Every patient satisfaction survey your practice sends collects protected health information. A name tied to a visit date is PHI. A comment about a diagnosis is PHI. The moment a survey tool touches that data, it becomes a vendor your practice is legally responsible for, and the wrong choice can turn a routine feedback program into a reportable breach.
The problem is that most survey tools were never built for healthcare. They are perfectly good at collecting opinions and completely unequipped to protect patient data the way federal law requires. This guide walks through exactly what to verify before you sign, so the software you pick strengthens your compliance posture instead of quietly undermining it.
Patient Surveys Collect PHI, Which Makes Your Survey Vendor Your Responsibility
Under HIPAA, your practice is a covered entity, and any company that creates, receives, maintains, or transmits PHI on your behalf is a business associate. A survey platform that stores patient contact details, links responses to specific visits, or captures open-text comments about care is squarely a business associate. That relationship does not depend on how much data is collected. Even a single phone number attached to an appointment is enough to bring the vendor inside HIPAA’s reach.
This matters because liability flows back to you. If your survey vendor mishandles patient data, your practice is the covered entity that has to notify affected patients, report the incident, and answer to regulators. Choosing survey software is therefore not just a marketing decision. It is a vendor-risk decision, and it belongs in the same category as the electronic health record or billing system you vet carefully before adoption. For the broader picture of why this applies to feedback programs specifically, see our overview of HIPAA compliance for patient feedback surveys.
A Signed Business Associate Agreement Is the First Thing to Confirm
Before any vendor handles PHI, HIPAA requires a signed Business Associate Agreement, or BAA. The U.S. Department of Health and Human Services is explicit that a covered entity may only let a business associate handle patient data after it obtains satisfactory written assurances, formalized in a BAA, that the data will be safeguarded. No BAA means no compliant relationship, full stop.
This is where the popular free tools fall away. Consumer-grade survey platforms and general form builders typically will not sign a BAA for their standard product, and some state plainly in their terms that the service is not intended for PHI. If a vendor cannot or will not execute a BAA, the conversation is over, no matter how polished the software looks. Ask for the BAA in writing early, because a vendor’s willingness to sign one is the fastest way to separate healthcare-ready platforms from everything else.
Patient Data Must Be Encrypted in Transit and at Rest
Encryption is the safeguard that determines whether a lost or intercepted record even counts as a breach. HIPAA’s Security Rule directs regulated entities to protect ePHI both while it moves across networks and while it sits in storage. In practical terms, that means survey links, responses, and any stored contact data should be encrypted in transit (so responses cannot be read if intercepted) and at rest (so stored data is unreadable if a system is compromised).
Ask vendors to state their encryption standards directly rather than accepting a generic “bank-level security” line. Strong answers reference established standards such as TLS for data in transit and AES-256 for data at rest. This is also a moving target worth watching: the Security Rule update HHS proposed in early 2025 would make encryption of ePHI a mandatory requirement rather than an addressable one, alongside multi-factor authentication and regular security testing. A vendor already meeting that bar is a vendor prepared for where the rules are heading.
Access Controls, Audit Logs, and Minimum-Necessary Data Collection
Encryption protects data from outsiders. Access controls protect it from misuse on the inside. Compliant survey software should let you limit who can view responses, assign role-based permissions, and produce an audit trail showing who accessed what and when. If every staff member can see every patient’s raw comments, the platform is not giving you the control HIPAA expects.
The other half of this is collecting less in the first place. HIPAA’s minimum-necessary principle means you should gather only the PHI a survey genuinely needs. Good survey software makes that easy: it avoids demanding sensitive identifiers you will never use, supports de-identified or aggregated reporting where possible, and does not quietly retain patient data longer than your program requires. The less PHI a tool stores, the smaller your exposure if anything ever goes wrong. This is doubly important in sensitive fields, a point we cover in our guide for behavioral and mental health practices, where the mere fact of a treatment relationship is highly protected.
Free and Consumer-Grade Survey Tools Carry Hidden HIPAA Risk
It is tempting to reach for a free form builder or a general-purpose survey app your team already knows. The risk is that these tools were designed for customer feedback, not patient data. They often will not sign a BAA, may store data on infrastructure you cannot vet, and can leave patient responses sitting in an inbox or spreadsheet with no access controls at all. A tool being widely used does not make it HIPAA compliant, and regulators do not grant leniency for convenience.
The consequences are documented and public. The HHS Office for Civil Rights has penalized practices for PHI disclosures tied to everyday digital habits, including a New Jersey psychiatric practice that paid $30,000 and a California dental practice that settled for $23,000 over how patient information was handled online. The same instinct that gets practices in trouble responding to reviews, which we cover in responding to negative reviews without a HIPAA slip, applies to the tools you use to collect feedback: convenience is not a defense.
Cloud Hosting Is Fine, But Only With the Right Vendor Assurances
Practices sometimes assume that storing patient data in the cloud is inherently risky. It is not. HHS confirms in its business associate guidance that a covered entity may use a cloud service provider to handle ePHI, provided a BAA is in place and the applicable HIPAA requirements are met. A cloud-hosted survey platform can be fully compliant.
The key is that the cloud provider becomes part of your chain of responsibility. A healthcare-ready survey vendor will have BAAs with its own infrastructure providers and will be able to explain where your patient data physically lives and how it is protected. If a vendor cannot answer basic questions about its hosting, encryption, and subcontractor agreements, that opacity is itself a red flag.
A Checklist for Vetting HIPAA-Compliant Survey Software
Bring this list to any vendor evaluation. A platform genuinely built for medical practices should clear every item without hesitation:
- Will the vendor sign a Business Associate Agreement for the product you are actually buying?
- Is patient data encrypted both in transit and at rest, with named standards?
- Does the platform support role-based access and produce audit logs of who viewed responses?
- Does it collect only the minimum PHI required, and can it report on results without exposing identifiers?
- Are there clear data-retention and deletion controls so patient data is not kept indefinitely?
- Can the vendor explain its hosting, subcontractors, and breach-notification process in plain language?
- Is the tool purpose-built for healthcare, or a general survey product being stretched to fit?
If a vendor stumbles on the first three, you can stop there. Those are the non-negotiables. And remember that compliance and effectiveness are not in tension: the same well-designed platform that protects patient data should also help you reach patients and earn a healthy survey response rate, because a secure survey nobody answers helps no one.
How ClearSurvey Protects Patient Data by Design
ClearSurvey is built for medical practices from the ground up, not adapted from a consumer tool. We operate under a signed BAA, encrypt patient data in transit and at rest, keep the PHI we collect to the minimum needed, and deliver short, well-timed surveys by text and email so you capture honest feedback without over-collecting sensitive data. Results flow into a secure dashboard with the access controls your compliance officer expects, and negative feedback surfaces fast so your team can close the loop privately, the foundation of closed-loop feedback. If you want the full evaluation framework, our buyer’s guide to survey software walks through it in depth, and you can always see how ClearSurvey works or why practices choose ClearSurvey. To see it applied to your specialty, schedule a personalized demo.
This article is for general information only and is not legal advice. HIPAA obligations vary by situation. Confirm your survey vendor and data practices with your practice’s privacy officer or legal counsel.
ClearSurvey is a best-in-class survey software focused on helping medical practices offer the best patient satisfaction in healthcare. We can help you develop a custom survey question-set based on your goals so you can gather data for useful insights. Learn more about how ClearSurvey can elevate your practice to stay ahead and schedule a demo today!
