Typeform alternative for HIPAA patient intake forms

Can a clinic run patient intake forms on a self-hosted tool under HIPAA?

A self-hosted Formbricks or LimeSurvey instance can hold intake and screening data inside a clinic's own HIPAA-covered environment, but the HIPAA obligations stay with the covered entity. The Security Rule applies to covered entities and their business associates for all electronic protected health information they create, receive, maintain or transmit, so choosing an open-source tool does not transfer responsibility for that data. There is also no HIPAA certification for any product or hosting setup. As HHS's 2003 FAQ explains, no Security Rule standard requires certifying compliance, and private certifications do not stop HHS from later finding a violation. What a clinic can build instead is a set of controls, signed contracts and evidence that those controls work. The rest of this page maps those controls onto Formbricks and LimeSurvey and sets out what to confirm before patient data arrives.

Both tools keep data where you put it, but the features that govern access are not equal. The Formbricks license documentation places OIDC and SAML single sign-on, teams and access roles, and audit logs in the Enterprise license, while the Community Edition includes file upload, full API access and webhooks. A clinic that needs role-based access to intake responses and an audit trail of who viewed them should price the Enterprise license into its plan, or design compensating controls that the Community Edition can support. LimeSurvey Community Edition is free to download and self-host under GPL, and survey data stays on the server you choose, but the facts available here do not establish its single sign-on or audit logging. Confirm those controls directly with the project for the exact version you deploy before relying on them.

HIPAA requirements for patient intake forms

Intake and screening forms collect electronic protected health information the moment a patient submits them, so the HIPAA Security Rule applies to the form tool as much as to the clinic's record system. The cards below cover scope, the safeguards most relevant to a self-hosted form platform, the contract terms that bind vendors, and the regulatory outlook.

Scope: covered entities and business associates

The Security Rule applies to covered entities, which are health plans, health care clearinghouses and covered health care providers, and to their business associates, for all electronic protected health information they create, receive, maintain or transmit. A form collected from a patient is ePHI from the first submission. Confirm with counsel whether your clinic is a covered entity, and whether a hosting provider or support firm touching the data is a business associate.

18 standards and 36 specifications

Appendix A to Subpart C groups the Security Rule into administrative, physical and technical safeguards. It contains 18 standards with 36 implementation specifications, 14 required and 22 addressable. Addressable does not mean optional: you must assess whether each specification is reasonable for your environment and document the alternative you choose if you do not implement it. Map each standard to the form platform, its hosting and its administrators.

Unique user identification and emergency access

The two required technical specifications are unique user identification and an emergency access procedure. For intake forms, every staff member who views responses or exports files needs an individual account, not a shared login. Define who can obtain access to response data during an outage, how that access is logged, and how it is revoked. Test this procedure on the self-hosted instance before go-live.

Automatic logoff and encryption

Automatic logoff and both encryption specifications for ePHI are addressable, so they must be assessed and either implemented or justified. For a self-hosted form tool this means setting session timeouts on the admin console, enforcing TLS for respondent submissions and encrypting the database, backups and uploaded files at rest. Document the decision for each, including the key management approach.

Business associate contract terms

A business associate contract under 45 CFR 164.314 must require the business associate to comply with the Security Rule, flow the same terms to subcontractors that handle ePHI, and report security incidents to the covered entity. If an outside firm installs, hosts or supports your Formbricks or LimeSurvey instance and can reach its data, that contract is required. Software you run entirely in your own environment does not create one by itself, so confirm the boundary in writing.

Penalty exposure and the proposed revision

For penalties assessed on or after 28 January 2026, the inflation-adjusted civil money penalty ranges from $145 to $2,190,294 per violation, with a calendar-year cap of $2,190,294. HHS proposed a major Security Rule revision on 6 January 2025, but as of October 2026 no final rule has been published and the Unified Agenda projects final action for July 2027. Plan against the current rule, and watch for changes that would affect risk analysis and encryption requirements.

Where Typeform's HIPAA position leaves smaller clinics

The Typeform pricing page lists HIPAA only on its Enterprise plan, which also carries custom limits and SSO and a choice of US or EU data center. The Basic, Plus and Business tiers, as read in October 2026, do not list HIPAA. That does not settle whether a smaller clinic can use those tiers for intake data, but it does mean the question has to be answered directly with the vendor before any patient information goes into a form. A clinic that expects to handle protected health information should not rely on the marketing page alone.

Before committing, ask Typeform in writing whether it will sign a business associate agreement that covers the form data you plan to collect, and confirm which plan that agreement attaches to. Under 45 CFR 164.314(a)(2)(i), the agreement must require the vendor to comply with the Security Rule, pass the same terms to any subcontractor that handles ePHI, and report security incidents to you. Ask which data center stores your responses, and whether that location is fixed for the life of the account. Ask how uploaded files are retained, how long they stay after a submission is deleted, and whether backups hold copies of them.

Keep the answers in your compliance file with the date they were given. If the answers do not cover the agreement, data location or file retention you need, the gap is a procurement decision, not a configuration problem. Self-hosting moves those answers into your own environment, where your team sets the retention and location rules, but it also makes you responsible for the safeguards that the vendor previously handled. Treat the written vendor answers as the baseline for that comparison.

Which open-source option fits a HIPAA intake workflow

This table compares the intake needs of a clinic across Formbricks Community Edition, Formbricks with an Enterprise license and LimeSurvey Community Edition. Read the Formbricks columns as the difference one license key makes, and treat every LimeSurvey item marked to confirm as an open question for a test instance before you commit.

Requirement	Formbricks Community Edition	Formbricks with Enterprise license	LimeSurvey Community Edition
Unique user accounts	Unlimited users included, each with their own login	Unlimited users included, each with their own login	Multiple admin accounts supported; confirm per-user permissions in your install
Access roles and teams	Not included	Teams and access roles included	Confirm role-based permissions per survey and per staff member
Audit logs	Not included	Audit logs included	Confirm whether an activity log exists and what it records
SSO (OIDC or SAML)	Not included	OIDC and SAML SSO included	Confirm supported login methods and any LDAP or SSO plugin with the vendor
File upload questions	Included in Community Edition	Included	Confirm the upload question type, storage location and size limits
Webhooks to clinic systems	Included, sending responses to your own endpoints	Included	Confirm whether a plugin or API export is needed and test delivery
Database and PHP stack	Deployed with Docker; no subscription needed to self-host	Same Docker images, unlocked with an Enterprise License Key	PHP 8.1.29 or later with mbstring and PDO; MySQL 8.0, PostgreSQL 14, MariaDB 10.3.38 or MSSQL 2019
Current version to deploy	Formbricks 6.0.2, published October 1, 2026	Formbricks 6.0.2, published October 1, 2026	Community Edition 7.6.0; avoid the 6.17.19 line, now out of support

Deploying a self-hosted intake form under HIPAA

This sequence moves patient intake and screening forms from Typeform into a self-hosted instance whose hosting, access and logging decisions your organization can document against its own HIPAA risk analysis.

Confirm covered entity and business associate roles
Your compliance lead and counsel confirm whether your organization is a covered entity, whether the hosting provider or support firm is a business associate, and which electronic protected health information the forms will collect. The HIPAA Security Rule applies to covered entities and their business associates for all ePHI they create, receive, maintain or transmit. Done means a written role map and, where a third party will touch ePHI, a business associate contract that requires Security Rule compliance and incident reporting to you.
Choose the platform and record the risk analysis
Compare Formbricks and LimeSurvey against the intake workflow: question types, file upload needs, conditional logic and whether the forms are link surveys or embedded in a patient portal. Your security officer records the decision in the risk analysis, including which Formbricks features your use case needs (such as roles, audit logs or SSO) and whether they require an Enterprise license key. Done means a signed decision memo that names the platform, version and the controls it depends on.
Place the server in a HIPAA-covered environment
Your infrastructure team deploys the application in a hosting environment that your organization or its business associate operates under a signed agreement. Enforce TLS for all browser and API traffic, and encrypt storage volumes and database backups at rest. Confirm the encryption choices against the addressable encryption specifications in the Security Rule and document why you chose each one. Done means a network diagram, a certificate inventory and a storage encryption record tied to the risk analysis.
Configure the database and file storage
Install the application against a dedicated database instance (LimeSurvey supports MySQL, PostgreSQL, MariaDB and MSSQL, while Formbricks uses its own database setup), restrict network access to the application tier, and set a private location for uploaded files that is not publicly listable. Turn on database audit logging where the platform or your database offers it, and confirm that uploaded documents are scanned and retained according to your policy. Done means a tested restore of the database and a file access test from an unauthorized account that fails as expected.
Set up unique accounts, roles and logoff
Create one named account for every staff member who will build forms or view responses, and avoid shared logins, which fail the unique user identification requirement. Assign the minimum role needed by intake staff, clinicians and administrators, and confirm that the access role model matches the need-to-know principle your risk analysis records. Set automatic session logoff at a value your policy defines. Done means an access matrix signed by the privacy officer and a test log showing the roles can see only their assigned forms.
Enable backups and test emergency access
Schedule encrypted backups of the database and the file store, stored separately from the production environment, and document retention periods. Write an emergency access procedure that names who can reach the system during an outage and how that access is granted and recorded. Run one restore exercise and one emergency access exercise, and record the results. Done means a dated test record showing a successful restore and a documented break-glass login that was approved and logged.
Switch webhooks and embeds to the new instance
Repoint every webhook, API consumer and website or portal embed from Typeform to the new endpoints, and confirm that each receiver accepts only the new certificate chain. Test the full path with dummy patient data that is labeled as test data and deleted afterward. Confirm that no data flows to an external tool unless a business associate agreement covers that tool. Done means a checklist signed off by the integration owner showing each connection tested and each unreviewed third-party connection disabled.
Retire the Typeform account after cut-over
After you export historical responses and uploaded files, confirm the export is complete and verified, then disable intake forms in Typeform and plan the account closure. Ask Typeform, through its support or contract team, how it deletes data after closure and whether it will provide written confirmation. Keep the export under the same controls as the new system, and record the closure date in the risk analysis. Done means a closure confirmation, a stored export checksum record and an updated data inventory.

Access roles, uploaded files and audit logs in each tool

Formbricks Community Edition includes file upload, webhooks and full API access, but the license documentation places teams, access roles, audit logs and OIDC or SAML SSO in the Enterprise license. A clinic that needs staff to see only certain surveys, or that needs a record of who changed a form or viewed responses, should treat that license as a requirement before go-live and not an assumption. Uploaded files are stored by the instance, so the storage location decides where patient documents sit.

Roles and teams: Teams and access roles require the Enterprise license. On Community, confirm which owner and member permissions exist in your version and whether a non-admin user can export full response sets.
File uploads: File upload is part of the Community feature set. Confirm whether files land on a container volume or in external storage you configure, whether they are encrypted at rest, and whether file links require an authenticated session.
Audit logs: Audit logs are listed under the Enterprise license. Without it, plan a separate record of access from the reverse proxy and database logs, and confirm what each one captures.
SSO and sessions: Single sign-on through OIDC or SAML is also an Enterprise feature. On Community, idle logoff has to be enforced at the proxy or identity layer.

Before loading any intake data, check the current license terms and run a permission test on a non-production instance with a user who should see no responses.

Evidence a HIPAA reviewer or auditor will ask for

A HIPAA reviewer or auditor will ask for records that show the Security Rule safeguards operate, not just that they were configured once. The organization prepares these records itself, because HIPAA has no certificate to issue, and each card below maps to a part of the intake workflow that touches ePHI.

Risk analysis and risk register

Document where intake responses, uploaded files and webhook payloads are created, stored and transmitted, then record the threats and controls for each point. Reviewers expect this analysis to be current and to name the Formbricks or LimeSurvey instance, its database, its backups and any integration that receives patient data. Confirm that the register is reviewed on a set schedule and after material changes such as a new form or a new webhook destination.

Signed business associate agreements

Every vendor, host or support provider that can reach ePHI needs a written business associate contract that requires Security Rule compliance and incident reporting to the covered entity. Self-hosting shifts some of this to your cloud or data center provider, so list each one. Check that subcontractors handling ePHI are bound by the same terms.

User access lists and role reviews

Keep a current list of every account on the survey platform, with its role, the clinical or administrative need behind it and the date of its last review. Formbricks needs its Enterprise license for teams and access roles, and LimeSurvey role settings must be confirmed in your configuration. Unique user identification is a required implementation specification, so shared logins will be flagged.

Configuration baselines and encryption settings

Record the approved settings for the application, database, TLS termination, storage encryption and session timeout, along with who approved them and when. Auditors compare these baselines against the running system, so screenshots or exported configuration files should match. Automatic logoff and encryption are addressable specifications, so document either the implemented setting or the reason it was not adopted.

Backup and restore test records

Keep logs of backups of the database and uploaded file storage, and of restore tests that rebuild a working instance from them. A backup that has never been restored is weak evidence. Record the restore date, the data checked and any gaps found, and keep these records with the contingency plan.

Incident response and audit log records

Keep the incident response plan, the audit log configuration and examples of reviewed log entries. Audit logs are an Enterprise feature in Formbricks, so confirm what LimeSurvey and your chosen tier record before relying on them. Reporting timelines for breaches of unsecured PHI flow down from business associate contracts, so the plan should name who notifies whom.

Webhook data flow diagrams

Draw how each form sends responses, files and metadata to downstream tools such as a spreadsheet, EHR interface or automation service. Record the endpoint, the authentication method and whether each destination is covered by a business associate contract. Formbricks lists integrations with Slack, Notion, Zapier and n8n, and each one that receives patient data needs its own agreement and review.

Questions clinics ask before a HIPAA intake project

What drives the cost of self-hosting Formbricks or LimeSurvey versus paying for a Typeform Enterprise plan?

The cost difference is mostly a matter of which items you pay for, not a published price comparison. Typeform lists HIPAA and SSO only on its Enterprise plan, and its Enterprise limits and pricing are set by custom quote, so ask Typeform for the written figure. Self-hosting shifts the spend to the servers or cloud account you run, the database and PHP or container operations, backups, the time your staff or a partner spends on setup and upgrades, and any Formbricks Enterprise license you need. LimeSurvey Community Edition is free to download and self-host, and Formbricks can be self-hosted with Docker without a subscription. Ask any implementation partner for a fixed-scope quote that lists each of these components separately, so you can compare recurring and one-time costs with the Enterprise quote on equal terms.

Do I need a Formbricks Enterprise license for SSO, roles and audit logs?

Yes, for Formbricks. The self-hosted Community Edition does not include OIDC or SAML SSO, teams and access roles, or audit logs. Those features, along with contact management, quota management, whitelabel email follow-ups and removal of the Powered by Formbricks badge, need the Enterprise license, which is unlocked with an Enterprise License Key. The enterprise code ships in the Docker images, so confirm with Formbricks which edition and key your setup requires before you plan access control. LimeSurvey's documentation and features should be checked separately against your required role model, because this page's sources do not confirm how its access roles and audit logging map to HIPAA expectations. Ask for a written feature matrix for the version you intend to deploy.

How long does a migration from Typeform to a self-hosted form tool take?

No researched fact gives a migration duration, so treat any number you hear as a question to ask rather than a benchmark. The time depends on how many forms you rebuild, how much conditional logic and hidden field handling each one has, how many historical responses and uploaded files you move, and whether you need the Responses API export to run in stages. Typeform's Responses API may not include submissions from roughly the last 30 minutes, so plan a cut-over window that accounts for that lag. Parallel running, staff review of intake forms, and the clinical sign-off on each rebuilt question also add time. Request a written plan with phases, owners and acceptance checks before work starts.

What must our clinic provide internally for a HIPAA intake project?

The clinic owns the compliance decisions, so it must supply several inputs before any build begins:

Named owners for the Security Rule risk analysis and for who may view patient intake data.
A cloud account, data center or private network where the platform will run, plus the hostnames and identity provider you want to use.
Clinical staff to approve every rebuilt question, screening logic and consent statement.
Decisions on retention for responses and uploaded files, and on who receives webhook or integration data.
Access to the Typeform account for export, and a cut-over date agreed with front-desk staff.

Under 45 CFR 164.308 and 164.312, the covered entity must document these safeguards. Confirm each requirement against the Security Rule text and your counsel's guidance.

Can our IT team run a HIPAA-covered Formbricks or LimeSurvey deployment without outside help?

A capable IT team can deploy either tool, but the work extends beyond installation. Formbricks is deployed with Docker, and LimeSurvey requires PHP 8.1.29 or later with mbstring and PDO drivers plus a supported database such as MySQL 8.0, PostgreSQL 14 or MariaDB 10.3.38. Your team must also configure encryption, unique user identification, automatic logoff, emergency access, backups and logging, which correspond to the technical safeguards in 45 CFR 164.312. Those are addressable or required specifications you must document and test. Many clinics choose a partner for planning, hardening and compliance evidence, while DeployOpen prepares systems, controls and evidence for assessments but does not issue audit reports or certifications. Decide which parts your staff can own before you sign a scope.

When is a business associate agreement needed for a self-hosted intake form?

A business associate agreement is needed when a third party creates, receives, maintains or transmits electronic protected health information on your behalf. If you run the form tool on your own servers or cloud account and no outside party accesses the ePHI, you may not need a business associate contract for that platform. If a hosting provider, managed service or implementation partner can access the data, a contract is required under 45 CFR 164.314(a)(2)(i), which requires the business associate to comply with the Security Rule, flow terms down to subcontractors and report security incidents. Ask counsel to review each vendor and partner relationship, and confirm the scope of any access during the scoping stage.

Does a HIPAA certification for Typeform or a self-hosted tool prove compliance?

No. HHS states that no Security Rule standard requires an entity to certify compliance, and private certifications do not prevent HHS from later finding a violation. The HHS Office for Civil Rights enforces the rule through complaints, compliance reviews and audits. Be cautious with any vendor claim of HIPAA certification, and ask for the specific evidence and the scope it covers. Civil money penalties under 45 CFR 102.3 range from $145 to $2,190,294 per violation for penalties assessed on or after 28 January 2026, with a calendar-year cap of $2,190,294, so the documented risk analysis matters. HHS proposed a major Security Rule revision on 6 January 2025 and has not published a final rule, so confirm the current status before you finalize your controls.

How DeployOpen deploys intake forms under HIPAA

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For clinics moving patient intake and screening forms off Typeform, that means a written scope that defines where Formbricks or LimeSurvey runs, how uploaded files and access roles are configured, and which evidence the client's compliance team will need. DeployOpen prepares systems and evidence for compliance assessments but does not issue HIPAA certifications or audit reports.

How we scope

Map which intake, screening and consent forms hold ePHI and which carry only general information.
Define the hosting boundary, including the cloud account, data center or network where the forms run.
Agree in writing which access roles, audit log settings and file upload rules are in scope.

How we build

Deploy the chosen platform with encryption in transit and at rest, configured against the client's own requirements.
Configure unique user accounts, role-based access and automatic logoff settings for staff and reviewers.
Set up upload storage and retention rules for patient files, then test them with representative sample data.

How we hand over

Document the architecture, configuration, access model and backup procedures in the client's own records.
Provide control evidence mapped to the client's HIPAA Security Rule risk analysis, for the client's compliance team and assessors to review.
Walk through administration, incident handling and the business associate contract questions the client must answer.

How we support

Engagements are fixed-scope, so scope, deliverables and timelines are agreed in writing before work starts.
Ongoing support, upgrades and continuous security testing are available as a retainer, which the client can scope separately.
Ask for a quote based on the written scope, which sets out the one-time build and any recurring support.

Typeform alternative for HIPAA and patient intake forms