If your practice website runs on Duda and you need a HIPAA-compliant contact form, Duda's built-in form isn't the answer.
Duda doesn't sign a business associate agreement (BAA).
That means its native form should not be used to collect protected health information (PHI).
Instead, use a form from a vendor that does sign a BAA, and have your
Duda agency embed it on your website.
Below, I cover:
- When you need a HIPAA-compliant form
- What makes a form HIPAA-compliant
- 4 form builders that work with Duda
- How to add a third-party form to a Duda website
A quick note before I dig in: this article is general information, not legal advice. For questions about your specific situation, talk to a healthcare attorney or compliance professional.
Do You Need a HIPAA-Compliant Form?
One question decides that: does your form create, receive, store, or transmit PHI?
PHI is health information tied to an identifiable person. A name alone isn't PHI. A name attached to a question about an appointment or health condition is.
You may not need a HIPAA-compliant form if:
- Your website gives patients another path for booking appointments and asking questions, like a patient portal or your EHR's scheduling tool
- Your general contact form asks only for a name, contact details, and a message
- The form doesn't ask for a date of birth, reason for visit, symptoms, or insurance details
- Patients are not defaulting to your general contact form to ask questions about their care
For more on this setup, read Does Your Medical Practice Website Need to Be HIPAA Compliant?.
You need one if:
- Patients use the form to communicate with you about their care
- The form asks intake or screening questions
- The form requests health information
What Makes a Contact Form HIPAA-Compliant
There's no official HIPAA certification for software.
What you're looking for is a vendor that will take on legal responsibility for protecting the data, and a product built to support HIPAA's Security Rule.
1. The vendor signs a BAA
A vendor that receives or stores PHI on your behalf is a business associate, and HIPAA requires a signed BAA with them.
Form vendors usually offer a BAA only on a higher-tier paid plan. A free or entry-level plan typically won't qualify.
2. The product supports HIPAA's technical safeguards
The Security Rule's technical safeguards cover how electronic PHI is protected. In a form tool, look for:
- Encryption of submissions in transit and at rest
- Access controls, so only authorized staff can view submissions
- Audit logs that record who accessed what
FYI: Your practice still owns compliance
A vendor can sell you a HIPAA-compliant tool. They can't make your practice compliant.
How your staff handles form submissions after they arrive is still your responsibility.
For example, if PHI will arrive in your inbox via form submissions (or otherwise), make sure you have a signed BAA with your email provider too.
4 HIPAA-Compliant Forms That Work With Duda
Each form builder below offers a business associate agreement and provides embed code you can paste into Duda's HTML widget.
BAA availability is accurate as of October 2026. BAAs are typically limited to higher-tier plans, so confirm the details with each vendor before you buy.
1. Jotform
A widely used form builder with a dedicated set of HIPAA-compliant features and step-by-step instructions for embedding forms on Duda.
2. Cognito Forms
A form builder that encrypts data at rest and serves forms over HTTPS, with a signed BAA and HIPAA compliance on its Enterprise plan.
3. Typeform
HIPAA-compliance is available on their Enterprise plan. Details, including pricing, is available only via a call with their sales team.
4. FormAssembly
A data collection platform that offers HIPAA compliance on enterprise-level plans, with a strong focus on Salesforce integration. Must book a demo in order to request pricing.
How to Add a HIPAA-Compliant Form to Duda
Use Duda's HTML widget to place the form vendor's embed code on your page.
- In your form builder, copy the form's embed code.
- In the Duda editor, go to the page where the form should appear.
- Find the HTML widget and drag it to the spot where you want the form.
- Paste the embed code into the widget.
- Click Done, then save and publish.
When you embed a third-party form this way, submissions go to the form vendor's servers, not Duda's.
That's why the form vendor's BAA is the one that matters.
Get Help Making Your Contact Form HIPAA-Compliant
If patients are already using your website to reach you, it’s important to know exactly what your forms collect and where those submissions go.
Bonfire Studio works with healthcare practices on Duda to:
- Review what your current forms ask for and where submissions end up
- Replace any form that collects health information with one from a vendor that signs a BAA
- Route appointment requests and medical questions to your patient portal
If your website has outgrown what a form change can fix, we’ll rebuild it with these decisions made from the start.
About the Author: Sara MacQueen
Sara MacQueen is the founder of Bonfire Studio, a web design studio that builds compliant websites for healthcare practices and professional service firms. She has over 20 years of experience spanning design, marketing, and software development.
