Cognito Forms is an online form builder that lets organizations create web forms for data collection, workflow automation, e-signatures, and online payments, with templates built for patient intake, appointment scheduling, and other healthcare use cases.

Is Cognito Forms HIPAA compliant? Yes, based on our research, Cognito Forms can be HIPAA compliant.

 

Will Cognito Forms sign a business associate agreement (BAA)?

Yes, Cognito Forms will sign a business associate agreement, but only for organizations on its Enterprise plan. A sample of the standard agreement is available, and the full terms can be reviewed on their HIPAA compliance support page.

 

What does the Cognito Forms BAA cover?

The Cognito Forms BAA covers the handling and protection of protected health information (PHI) submitted through forms on a HIPAA-enabled Enterprise organization.

Their BAA and related HIPAA documentation cover:

  • Encryption of all forms and uploaded files at rest
  • Reduced session timeouts (from 8 hours to 1 hour) to limit exposure of sensitive PHI
  • Written subcontractor agreements requiring any vendor that creates, receives, maintains, or transmits PHI on Cognito Forms' behalf to meet substantially the same obligations as the BAA
  • Reporting of unauthorized use or disclosure of PHI, and of security incidents, within three business days
  • Guest Access authentication requirements for workflow links and Save & Resume links, automatically enabled once a BAA is signed
  • Encrypted, end-to-end email delivery for workflow links sent to known users (e.g., employees), where the recipient's email provider supports it

 

Conclusion

Cognito Forms signs a BAA and is therefore HIPAA compliant.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQS

What is a business associate agreement?

A business associate agreement (BAA) is a legally binding contract establishing a relationship between a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and its business associates. The purpose of this agreement is to ensure the proper protection of personal health information (PHI) as required by HIPAA regulations.

 

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting the privacy and security of certain health information, known as protected health information (PHI).

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.