Does Typeform AI sign a BAA?
Only on some plans or setups
Typeform signs a BAA for customers on its Enterprise or Growth Custom plans, arranged through Sales. Its BAA help article does not say whether Typeform's AI features are covered.
- Business associate
- Typeform
- Tool
- Typeform AI
- Plans with a BAA
- Enterprise / Growth Custom
- Checked
Some plans only
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Enterprise / Growth Custom | Signs a BAA | Through salesRequest page | Existing Enterprise or Growth Custom customers request the BAA through the Sales form linked from the help article.[1] |
| Other plans (Basic, Plus, Business, Growth Essentials/Pro) | No BAA | Not offered | The BAA is limited to Enterprise and Growth Custom. Customers on other plans are sent to a 'Request HIPAA Pricing' form, which leads to an upgrade.[1] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Typeform says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Typeform AI features (AI form creation, AI insights)Enterprise / Growth Custom | Not stated | The BAA article does not mention AI features, either as included or excluded. Confirm with Typeform Sales before sending PHI to AI features.[1] |
Workspace and collaboration AI that offer a BAA
- Adobe Acrobat AI AssistantBAA on: Acrobat Studio for enterprise: Analyzer in Acrobat, Acrobat Studio for enterprise: Knowledge Base in AcrobatSome plans only
- Airtable AIBAA on: Enterprise ScaleSome plans only
- Asana AIBAA on: AsanaGov, Enterprise+Some plans only
- Atlassian Rovo / Atlassian Intelligence (Confluence, Jira)BAA on: Enterprise, Standard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence)Some plans only
- Box AIBAA on: Enterprise / Enterprise Plus / Enterprise AdvancedSome plans only
- ClickUp BrainBAA on: EnterpriseSome plans only
All BAA-ready alternatives to Typeform AI
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.