By Mehdi HassanCan Webflow or Framer forms be HIPAA compliant?
Webflow and Framer native forms shouldn't be treated as HIPAA compliant, because neither platform covers them with a business associate agreement by default, and submissions are stored and emailed through systems not set up for protected health information. The working answer is to keep native forms for non-health inquiries and route any PHI to a form provider that will sign a BAA. Check each platform's current documentation, since offerings change.
This how-to is part of our healthtech website design hub. It assumes you already know whether HIPAA applies to you; if not, start with our guide to what actually needs to be HIPAA compliant. Below are the approaches, then setup steps for Webflow, Framer and Next.js, then a launch test. This is a technical brief, not legal advice.
Which approach should you use for a HIPAA compliant contact form?
The approach for a HIPAA compliant contact form depends on your platform and how custom the form must be. Embedding a BAA-covered provider's form is the most common choice on Webflow and Framer. Linking out to the provider's hosted form is the simplest and keeps your site's scripts fully separate. A custom form in Next.js gives the most control but puts more responsibility on your team.
Approach | How it works | Best for | Trade-off |
|---|---|---|---|
Embedded provider form | Provider's form loads in an embed or iframe on your page | Webflow and Framer intake or contact forms | Limited styling; page scripts still need care |
Link-out to hosted form | Button opens the provider's own form page | Highest separation, fastest setup | Visitor leaves your site; brand break |
Custom form, direct to provider API | Your UI posts straight from the browser to the provider | Next.js sites needing a branded form | Developer time; check the provider supports it |
Custom form via your own backend | Your server receives and stores PHI | Products with their own HIPAA infrastructure | Your host and database need BAAs and safeguards |
Form providers such as Jotform and Formstack offer HIPAA features and BAAs on certain plans. Check the current plan pages to confirm which tier includes a BAA before you buy, because it's often not the cheapest one.
How do you set up HIPAA compliant forms in Webflow?
To set up HIPAA compliant forms in Webflow, build the form in a BAA-covered provider, embed it with Webflow's custom code embed element, remove any native Webflow form from that page, and control which site-wide scripts run there. The provider stores the data; Webflow only displays the page.
Sign the BAA first
Choose a form provider, upgrade to the plan that includes a BAA, and sign it before collecting any real data.
Build and secure the form there
Create the form in the provider, turn on its HIPAA settings, encryption and access controls, and limit who can view submissions.
Embed it in Webflow
Add the provider's embed code with Webflow's Embed element on a dedicated page. Don't wrap it in a Webflow form block.
Remove native forms from that page
Delete any Webflow form on the intake page so nothing duplicates the data into Webflow's form submissions.
Control the page's scripts
Review site-wide custom code in project settings. Move ad pixels and session recording to page-level code on marketing pages only, so they don't load on the intake page.
Fix notifications
In the provider, set staff notifications to alert without including submission content.
How do you set up HIPAA compliant forms in Framer?
To set up HIPAA compliant forms in Framer, follow the same pattern: build the form in a BAA-covered provider, add it with Framer's embed component or link to the hosted form, and keep Framer's native forms for non-health inquiries. The main Framer-specific work is controlling custom code so tracking doesn't load on the intake page.
Sign the BAA and build the form
As with Webflow, choose the provider plan with a BAA and build the form there with its HIPAA settings on.
Add it with an embed
Use Framer's Embed component with the provider's embed code or URL on a dedicated page.
Or link out
If the embed's styling or height behaves poorly, a clear button to the provider's hosted form is a simpler, cleaner option.
Check site-wide custom code
Review Framer's site settings for scripts injected on every page, and move tracking to page-level code where you can.
Relabel native forms
Where Framer forms remain, such as a press or partnership form, add a line telling visitors not to include health information.
How do you build HIPAA compliant forms in Next.js?
To build HIPAA compliant forms in Next.js, design the form as a React component but send submissions directly from the browser to a BAA-covered provider's API or secure endpoint, so PHI never passes through your own hosting. If it must pass through your server, every system it touches, including hosting, logs and error tracking, needs a BAA and safeguards.
- Pick the destination. A BAA-covered form, intake or EHR vendor that offers an API or secure post endpoint.
- Post from the client. Send the form data straight to that endpoint over HTTPS, not through a Next.js API route, unless your host is covered by a BAA.
- Scrub observability. Make sure error tracking, logging and session replay tools don't capture form field values. Mask inputs by default.
- Isolate scripts. Load analytics and pixels only on marketing routes, and keep intake routes free of third-party scripts.
- Validate without storing. Client-side validation is fine; don't cache or persist the payload in local storage.
- Show a safe confirmation. The thank-you screen and any URL should not contain health details.
Next.js is often the better fit when intake is part of the product, such as an eligibility check before booking; see our guide to telehealth website design. For the platform decision overall, our guide on choosing a platform for a marketing site compares Webflow, Framer, WordPress and Next.js.
Questions to ask a form provider before you sign
Will you sign a BAA, and on which plan? Is data encrypted in transit and at rest? Where is data stored, and can we choose the region? Can we restrict who sees submissions and require two-factor authentication? Are there audit logs? Can notifications exclude submission content? How long is data retained, and can we set retention? Can we export and delete records? Does the embed load any third-party scripts of its own? How do you handle file uploads, such as insurance cards?
Get the answers in writing, and keep a copy of the signed BAA with your compliance records.
How do you test HIPAA forms before launch?
Test HIPAA forms before launch by submitting a dummy record with obviously fake health details, then checking every place that record could land: the provider dashboard, staff email inboxes, your analytics, ad platform event logs, error tracking and server logs. If the fake data appears anywhere outside the BAA-covered provider, fix it before going live.
- Submit a test entry with fake but realistic-looking health details.
- Confirm it appears in the provider dashboard and nowhere else.
- Check staff notification emails contain no submission content.
- Inspect network requests on the page for calls to analytics or ad domains.
- Search your error tracking and logs for the test values.
- Repeat after any new script, plugin or integration is added.
Our guide to healthcare website tracking covers pixel auditing in more depth. Regulated intake isn't unique to healthcare; law firms face similar issues with confidential details, as covered in our guide to law firm website requirements.
Should you move platforms to get HIPAA compliant forms?
You usually don't need to move platforms to get HIPAA compliant forms, because embedding a BAA-covered provider works on Webflow and Framer. Moving makes sense when you need custom eligibility logic, strict per-route script control or integration with your product, which are easier in Next.js.
If you're weighing a move, our guide to Framer to Next.js migration cost explains the work involved, and our guide to Figma to website covers choosing a build path for a new design. For budgets that include BAA-covered tools, see our healthcare website cost guide. Migration work is scoped on the intro call, and we include redirects and SEO checks in any migration we take on.
