formstack.com

Yes. As of **August 2026**, there are several no-code/low-code platforms that will sign a HIPAA Business Associate Agreement (BAA). The important distinction is that **“HIPAA-capable” is not the same as “the vendor will sign a BAA for your specific account.”** HHS says a cloud provider handling ePHI on your behalf generally needs a BAA in place. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### Strongest options | Platform | BAA? | Best for | Notes | |---|---|---|---| | **[Knack Health](https://www.knack.com/health/?utm_source=chatgpt.com)** | **Yes** | Custom healthcare apps/databases | Purpose-built HIPAA environment; BAA included on HIPAA plans; RBAC, encryption, record-change logs. [www.knack.com](https://www.knack.com/health/hipaa-database/?utm_source=chatgpt.com) | | **[Caspio](https://www.caspio.com/?utm_source=chatgpt.com)** | **Yes** | Database-driven web apps | Dedicated HIPAA Edition, signed BAA, encryption, RBAC and audit logging. Current HIPAA Edition starts at $800/mo. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) | | **[Blaze](https://www.blaze.tech/?utm_source=chatgpt.com)** | **Yes** | More sophisticated custom apps | BAA available on higher/enterprise tiers; particularly geared toward healthcare apps. [www.knack.com](https://www.knack.com/health/compare/?utm_source=chatgpt.com) | | **[Jotform](https://www.jotform.com/?utm_source=chatgpt.com)** | **Yes** | Forms, intake, consent, simple workflows | Very easy no-code option; Jotform explicitly provides a signed BAA for its HIPAA-enabled offering. [www.jotform.com](https://www.jotform.com/hipaa/health-app/?utm_source=chatgpt.com) | | **[Formstack](https://www.formstack.com/?utm_source=chatgpt.com)** | **Yes** | Forms, documents, e-signatures, workflows | Standard BAA available; has dedicated healthcare configurations. [www.formstack.com](https://www.formstack.com/features/hipaa-compliant-esignatures?utm_source=chatgpt.com) | | **Microsoft Power Apps** | **Yes, through Microsoft's HIPAA-covered services** | Enterprise/internal apps | Good choice if you're already in the Microsoft ecosystem; HIPAA obligations still depend on configuration and which services you use. | | **Airtable** | **Yes, on qualifying enterprise arrangements** | Lightweight databases/internal tools | Worth considering for less complex workflows, but I would verify the exact Enterprise/BAA scope before putting PHI into it. | | **Quickbase** | **Yes** | Enterprise workflow/operations apps | More enterprise-oriented than typical startup no-code tools. | | **Keragon** | **Yes** | Healthcare automation/integrations | Better for connecting EHRs and healthcare systems than for building a general-purpose application. | ### A particularly important one: Knack If you're looking to **build an actual healthcare application**, rather than just collect forms, I'd put **Knack Health and Caspio at the top of the list**. Knack's current healthcare offering explicitly includes a signed BAA, encrypted storage/transfer, role-based permissions and record-change logs. Its HIPAA Starter plan currently starts at **$499/month**. [www.knack.com](https://www.knack.com/health/hipaa-database/?utm_source=chatgpt.com) Caspio is another strong choice if your application is fundamentally a **relational database + forms + portals + workflows**. Its dedicated HIPAA Edition includes a signed BAA and dedicated HIPAA environment, currently starting at **$800/month**. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) ### What I'd *not* use for PHI Be careful with popular AI/no-code builders such as **Bubble, Lovable, Bolt, Glide, Adalo, and similar tools**. For example, Bubble's own documentation currently says that its platform **does not meet HIPAA requirements and does not support HIPAA-compliant apps**. [www.formstack.com](https://www.formstack.com/features/hipaa-compliant-esignatures?utm_source=chatgpt.com)[manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) And don't assume that putting a HIPAA-compliant database behind a non-BAA frontend makes the whole application compliant. Every service that handles PHI needs to be evaluated. **If you tell me what you're building** (e.g. patient portal, clinician dashboard, intake app, care-management app, marketplace, internal healthcare SaaS), I can narrow this to the **3 best platforms and compare their pricing, BAA terms, database capabilities, integrations, and whether you retain ownership/exportability of the app.** [Knack Health](https://www.knack.com/health/?utm_source=chatgpt.com) [Caspio](https://www.caspio.com/?utm_source=chatgpt.com) [Blaze](https://www.blaze.tech/?utm_source=chatgpt.com) [Jotform](https://www.jotform.com/?utm_source=chatgpt.com) [Formstack](https://www.formstack.com/?utm_source=chatgpt.com) | Platform | BAA? | Best for | Notes | |---|---|---|---| | **[Knack Health](https://www.knack.com/health/?utm_source=chatgpt.com)** | **Yes** | Custom healthcare apps/databases | Purpose-built HIPAA environment; BAA included on HIPAA plans; RBAC, encryption, record-change logs. [www.knack.com](https://www.knack.com/health/hipaa-database/?utm_source=chatgpt.com) | | **[Caspio](https://www.caspio.com/?utm_source=chatgpt.com)** | **Yes** | Database-driven web apps | Dedicated HIPAA Edition, signed BAA, encryption, RBAC and audit logging. Current HIPAA Edition starts at $800/mo. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) | | **[Blaze](https://www.blaze.tech/?utm_source=chatgpt.com)** | **Yes** | More sophisticated custom apps | BAA available on higher/enterprise tiers; particularly geared toward healthcare apps. [www.knack.com](https://www.knack.com/health/compare/?utm_source=chatgpt.com) | | **[Jotform](https://www.jotform.com/?utm_source=chatgpt.com)** | **Yes** | Forms, intake, consent, simple workflows | Very easy no-code option; Jotform explicitly provides a signed BAA for its HIPAA-enabled offering. [www.jotform.com](https://www.jotform.com/hipaa/health-app/?utm_source=chatgpt.com) | | **[Formstack](https://www.formstack.com/?utm_source=chatgpt.com)** | **Yes** | Forms, documents, e-signatures, workflows | Standard BAA available; has dedicated healthcare configurations. [www.formstack.com](https://www.formstack.com/features/hipaa-compliant-esignatures?utm_source=chatgpt.com) | | **Microsoft Power Apps** | **Yes, through Microsoft's HIPAA-covered services** | Enterprise/internal apps | Good choice if you're already in the Microsoft ecosystem; HIPAA obligations still depend on configuration and which services you use. | | **Airtable** | **Yes, on qualifying enterprise arrangements** | Lightweight databases/internal tools | Worth considering for less complex workflows, but I would verify the exact Enterprise/BAA scope before putting PHI into it. | | **Quickbase** | **Yes** | Enterprise workflow/operations apps | More enterprise-oriented than typical startup no-code tools. | | **Keragon** | **Yes** | Healthcare automation/integrations | Better for connecting EHRs and healthcare systems than for building a general-purpose application. | ### A particularly important one: Knack If you're looking to **build an actual healthcare application**, rather than just collect forms, I'd put **Knack Health and Caspio at the top of the list**. Knack's current healthcare offering explicitly includes a signed BAA, encrypted storage/transfer, role-based permissions and record-change logs. Its HIPAA Starter plan currently starts at **$499/month**. [www.knack.com](https://www.knack.com/health/hipaa-database/?utm_source=chatgpt.com) Caspio is another strong choice if your application is fundamentally a **relational database + forms + portals + workflows**. Its dedicated HIPAA Edition includes a signed BAA and dedicated HIPAA environment, currently starting at **$800/month**. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) ### What I'd *not* use for PHI Be careful with popular AI/no-code builders such as **Bubble, Lovable, Bolt, Glide, Adalo, and similar tools**. For example, Bubble's own documentation currently says that its platform **does not meet HIPAA requirements and does not support HIPAA-compliant apps**. [www.formstack.com](https://www.formstack.com/features/hipaa-compliant-esignatures?utm_source=chatgpt.com)[manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) And don't assume that putting a HIPAA-compliant database behind a non-BAA frontend makes the whole application compliant. Every service that handles PHI needs to be evaluated. **If you tell me what you're building** (e.g. patient portal, clinician dashboard, intake app, care-management app, marketplace, internal healthcare SaaS), I can narrow this to the **3 best platforms and compare their pricing, BAA terms, database capabilities, integrations, and whether you retain ownership/exportability of the app.**

Yes. You can build a useful HIPAA-compliant **client/patient portal without coding**, but there’s an important distinction: > **Using a HIPAA-capable platform does not automatically make your entire portal HIPAA compliant.** You still need the right configuration, contracts, access controls, policies, and risk analysis. HHS specifically says that if a cloud provider creates, receives, maintains, or transmits ePHI for you, you generally need a **Business Associate Agreement (BAA)** with that provider. You also remain responsible for your own HIPAA obligations and risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### The easiest no-code approach For a small practice, therapist, consultant, home-health business, or similar operation, I'd build it like this: **Patient → branded portal → secure forms/files → staff dashboard → automated workflows** A particularly straightforward option is [Jotform](https://www.jotform.com/?utm_source=chatgpt.com). Its HIPAA-enabled offering supports no-code forms, file uploads, e-signatures, appointments, and a mobile healthcare app, and eligible HIPAA accounts receive a BAA. [www.jotform.com](https://www.jotform.com/hipaa/?utm_source=chatgpt.com)[www.jotform.com](https://www.jotform.com/hipaa/health-app/?utm_source=chatgpt.com) You can essentially make the "portal" an app-like experience containing: - **Welcome/dashboard** - New-client intake - Medical history questionnaire - Consent forms - HIPAA/privacy acknowledgments - Secure document upload - Documents you've sent to the client - E-signatures - Appointment requests - Secure messages/workflow notifications - Payment collection, if appropriate - Client-specific forms/tasks Jotform also provides no-code medical-app templates that can combine forms, signatures, file uploads, and patient information. [www.jotform.com](https://www.jotform.com/medical-app-creator/?utm_source=chatgpt.com) ### Another good option: Formstack [Formstack](https://www.formstack.com/?utm_source=chatgpt.com) is worth considering if you need more sophisticated workflows. Its HIPAA-enabled setup includes encryption, user-level permissions, audit logging, secure routing, file uploads, e-signatures, and workflow management. Formstack also provides a BAA for its healthcare offering. [www.formstack.com](https://www.formstack.com/features/hipaa-friendly-forms?utm_source=chatgpt.com) I'd lean toward **Formstack** when the portal is more workflow-heavy, and **Jotform** when you want the fastest DIY build. ### What I would *not* do Don't assemble a HIPAA portal from ordinary consumer tools such as: - Google Forms - ordinary Gmail - Dropbox/Google Drive without verifying the exact HIPAA configuration and BAA - Airtable's ordinary configuration - Notion - Webflow + random form provider - Zapier/Make integrations that haven't been specifically evaluated for your PHI workflow The issue isn't simply whether the website has HTTPS. **Every system that handles PHI needs to be considered.** HHS notes that even a cloud provider storing only encrypted ePHI can still be a business associate and require a BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### A practical build I'd structure a simple portal like this: | Portal area | What the client sees | |---|---| | **Home** | "You have 3 tasks to complete" | | **My Forms** | Intake, history, consent | | **My Documents** | Documents you've shared | | **Upload** | Secure document/photo upload | | **Appointments** | Request/schedule appointment | | **Payments** | Outstanding balance/payment | | **Messages** | Secure communication | | **Profile** | Contact information | | **Help** | Contact your office | Then create automated workflows: **New client** → invite client → client creates/authenticates account → intake form → consent → upload documents → staff review → mark onboarding complete **Existing client** → assign new form → client receives notification → completes form → staff receives task → record is stored securely ### The HIPAA checklist that matters Before putting real PHI into it, I'd verify: 1. **BAA** — You have a signed BAA with every vendor that handles your ePHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) 2. **Authentication** — Don't use shared client accounts. 3. **Access controls** — Staff only see information they need. 4. **Auditability** — You can determine who accessed/changed information. 5. **Encryption** — Data is protected in transit and at rest. 6. **Backups/recovery** — You have a plan for availability and data recovery. 7. **Integrations** — Every downstream service touching PHI is evaluated too. 8. **Email/SMS** — Don't casually put PHI into ordinary notification messages. 9. **Data retention/deletion** — Know what happens when a client leaves. 10. **Risk analysis** — Document the risks associated with the system and how you're mitigating them. HHS explicitly says covered entities and business associates need to conduct risk analyses addressing threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### My recommendation If you're trying to get this running **quickly and inexpensively without a developer**, I'd start with: **Jotform HIPAA account → Jotform Health App → branded forms → secure uploads → e-signatures → automated staff workflows.** That gets you surprisingly close to a custom client portal without programming. [www.jotform.com](https://www.jotform.com/medical-app-creator/?utm_source=chatgpt.com)[www.jotform.com](https://www.jotform.com/hipaa/health-app/?utm_source=chatgpt.com) If you need something that behaves more like a **full EHR/client-management system**—persistent client profiles, clinical notes, secure messaging, scheduling, billing, treatment plans, etc.—I'd look at a healthcare-specific portal/EHR rather than trying to recreate one with a no-code form builder. If you tell me **what kind of practice/business this is and exactly what you want clients to be able to do in the portal**, I can lay out the cheapest no-code stack and the exact screens/workflows I'd use. [Jotform](https://www.jotform.com/?utm_source=chatgpt.com) [Formstack](https://www.formstack.com/?utm_source=chatgpt.com) | Portal area | What the client sees | |---|---| | **Home** | "You have 3 tasks to complete" | | **My Forms** | Intake, history, consent | | **My Documents** | Documents you've shared | | **Upload** | Secure document/photo upload | | **Appointments** | Request/schedule appointment | | **Payments** | Outstanding balance/payment | | **Messages** | Secure communication | | **Profile** | Contact information | | **Help** | Contact your office | Then create automated workflows: **New client** → invite client → client creates/authenticates account → intake form → consent → upload documents → staff review → mark onboarding complete **Existing client** → assign new form → client receives notification → completes form → staff receives task → record is stored securely ### The HIPAA checklist that matters Before putting real PHI into it, I'd verify: 1. **BAA** — You have a signed BAA with every vendor that handles your ePHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) 2. **Authentication** — Don't use shared client accounts. 3. **Access controls** — Staff only see information they need. 4. **Auditability** — You can determine who accessed/changed information. 5. **Encryption** — Data is protected in transit and at rest. 6. **Backups/recovery** — You have a plan for availability and data recovery. 7. **Integrations** — Every downstream service touching PHI is evaluated too. 8. **Email/SMS** — Don't casually put PHI into ordinary notification messages. 9. **Data retention/deletion** — Know what happens when a client leaves. 10. **Risk analysis** — Document the risks associated with the system and how you're mitigating them. HHS explicitly says covered entities and business associates need to conduct risk analyses addressing threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### My recommendation If you're trying to get this running **quickly and inexpensively without a developer**, I'd start with: **Jotform HIPAA account → Jotform Health App → branded forms → secure uploads → e-signatures → automated staff workflows.** That gets you surprisingly close to a custom client portal without programming. [www.jotform.com](https://www.jotform.com/medical-app-creator/?utm_source=chatgpt.com)[www.jotform.com](https://www.jotform.com/hipaa/health-app/?utm_source=chatgpt.com) If you need something that behaves more like a **full EHR/client-management system**—persistent client profiles, clinical notes, secure messaging, scheduling, billing, treatment plans, etc.—I'd look at a healthcare-specific portal/EHR rather than trying to recreate one with a no-code form builder. If you tell me **what kind of practice/business this is and exactly what you want clients to be able to do in the portal**, I can lay out the cheapest no-code stack and the exact screens/workflows I'd use.

Yes—you can build a **HIPAA-compliant client/patient portal without writing code**, but the important distinction is that **“HIPAA-compliant” applies to the entire system and your practices, not just the no-code platform**. HHS says you still need appropriate safeguards, a risk analysis, and BAAs with vendors that handle ePHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### The simplest no-code architecture For a small practice or healthcare business, I'd aim for: **Patient → secure portal → HIPAA-enabled forms/database → staff dashboard → secure messaging/files** A practical stack could be: 1. **Portal/interface:** A no-code platform that explicitly supports HIPAA and will sign a BAA. 2. **Forms:** [Jotform](https://www.jotform.com/?utm_source=chatgpt.com) or [Formstack](https://www.formstack.com/?utm_source=chatgpt.com) for intake forms, questionnaires, consents, uploads, etc. Jotform's HIPAA offering includes encrypted form data and a BAA; Formstack offers a HIPAA-oriented account with encryption and security controls. [www.jotform.com](https://www.jotform.com/hipaa/faq/?utm_source=chatgpt.com) 3. **Authentication:** Require individual patient accounts, strong passwords and MFA where supported. 4. **Documents:** Store records in a HIPAA-supported system—not ordinary Google Drive/Dropbox/etc. merely because those services have security features. 5. **Messaging:** Keep PHI inside the authenticated portal rather than ordinary email/SMS. 6. **Automation:** Only connect services that will sign a BAA **and** are configured to handle PHI appropriately. ### What I'd build first Your MVP could have these six screens: | Screen | Patient can… | |---|---| | **Dashboard** | See outstanding tasks and recent messages | | **My Profile** | Update contact/demographic information | | **Forms** | Complete intake, consent and questionnaires | | **Documents** | Upload/download documents | | **Messages** | Securely communicate with your staff | | **Appointments** | Request or manage appointments | Your staff side would have: - Patient directory - Patient-specific records - Form/submission review - Document management - Secure messaging - Appointment/task status - Audit/history information - Role-based access ### The critical HIPAA checklist Before putting real patient information into it: - [ ] Every vendor touching PHI has been evaluated. - [ ] You have a **BAA** with each applicable business associate. - [ ] The platform's HIPAA features are actually enabled—not just advertised. - [ ] Access is based on individual accounts and appropriate permissions. - [ ] PHI isn't being accidentally sent through email notifications, analytics, logs, forms, AI tools, etc. - [ ] Data is encrypted in transit and at rest as appropriate. - [ ] You have backups and a recovery process. - [ ] You have appropriate audit/access logging. - [ ] You have policies for access, retention, disposal and incident response. - [ ] You've performed and documented your HIPAA security risk analysis. HHS specifically notes that even a cloud provider storing **encrypted** ePHI can still be a business associate, so encryption by itself doesn't eliminate the need for a BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### What I would *not* do I wouldn't start with **Bubble + Airtable + Zapier + Google Drive + Gmail** and assume that making the portal password-protected makes it HIPAA compliant. You have to trace **every place PHI travels and every vendor that can access it**. For a no-code build, the safest approach is usually to minimize the number of vendors and choose platforms that have an explicit HIPAA offering and BAA. If you tell me **what kind of client portal you're building** (e.g. therapist, medical practice, home healthcare, law firm handling medical records, billing company) and roughly **how many clients/users**, I can lay out a specific **$0–$500/month no-code stack and the exact build steps**. [Jotform](https://www.jotform.com/?utm_source=chatgpt.com) [Formstack](https://www.formstack.com/?utm_source=chatgpt.com) | Screen | Patient can… | |---|---| | **Dashboard** | See outstanding tasks and recent messages | | **My Profile** | Update contact/demographic information | | **Forms** | Complete intake, consent and questionnaires | | **Documents** | Upload/download documents | | **Messages** | Securely communicate with your staff | | **Appointments** | Request or manage appointments | Your staff side would have: - Patient directory - Patient-specific records - Form/submission review - Document management - Secure messaging - Appointment/task status - Audit/history information - Role-based access ### The critical HIPAA checklist Before putting real patient information into it: - [ ] Every vendor touching PHI has been evaluated. - [ ] You have a **BAA** with each applicable business associate. - [ ] The platform's HIPAA features are actually enabled—not just advertised. - [ ] Access is based on individual accounts and appropriate permissions. - [ ] PHI isn't being accidentally sent through email notifications, analytics, logs, forms, AI tools, etc. - [ ] Data is encrypted in transit and at rest as appropriate. - [ ] You have backups and a recovery process. - [ ] You have appropriate audit/access logging. - [ ] You have policies for access, retention, disposal and incident response. - [ ] You've performed and documented your HIPAA security risk analysis. HHS specifically notes that even a cloud provider storing **encrypted** ePHI can still be a business associate, so encryption by itself doesn't eliminate the need for a BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### What I would *not* do I wouldn't start with **Bubble + Airtable + Zapier + Google Drive + Gmail** and assume that making the portal password-protected makes it HIPAA compliant. You have to trace **every place PHI travels and every vendor that can access it**. For a no-code build, the safest approach is usually to minimize the number of vendors and choose platforms that have an explicit HIPAA offering and BAA. If you tell me **what kind of client portal you're building** (e.g. therapist, medical practice, home healthcare, law firm handling medical records, billing company) and roughly **how many clients/users**, I can lay out a specific **$0–$500/month no-code stack and the exact build steps**.

Yes. As of 2026, there are several no-code/low-code platforms that will sign a **HIPAA Business Associate Agreement (BAA)**. The important distinction is that the BAA is usually available only on a specific HIPAA/healthcare/enterprise plan—not on the ordinary free or entry-level plan. | Platform | BAA? | No-code level | Good for | |---|---|---|---| | **Knack / Knack Health** | ✅ Yes | **No-code** | Patient portals, databases, internal healthcare apps | | **Caspio** | ✅ Yes | **No/low-code** | Database-backed apps, portals, forms, workflows | | **Blaze** | ✅ Yes | **No-code** | Custom healthcare apps and EHR-connected workflows | | **Formstack** | ✅ Yes | **No-code** | Forms, signatures, document workflows | | **Quickbase** | ✅ Yes | **No-code/low-code** | Enterprise workflows and operational apps | | **Microsoft Power Apps** | ✅ Yes* | **Low-code** | Organizations already using Microsoft/Azure/Dataverse | | **Mendix** | ✅ Yes* | **Low-code** | Enterprise-grade custom applications | ### My shortlist **1. Knack Health — easiest pure no-code option** Knack specifically offers a healthcare version with HIPAA plans and a signed BAA. Its HIPAA Core plan currently starts at **$625/month** and includes encryption, audit/change logs, role-based permissions, and unlimited app users/builders. [www.knack.com](https://www.knack.com/health/?utm_source=chatgpt.com) [Knack Health](https://www.knack.com/health/) **2. Caspio — strongest database-centric choice** Caspio offers a dedicated HIPAA Edition with a signed BAA, encrypted data, audit trails, extended backups, and a HIPAA-specific environment. It's particularly attractive if you're building a serious database application rather than just a form. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) [Caspio HIPAA Edition](https://www.caspio.com/hipaa-edition/) **3. Blaze — strongest healthcare-native app builder** Blaze is specifically positioned around healthcare and says its no-code platform supports HIPAA compliance and signed BAAs. It also emphasizes EHR/FHIR integrations, making it interesting if the application needs to interact with clinical systems. [www.blaze.tech](https://www.blaze.tech/?utm_source=chatgpt.com) [Blaze](https://www.blaze.tech/) **4. Formstack — excellent for forms/signatures** If your "app" is primarily intake forms, patient questionnaires, document generation, approvals, and e-signatures, Formstack is worth considering. Formstack says it provides a standard BAA and a specialized account for HIPAA workflows. [www.formstack.com](https://www.formstack.com/features/hipaa-compliant-esignatures?utm_source=chatgpt.com) [Formstack](https://www.formstack.com/) ### One important caveat **A BAA doesn't make your application automatically HIPAA compliant.** The platform's BAA covers the vendor's responsibilities; you still have to configure access controls, authentication, audit procedures, retention, integrations, user policies, etc. Knack explicitly makes this distinction in its BAA documentation. [docs.knack.com](https://docs.knack.com/docs/business-associate-agreements?utm_source=chatgpt.com) Also, **every connected service that handles PHI needs to be evaluated separately**. For example, having a BAA with your app builder doesn't automatically make an email provider, analytics service, AI API, or automation service HIPAA-compliant. If you're choosing a platform for a **specific app**, tell me what you're building (e.g. patient portal, intake app, CRM, scheduling, AI workflow, internal database), and I can narrow this to the **3 best options with current pricing, BAA requirements, and limitations**. [Knack Health](https://www.knack.com/health/) [Caspio HIPAA Edition](https://www.caspio.com/hipaa-edition/) [Blaze](https://www.blaze.tech/) [Formstack](https://www.formstack.com/) Knack Caspio Blaze Formstack Quickbase | Platform | BAA? | No-code level | Good for | |---|---|---|---| | **Knack / Knack Health** | ✅ Yes | **No-code** | Patient portals, databases, internal healthcare apps | | **Caspio** | ✅ Yes | **No/low-code** | Database-backed apps, portals, forms, workflows | | **Blaze** | ✅ Yes | **No-code** | Custom healthcare apps and EHR-connected workflows | | **Formstack** | ✅ Yes | **No-code** | Forms, signatures, document workflows | | **Quickbase** | ✅ Yes | **No-code/low-code** | Enterprise workflows and operational apps | | **Microsoft Power Apps** | ✅ Yes* | **Low-code** | Organizations already using Microsoft/Azure/Dataverse | | **Mendix** | ✅ Yes* | **Low-code** | Enterprise-grade custom applications | ### My shortlist **1. Knack Health — easiest pure no-code option** Knack specifically offers a healthcare version with HIPAA plans and a signed BAA. Its HIPAA Core plan currently starts at **$625/month** and includes encryption, audit/change logs, role-based permissions, and unlimited app users/builders. [www.knack.com](https://www.knack.com/health/?utm_source=chatgpt.com) [Knack Health](https://www.knack.com/health/) **2. Caspio — strongest database-centric choice** Caspio offers a dedicated HIPAA Edition with a signed BAA, encrypted data, audit trails, extended backups, and a HIPAA-specific environment. It's particularly attractive if you're building a serious database application rather than just a form. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) [Caspio HIPAA Edition](https://www.caspio.com/hipaa-edition/) **3. Blaze — strongest healthcare-native app builder** Blaze is specifically positioned around healthcare and says its no-code platform supports HIPAA compliance and signed BAAs. It also emphasizes EHR/FHIR integrations, making it interesting if the application needs to interact with clinical systems. [www.blaze.tech](https://www.blaze.tech/?utm_source=chatgpt.com) [Blaze](https://www.blaze.tech/) **4. Formstack — excellent for forms/signatures** If your "app" is primarily intake forms, patient questionnaires, document generation, approvals, and e-signatures, Formstack is worth considering. Formstack says it provides a standard BAA and a specialized account for HIPAA workflows. [www.formstack.com](https://www.formstack.com/features/hipaa-compliant-esignatures?utm_source=chatgpt.com) [Formstack](https://www.formstack.com/) ### One important caveat **A BAA doesn't make your application automatically HIPAA compliant.** The platform's BAA covers the vendor's responsibilities; you still have to configure access controls, authentication, audit procedures, retention, integrations, user policies, etc. Knack explicitly makes this distinction in its BAA documentation. [docs.knack.com](https://docs.knack.com/docs/business-associate-agreements?utm_source=chatgpt.com) Also, **every connected service that handles PHI needs to be evaluated separately**. For example, having a BAA with your app builder doesn't automatically make an email provider, analytics service, AI API, or automation service HIPAA-compliant. If you're choosing a platform for a **specific app**, tell me what you're building (e.g. patient portal, intake app, CRM, scheduling, AI workflow, internal database), and I can narrow this to the **3 best options with current pricing, BAA requirements, and limitations**.