How to Get the Jotform BAA Signed: A Step-by-Step Walkthrough
The Jotform BAA is a 10-minute task once you know which screen to click. Here is the exact path: what to enable, what to ask for, and how to verify it actually got signed.
- The Jotform BAA is only available on the Gold plan or Enterprise tier. Upgrade your account first.
- After upgrade, the BAA is generated from inside Account Settings. Most setups have it signed and on file within 24 hours.
- Verify by checking your account's HIPAA badge and asking for a countersigned PDF copy. Keep that PDF in your compliance folder.
- Common gotcha: the BAA covers the account holder, not the form. If you transfer ownership of the form to a new account, the BAA does not transfer with it.
If you got here looking for whether Jotform is HIPAA-compliant: yes, on the right plan, with a signed BAA. The harder question is what happens after the form gets submitted. If you want the BAA in hand without a week of back-and-forth, this is the exact path. I worked on the Jotform HIPAA codepath from 2020 to 2025, including the BAA flow itself. Here is what works.
Step 1: Upgrade to the HIPAA plan
- Sign in to Jotform with the account that owns the forms collecting PHI.
- Go to My Account → Billing.
- Select the HIPAA plan from the plan picker. If you do not see it, scroll. HIPAA is listed below the standard tiers.
- Complete the upgrade. The HIPAA badge appears in your account header within a minute.
- Important: the HIPAA badge is not the BAA. You still need to request and sign the agreement separately.
Step 2: Generate and sign the BAA
- Go to My Account → Settings → HIPAA Compliance.
- Click 'Request BAA'. The system generates a pre-filled BAA addressed to your account holder name.
- Review the document. The two clauses to read carefully are the breach notification timeline (typically 60 days) and the subprocessor list.
- Sign electronically. Jotform countersigns automatically and emails the executed PDF to the account email.
- Save the PDF in a compliance folder you control, not just in the email inbox where staff turnover will lose it.
Step 3: Verify the BAA is in effect
Three checks: run all three before you put PHI on a form.
- Account header shows the HIPAA badge (green or marked 'HIPAA').
- Settings → HIPAA Compliance shows 'BAA Active' with a date.
- You have the countersigned PDF saved locally with both signatures on it (yours and Jotform's).
If any of those three are missing, do not assume the BAA is in effect. The most common failure mode I see is teams who signed the BAA on their side but never received the countersigned copy back. Without the countersigned PDF, you do not have a binding BAA.
Step 4: Configure the account-side defaults
Signing the BAA is necessary but not sufficient. Flip these account settings before any PHI form goes live:
- Enable 2FA on every account that can access HIPAA forms (Account Settings → Security).
- Set submission storage retention to your practice's policy (usually 6-7 years for medical records). HIPAA Compliance → Data Retention.
- Restrict who can view submissions to specific named accounts (Form Builder → Settings → Form Permissions).
- Turn on activity logging at the account level (Enterprise only, but useful where available).
Step 5: Document the chain
Auditors look for a paper trail. Keep a single document (I call it the 'Compliance Decision Log') that lists:
- Date the Jotform BAA was signed and a link to the countersigned PDF.
- Date each downstream integration's BAA was signed (Zapier HIPAA, Workspace, Salesforce, etc.) and links to those PDFs.
- List of accounts authorized to view PHI on this Jotform account, with role and start date.
- Date of last access log review and who reviewed it.
- Date of last integration audit and a 'safe / replace / remove' verdict for each.
Common failure modes
Signing the BAA after PHI has already been collected
If patient data was submitted before the BAA was active, that data was technically processed without a BAA in place. Best practice: delete those submissions and have patients re-submit under the active BAA, or document the gap in the decision log and remediate.
Transferring form ownership without re-signing
The BAA covers the account holder. If you transfer a HIPAA form to a different Jotform account (e.g., from a personal account to a clinic account), the new account needs its own HIPAA plan and its own BAA. The form does not carry compliance with it.
Forgetting to renew on plan change
If you downgrade off the HIPAA plan and then upgrade back later, you will need to request the BAA again. Some teams have run for months on a downgraded plan without realizing they were out of compliance.
Done-for-you BAA setup
If you want a Jotform HIPAA expert to run the full BAA + integration + decision-log setup in your account once and hand it back compliant, that is what the Done-For-You HIPAA engagement covers.
