Is Typeform HIPAA Compliant for Pre-Visit Intake with Photos?

You can only use a form platform like Typeform to collect Protected Health Information (PHI)—including patient photos—if you have a HIPAA-eligible plan and a signed Business Associate Agreement (BAA) in place. Without an executed BAA, do not collect or store PHI on the platform, and do not enable file uploads for images.

This guide explains how HIPAA-eligible plans and BAAs work, which feature configurations matter (including AI feature restrictions), and how to design secure pre-visit intake workflows with photos while aligning with the HIPAA Security Rule.

HIPAA-Eligible Plans and BAAs

A BAA is the threshold requirement for handling PHI with any cloud vendor. It defines each party’s responsibilities and ensures the vendor is a Business Associate under HIPAA. If your Typeform plan does not include a BAA (or you do not have one fully executed), the service must not be used for PHI.

Not all subscription tiers are HIPAA eligible. Typically, only specific business or enterprise offerings qualify and may include a BAA. Verify eligibility and obtain a countersigned BAA before building pre-visit intake forms, especially those that accept photos or file uploads.

Confirm that the BAA explicitly covers features you plan to use—file uploads, APIs/webhooks, integrations, analytics, and AI-powered capabilities. If a feature is outside the scope of the BAA, treat it as prohibited for PHI.

Feature Configuration and Restrictions

Apply strict access controls that follow the minimum-necessary standard. Use role-based permissions, least-privilege access, and, where available, SSO or MFA to prevent unauthorized viewing or exporting of patient images and responses.

• AI feature restrictions: Disable any AI, auto-summarization, or model training features unless they are expressly covered under your BAA. Avoid sending PHI to third-party AI services outside the agreement.
• Notifications: Turn off email or chat notifications that include PHI or photo attachments. Send redacted alerts or links that require authenticated sign-in instead.
• File uploads: Allow only necessary image types (for example, JPG/PNG). Block unnecessary file types, restrict file sizes, and prevent public or unauthenticated links.
• Form settings: Disable social sharing, public galleries, or response previews that could expose PHI. Limit who can view responses, exports, and reports.

Data Handling and Security Measures

Ensure data encryption in transit and at rest. Confirm TLS for all submissions and strong Data Encryption for stored responses and photos. Avoid any feature that exposes files via unauthenticated URLs or long-lived public links.

Align operations with the HIPAA Security Rule: maintain audit logs, monitor access, and review administrative, physical, and technical safeguards. Schedule periodic reviews and a compliance audit to verify controls are working and documented.

• Retention and deletion: Define short, documented retention periods for photos and responses. Enable secure deletion and verify removal from backups per policy.
• Integrity and availability: Use version controls or checksums to detect tampering, and ensure backups/DR plans are in place for mission-critical intake workflows.
• Workforce training: Train staff on secure handling of PHI, export hygiene, and incident response procedures.

Managing Protected Health Information

Identify exactly which fields constitute PHI, including photos of faces, identifiable body marks, patient IDs, and images that include names or medical record numbers. Apply the minimum-necessary principle and collect only what you need for pre-visit triage.

Provide clear instructions so patients avoid uploading unnecessary identifiers in photos. Where feasible, instruct them to remove geolocation and EXIF metadata before submission, or implement an automated process to strip metadata upon upload.

Capture consent for photo submission and disclosure. Display a concise privacy notice and a purpose statement, and avoid collecting highly sensitive data (for example, Social Security numbers) unless essential for care operations.

Integrations and Third-Party Compliance

Every downstream system that stores or processes PHI must also be compliant and, when required, must sign a BAA with you. This includes storage services, analytics tools, automation platforms, and EHR/EMR integrations.

• APIs and webhooks: Use secure, authenticated endpoints (for example, token-based auth, IP allowlisting). Transmit PHI only over encrypted channels and avoid embedding images in emails.
• Cloud storage and analytics: Only connect to services that offer a BAA and support access controls and audit logs. Disable tracking pixels or marketing analytics on PHI-bearing forms.
• EHR/EMR workflows: Prefer direct, secure transfers (for example, SFTP or standards-based APIs) over ad hoc downloads. Log and review every data handoff.

Best Practices for Pre-Visit Intake Forms

Design your form to be short, mobile-friendly, and explicit about the photo requirements. Guide patients to provide usable, non-excessive information for faster triage and fewer follow-up calls.

• Structure: demographics (minimum necessary), reason for visit, symptoms, relevant history/medications/allergies, insurance, consent, and a dedicated photo-upload step with clear instructions.
• Photo guidance: ask for good lighting, neutral backgrounds, no bystanders or extra documents, and no faces unless clinically required. Remind patients not to include unrelated identifiers.
• Operational safeguards: test uploads on common devices, confirm metadata stripping, verify access controls, rehearse incident response, and periodically run a compliance audit of the intake workflow.

Assessing Typeform for Healthcare Use

Typeform can be considered for PHI—including photos—only if you secure a HIPAA-eligible plan with a signed Business Associate Agreement and configure strict controls. If you cannot obtain a BAA or required safeguards, choose a different intake method that will sign a BAA and supports secure image handling.

• Require a signed BAA that covers file uploads, APIs, integrations, analytics, and AI features.
• Enable access controls, audit logging, encryption, and short retention with verified deletion.
• Disable non-BAA features, especially notifications with attachments and any uncovered AI features.
• Limit integrations to HIPAA-compliant services with their own BAAs.

Bottom line: Is Typeform HIPAA compliant for pre-visit intake with photos? It can be—only when you are on a HIPAA-eligible plan with an executed BAA and you configure features to align with the HIPAA Security Rule. Otherwise, do not collect PHI in the platform.

FAQs.

Does Typeform provide a Business Associate Agreement?

Only HIPAA-eligible offerings may include a Business Associate Agreement. You must request and obtain a fully executed BAA before collecting PHI. Without a signed BAA, you should not use Typeform to handle PHI or patient photos.

Can photos be stored HIPAA-compliantly in Typeform?

Yes—if you are on a HIPAA-eligible plan with an executed BAA and you configure security controls properly. Use access controls, encryption, short retention, and metadata stripping, and disable notifications or integrations that expose images outside authenticated systems.

What configurations are needed for HIPAA compliance?

Use least-privilege access, SSO/MFA where available, encryption in transit and at rest, audit logs, short retention with secure deletion, and strict controls over exports. Disable AI features not covered by your BAA, avoid PHI in emails, and connect only to third parties that will sign a BAA.

Are all Typeform plans HIPAA eligible?

No. HIPAA eligibility is typically limited to specific business or enterprise offerings. Confirm eligibility and secure a signed BAA before building any intake form that collects PHI or patient photos.