment processors, which is more than every other tool on this page combined, and copays, deposits and self-pay balances can be collected in the intake form itself rather than through a separate portal. There are 150+ native integrations, conditional logic, calculation fields, and a genuinely good mobile app for staff collecting responses away from a desk.

Then there is the metering, which is where Jotform gets expensive in a way the sticker price hides. Gold allows 10,000 submissions a month, 100 forms and 1,000 payment submissions, and every self-serve tier from Starter to Gold is single-user. There is no second seat to give your practice manager without moving to an Enterprise quote, which is the same procurement cycle you chose Jotform to avoid. Form views, storage and fields per form are each metered separately too. Nonprofit and education discounts of 50% apply to Bronze, Silver and Gold, which is worth claiming if you qualify.

• Pricing: Free (100 submissions/month). Bronze $39/$34 annual. Silver $49/$39. Gold $129/$99 (HIPAA). Enterprise on quote.
• Best for: Independent practices that need a BAA, copay collection and a fast start.
• Key limitation: Single user on every published tier, and seven separate meters above that.

#3 Cognito Forms — Best for Unlimited Compliant Volume on a Published Price

Cognito Forms Enterprise is $129/month billed annually and includes HIPAA compliance, unlimited entries, SSO, folder permissions, 20 users and 20 guests. For a practice with unpredictable intake volume, unlimited entries at a published price is worth more than a longer certification list; it removes the scenario where a busy month forces an unplanned upgrade. Hosting is on Microsoft Azure, with SOC 2 Type 2 audits ongoing and PCI-compliant payments.

The formula engine is the reason to prefer it over Jotform on anything with maths in it. Cognito runs real calculations with repeating sections and data lookups, so insurance estimates, sliding-scale fee schedules, BMI and dosing calculators and multi-dependant enrolment forms can be modelled properly rather than approximated. Folder-level permissions also map well onto departments that should not see each other's submissions.

Two caveats. The compliant tier is the top tier, so there is no middle ground: Team at $39/month annual has no HIPAA, and the jump is a three-fold price increase. And the builder is dense. Reviewers consistently praise the logic and criticise the interface, with Website Planet's review noting design limitations as the trade-off for the calculation power. Patient-facing forms will look functional rather than reassuring, which matters more in healthcare than it does elsewhere.

• Pricing: Free (100 entries/month). Pro $24/$19 annual. Team $49/$39. Enterprise $174/$129 (HIPAA, unlimited entries).
• Best for: Practices with heavy calculation needs and volume they cannot forecast.
• Key limitation: HIPAA only at the top tier, and a utilitarian builder with limited design control.

#4 Formstack — Best for Forms, Documents and Signatures in One Contract

Formstack offers HIPAA as a paid add-on on the Forms and Suite plans and includes it by default on the Salesforce and Enterprise solutions. The add-on price is not published, which makes the true cost of compliance unknowable before a sales conversation, so treat the $83/month Forms figure as a floor rather than a quote. Supporting compliance covers SOC 2, PCI DSS, TX-RAMP Level 2 and the EU, UK and Swiss Data Privacy Frameworks, with PHI encrypted at AES-256.

The Suite plan at $250/month billed annually is where the argument gets interesting for healthcare, because it bundles document generation and Formstack Sign with the form builder. A consent form that becomes a generated PDF and then a signed record, without a second vendor, is a genuinely useful shape for intake and release-of-information work. Integrations run to 300+ and the Salesforce line is well established.

The metering is aggressive and it stacks: per builder user, per form, per submission on that form, and per document delivered. Forms includes 1,000 submissions per form and one user; Suite includes 5,000 per form, three users and 250 document deliveries a month. Reviewers repeatedly flag the pricing and a dated interface, and the document and signature products arrived largely through acquisition, so how cleanly they join up varies by workflow. Formstack now sits under Intellistack, which has launched a separate CLM product line, and it is fair to ask where the roadmap attention is going.

• Pricing: No free plan. Forms $99/$83 annual. Suite $299/$250. HIPAA add-on priced on request. Enterprise on quote.
• Best for: Organisations that need compliant forms, generated documents and eSignature under one contract.
• Key limitation: Unpublished HIPAA pricing, meters at four separate joints, and divided roadmap attention.

#5 Microsoft Forms — Best for Internal Healthcare Use You Already Pay For

Microsoft Forms is covered under the Microsoft 365 Business Associate Agreement and holds HIPAA, ISO 27001, SOC 2, FERPA and FedRAMP, which puts it ahead of most paid form builders on paper at $7/user/month on Business Basic billed annually. If your organisation already runs Microsoft 365, the compliant form builder is sitting in the tenant, and for staff training quizzes, internal incident reporting, shift preference surveys and screening questionnaires we would not argue for anything else.

The ranking reflects what it cannot do rather than what it gets wrong. Microsoft Forms has no payment fields of any kind, no calculation fields, no public API, no branding control worth the name, and roughly 20 native integrations. Free personal accounts stop at 200 responses per form. Every step past collection needs Power Automate, and every signature needs a separately licensed eSignature vendor. Configuration also matters: a form shared with an anonymous external link behaves differently from one restricted to the tenant, and patient-facing use needs the tenant controls set deliberately.

• Pricing: Free with a personal account (200 responses/form). Included in Microsoft 365 from $8.40/month, $7/month annually per user.
• Best for: Internal staff-facing forms inside an existing Microsoft 365 tenant.
• Key limitation: No payments, no calculations, no API, and roughly 20 integrations.

#6 Formsite — Best for Long-Running Forms on a Fixed Process

Formsite makes a BAA available on its Enterprise plan at $209/month, which also carries SLA, 2FA and Salesforce integration. It has been operating since 1998, it is PCI DSS 4.0 compliant, and it supports Stripe, PayPal, Braintree and Authorize.Net for payments, with calculations and conditional logic in the builder. For a records release form or a referral form that has been working the same way for eight years, none of that is a bad foundation.

It ranks sixth because of what is missing and what is metered. There is no SOC 2 attestation, which will stop the procurement conversation dead at many hospital systems. Results are capped per form rather than per account, so 2,500 on Business means one popular intake form exhausts the plan while the others sit idle, and extra logins are $10/month each. The interface shows its age, and 2026 reviews on G2 and elsewhere consistently frame it as a dated veteran. The company is also under ten people, which is a thin base for a decade-long compliance dependency.

• Pricing: Free (10 results/form). Personal $21/month. Professional $34. Business $59. Business+ $84. Enterprise $209 (HIPAA BAA).
• Best for: Stable, low-change forms where the process will not be redesigned.
• Key limitation: No SOC 2, per-form result caps, paid sub-users and an aging interface.

#7 Paperform — Best for Healthcare Admin Work That Never Touches PHI

Paperform is not HIPAA compliant and does not sign Business Associate Agreements. That is why it is ranked last on a healthcare page written by Paperform. If your form collects protected health information, the tools above are the correct answer and this one is not, and no configuration, plan tier or workaround changes that. We would rather say it here than have you discover it during an audit.

Where it belongs in a healthcare organisation is the substantial amount of work that sits outside PHI. Staff recruitment and onboarding, credentialing document collection, CPD and conference registration, vendor and supplier intake, donor and fundraising pages, equipment and facilities requests, internal feedback. Paperform holds SOC 2 Type II, GDPR and CCPA, which clears most security questionnaires for work of that kind.

For those jobs the pricing model is the argument. Pro is $59/month, or $49/month billed annually, with unlimited submissions and unlimited team members under a fair use policy; Business is $149/month, $124 annually, adding 10 workspaces, SSO and the Business API. Nothing on this page matches that: Jotform gives one user, Cognito counts seats and guests, Formstack meters four different things, and FormAssembly caps standard users at five on Enterprise. A recruitment campaign that works does not generate a bill.

One subscription also covers Papersign for eSignatures and Stepper for workflow automation, so an employment offer can be generated, signed and routed for approval without a second vendor. The calculation engine is Excel-style and drives question and page visibility, conditional emails, integration payloads and success page content, which handles things like fee schedules and eligibility scoring on non-clinical forms. Payments run through five gateways with subscriptions, coupons and tax rules, and there are 4,000+ integrations. The company was founded in 2016, is bootstrapped and profitable, and HIPAA support is on the roadmap but is not available today, so it cannot be planned around.

• Pricing: Pro $59/month, $49/month billed annually. Business $149/month, $124 annually. Enterprise on quote. 7-day trial, no card.
• Best for: Non-clinical healthcare operations: hiring, vendors, events, fundraising and internal requests.
• Key limitation: No HIPAA compliance and no BAAs, which rules out every form that touches PHI.

See Them in Action

Two independent walkthroughs covering the two ends of this list: the compliance-heavy Salesforce platform and the tool already sitting in your tenant.

The Five Dimensions That Decide a Healthcare Shortlist

Compliance

Six of the seven tools ranked here can be made HIPAA compliant with a BAA; Paperform cannot, and signs no BAAs. FormAssembly carries the longest list: HIPAA, PCI DSS Level 1, ISO 27001, SOC 2, FedRAMP High, GLBA, FERPA and 21 CFR Part 11. Jotform adds StateRAMP and HECVAT to a similar core. Microsoft Forms inherits HIPAA, ISO 27001, SOC 2 and FedRAMP from the Microsoft 365 BAA. All seven claim GDPR and CCPA. SOC 2 is held by every tool here except Formsite, which is the fastest way to lose a hospital procurement review.

Pricing

The cheapest published HIPAA tier is Jotform Gold at $99/month billed annually, followed by Cognito Forms Enterprise at $129/month annually and Formsite Enterprise at $209/month. Formstack sells HIPAA as an unpublished add-on above its $83/month Forms plan, and FormAssembly publishes no prices at all. Microsoft Forms is effectively free at $7/user/month inside an existing Microsoft 365 licence. Paperform's Pro plan is $49/month billed annually and carries no HIPAA at any tier.

Integrations and API

Native integration counts run from roughly 20 to 4,000-plus. Paperform lists 4,000+, Formsite 2,000+ counting its connector network, Formstack 300+, Jotform 150+, Cognito Forms 50+, and FormAssembly and Microsoft Forms roughly 20 each. Counts are the wrong headline in healthcare, because each connector that carries PHI needs its own BAA with that destination. FormAssembly's small native list is deliberate and its Salesforce connector is the deepest available; Microsoft Forms has no public API at all, which is the harder constraint.

Conditional logic and calculations

Six of the seven have calculation fields; Microsoft Forms has none, only quiz scoring and branching. Cognito Forms and Paperform run the most capable formula engines, with repeating sections and data lookups on the Cognito side and Excel-style formulas driving visibility, emails, integration payloads and success pages on the Paperform side. Jotform, Formstack, FormAssembly and Formsite all handle branching and arithmetic competently, which covers most triage and eligibility logic. For sliding-scale fees, insurance estimates or dosing calculations, the difference between an engine and an arithmetic field is the difference between building it and faking it.

Payments

Jotform leads by a wide margin with 40+ payment processors, which matters for copays, deposits and self-pay balances collected at intake. Paperform supports five gateways with subscriptions, coupons, tax rules and inventory. Cognito Forms has four including its own Cognito Pay, Formsite four, and Formstack five. Microsoft Forms takes no payments at all. Note that collecting a payment on a form carrying PHI puts PCI DSS and HIPAA in scope together, which is a reason to check the processor's own agreement rather than just the form vendor's.

Full Pricing Comparison

Every published tier across all seven tools. FormAssembly publishes no numeric prices as of September 2026, and Formstack's HIPAA add-on price is quoted on request.

Full Feature Comparison

Every tracked capability across the seven tools, grouped by category.

Review Ratings Across Platforms

Aggregated ratings from G2, Capterra, GetApp, Trustpilot and TrustRadius, weighted by review count so small samples do not distort the picture.

How We Ranked These Form Builders for Healthcare

Five weighted criteria, applied the same way to all seven tools:

1. HIPAA and BAA availability (40%): Whether the vendor signs a Business Associate Agreement, at which tier, and what supporting certifications sit behind it. A tool without a BAA cannot rank above one with a BAA on this page, whatever else it does well.
2. Cost of the compliant tier (20%): Not the entry price, but the price of the lowest plan that carries HIPAA, including seat counts and whether the figure is published at all. Unpublished pricing was scored down.
3. Volume and seat headroom (15%): What happens during an intake spike or when a second administrator needs access. Per-form caps were scored below per-account caps, and single-seat tiers were scored down.
4. Clinical workflow depth (15%): Calculations, conditional routing, approvals, document generation, eSignature and the integration path into an EHR, practice management system or Salesforce Health Cloud.
5. Vendor stability (10%): Company age, ownership, team size and visible development momentum, because migrating a compliant intake process is expensive and slow.

Every tool was assessed against four healthcare jobs: new patient intake with insurance details, a consent form that must produce a signed record, a self-pay payment form, and an internal staff reporting form. Pricing and compliance claims were read live from each vendor on 22 September 2026, from published trust and security documentation rather than marketing pages.

A closing note on scope. Nothing here is legal advice, and a compliant form builder is one component of a compliance programme rather than the whole of it. Confirm the BAA terms with the vendor and your own counsel before PHI goes anywhere near a live form. If you are comparing two of these directly, our Formstack alternatives and FormAssembly alternatives guides go deeper on each.

Last updated September 22, 2026