HIPAAtizer Forms

Webflow states its own position on health data in writing. Section 3.6 of its terms is headed HIPAA Non-Compliance, and Webflow's security page puts it plainly: "Webflow is not HIPAA compliant by default and is not designed to store or process protected health information." We looked for a Business Associate Agreement in Webflow's terms, its data processing addendum and its help center, and found none documented. That matters for one mechanical reason: a native Webflow form posts to Webflow's own submission store, so anything a patient types into it lands there.

HIPAAtizer is built for that gap. It hosts the form on its own servers, renders it inside a Webflow page through an embed, and keeps the submission in its own storage rather than Webflow's. HIPAAtizer says every covered entity plan includes a Business Associate Agreement, signed inside the dashboard when you upgrade. What that gives you is a documented arrangement with HIPAAtizer covering the part of your site that collects patient data. Compliance is a property of the arrangement you run end to end, not of a form widget, and nothing on this page can tell you whether a particular build qualifies.

The pairing suits Webflow agencies and freelancers with healthcare clients, and the practices themselves. Dental offices, MedSpas, therapists, pediatric clinics, pharmacies and telehealth providers use it for intake, consent and payment forms. Healthcare marketers reach for it to keep patient data out of a CRM while still routing the non-identifying parts of a lead.

How to integrate HIPAAtizer Forms with Webflow

What is HIPAAtizer Forms? HIPAAtizer is a form builder and document tool that hosts online forms on its own servers and lets you place them on a site you already own. Its drag and drop builder covers fields, consents, conditional logic, e-signatures and file uploads, and its AI converter turns an existing PDF, Word or paper form into an online version. HIPAAtizer states that it encrypts submissions in transit and at rest using FIPS 140-2 encryption, and that team access is role based with two-factor authentication and an exportable log of every view, download and export.

Healthcare teams pick Webflow for design control and hand the patient data part to a separate service, which is the shape Webflow's own security page points at when it says regulated use cases can run alongside a compliant backend. You do not rebuild the existing site and you do not move hosting. HIPAAtizer also lets a developer account build and edit forms for a client's covered entity account without the developer being exposed to the submissions.

The HIPAAtizer and Webflow integration supports four approaches:

• The Marketplace app: HIPAAtizer's Webflow app installs from the Marketplace and writes the embed code onto your site for you, with no hand editing.
• Code Embed elements, share links and QR codes: These place a published form manually, either inside a page or as a hosted link that lives outside the site entirely.
• Zapier: This connects a HIPAAtizer submission event to a Webflow CMS action, carrying metadata rather than the submission itself.
• The two REST APIs: HIPAAtizer and Webflow both expose REST endpoints and webhooks, which gives you full control at the cost of server-side development.

You can combine these on one site, and most builds do.

Set the agent boundary before you build

Decide what an AI agent may touch before you wire anything up, because the answer changes what you are allowed to put in a Webflow form. The Webflow MCP server connects an agent to your Webflow projects, and its documented Manage group includes reading forms and their schemas, listing submissions, and updating or deleting them. An agent with that access can therefore read whatever sits in Webflow's submission store, which is a further reason to keep patient data out of native Webflow forms rather than a reason to avoid agents.

On the HIPAAtizer side, we could not find any term, policy or BAA clause that addresses agent or MCP access to submissions in either direction. Unaddressed is not the same as permitted, so read HIPAAtizer's agreements yourself and ask the vendor before pointing an agent at patient data. Webflow's MCP server is a reasonable fit for the half of the work that never touches submissions: building pages, managing CMS content, editing custom code and auditing the site. Webflow documents that every agent works inside your existing permissions and roles, that each site can carry its own Agent Instructions, and that agent changes are recorded in the site activity log.

Install the HIPAAtizer app

The Marketplace app is the shortest path, and it needs no code from you. HIPAAtizer publishes it under its own Workspace, the listing's support address sits on hipaatizer.com, and Webflow marks it as reviewed while stating that it neither endorses nor certifies Marketplace apps. Start on a free Developer Sandbox account, which has no time limit for building and testing, and move to a covered entity plan before any real patient uses the form.

To set up the integration:

1. Open the HIPAAtizer Forms listing in the Webflow Marketplace and click Add to site.
2. Select the Workspaces and sites you want the app on, then click Authorize application.
3. Sign up for HIPAAtizer from your Webflow dashboard with a developer account or a covered entity account.
4. Build a form in the drag and drop builder, or upload an existing PDF, Word file or image for AI conversion.
5. Publish the form, then follow HIPAAtizer's Webflow guide at My Forms > Form Settings > Integrations > Webflow.

Read the Permissions tab before you authorize, because this is an app that writes to your site. The listing names three scopes: read information about authorized users, read and write site data and publishing, and read and write custom code. That third scope is what lets the app place the embed for you, and it is also why revocation has a visible effect on the live site. Per the Webflow Apps overview, you view a site's authorized apps under Site settings > Integrations > Authorized apps, and you revoke from Site settings > Apps & integrations by clicking Revoke. Uninstalling at Workspace settings > Apps & integrations removes the authorization from every site in that Workspace. After a revoke, elements the app added stay on the page while custom code it added is removed at your next publish, so an intake form can vanish on a routine republish rather than at the moment you revoke.

Once it is authorized, the app carries HIPAAtizer's form toolkit onto your Webflow pages.

• Form components: HIPAAtizer counts more than 30 drag and drop components, including HIPAA-oriented e-signatures and a Canvas element patients can draw on.
• Secure uploads: Patients attach files and images inside the form, and the attachments stay with the submission on HIPAAtizer's side.
• Conditional logic and Form Packets: Multi-step intake and assessment flows branch on an answer, and several forms can run in a set order as one packet.
• Payments and automation: A Stripe payment element sits inside the form, and webhooks plus the REST API carry events downstream.

One restriction applies to sandbox accounts. HIPAAtizer watermarks sandbox forms and requires publication from a covered entity account to clear it, so a sandbox build is for testing rather than live intake. If you want direct control over where and how a form renders, the manual methods below use the same published forms.

Embed forms with Code Embed elements, links, or QR codes

HIPAAtizer produces four outputs for every published form: an iframe embed, a JavaScript embed, a hosted share link and a QR code. You reach them from the My Forms dashboard by clicking Embed Form. Placing code by hand needs a Core, Growth, Agency or Freelancer Workspace, or an active Site plan, which is the same requirement Webflow documents for custom code generally. The short URL and the embed code survive republishing, so you do not have to re-embed or reissue a link every time you change the form.

Paste the embed code with a Code Embed element

Use this when a form belongs on one specific page. A Code Embed element accepts up to 50,000 characters, supports HTML and JavaScript in <script> tags and CSS in <style> tags, and breaks the layout if you paste <html>, <head> or <body> tags into it.

To embed a form on a page:

1. In HIPAAtizer, click Integrate or Embed Form and copy the iframe or JavaScript code.
2. In Webflow, open the Add panel and drag a Code Embed element onto the canvas.
3. Paste the code and click Save and close.
4. Publish the site.

The embed renders in preview, but it does not go live until you publish.

Load the JavaScript embed site-wide

The JavaScript embed splits into a header script you add once per site and a placement script that goes at the end of the body, and it resizes its container to match the form's height. Add the header script through custom code in head and body tags so any page can render a form. The Head code and Footer code sections in Site settings hold up to 50,000 characters each, as do the head and body sections in Page settings.

To add the script site-wide:

1. Go to Site settings > Custom code.
2. Paste the HIPAAtizer header script into the Head code section.
3. Paste each form's placement script into the Footer code section, or into the target page's Before </body> tag section.
4. Click Save changes, publish the site, and load the page to confirm the form renders.

For a single page, put the header script in Page settings under Inside <head> tag and the placement script under Before </body> tag instead.

Share forms with a link or QR code

This path needs no code and no paid Webflow plan, because nothing is placed on the site. A Webflow button, a nav item or an email can point at HIPAAtizer's hosted short URL, and the QR image downloads as a file you drop into an image element. It also works before a design is finished, so a practice can start collecting intake while the site is still being built.

Connect Webflow and HIPAAtizer with Zapier

Both products publish Zapier connectors, and HIPAAtizer's is deliberately narrow. Its listing in the Zapier app directory shows one trigger, New Form Submission, and one action, Delete Submission. Webflow's connector carries triggers for form submissions, orders and comments, plus actions and searches across CMS items and orders. Useful pairings run from HIPAAtizer into Webflow.

• Log an intake as a CMS item: New Form Submission into Create Item or Create Live Item writes submission metadata into a collection you control.
• Update a status record: New Form Submission into Update Item moves an existing item along, for example from received to reviewed.
• Fan out to a CRM: The same trigger can feed HubSpot or Pipedrive with a secure link instead of the submission body.
• Alert a human: A notification step tells staff a form arrived without repeating anything the patient typed.

Watch the field mapping, because that is where this goes wrong. HIPAAtizer's own Zapier guidance states that Zapier does not provide a BAA to its users, that by default the connector sends only submission metadata such as timestamps and secure links, and that its Contact Anonymization feature "replaces personally identifiable information with randomly generated values" for use with systems that are not covered. The trigger's own field for including form values is labeled as a risk in the Zapier UI. Leave the defaults alone unless you have read HIPAAtizer's terms and decided otherwise.

Build with the Webflow and HIPAAtizer APIs

Custom API work is for developers moving submission data into their own backend, an EMR or the Webflow CMS. Both products expose REST endpoints and webhooks, and this path needs a server you control. HIPAAtizer does not publish its routes on its website; they live in the Postman collection in its api-docs repository, which names https://app.hipaatizer.com as the base URL.

• HIPAAtizer submissions: The API retrieves, searches and exports submissions as PDF or CSV, and reaches attachments and access logs.
• HIPAAtizer scheduling: Appointments, locations, services and workers each have their own endpoints, listed in HIPAAtizer's developer features.
• Webflow data: Webflow's Data API authenticates with a Bearer token and covers CMS collection items and form submissions.
• Webflow events: Webflow webhooks fire on events including form_submission, collection_item_created and site_publish.

Whatever you build, keep the submissions on HIPAAtizer's side and let only metadata and secure access links cross into Webflow.

Retrieve submissions with the HIPAAtizer REST API

Every request needs an API key and an allowlisted server IP, and the key travels in a request header rather than as a Bearer token.

1. Generate a key at Integrations > REST API > Create API Key in the HIPAAtizer dashboard.
2. Add your server's IP address to the allowlist in the same Integrations menu.
3. Send requests with the key in the X-Api-Key header, using the routes from the Postman collection.

A 401 usually means the IP allowlist rejected the calling server rather than that the key is wrong, so check the allowlist first.

Sync submission metadata to the Webflow CMS

HIPAAtizer's outbound webhooks POST to an endpoint of yours each time a form is submitted, and because you map the payload field by field with HIPAAtizer form variables, it is on you to confirm nothing identifying is in there before you switch it on. Carry submission IDs, timestamps, referral sources, status labels and secure access links, and nothing a patient wrote.

1. In HIPAAtizer, go to Form Settings > Integrations > Webhooks, pick a template, point it at your endpoint, and map the fields.
2. On receipt, call POST /v2/collections/{collection_id}/items/live on api.webflow.com with a Bearer token carrying the cms:write scope.
3. Include fieldData.name and fieldData.slug in the body, since both are required.

Render the resulting items in a Collection List on a page staff sign in to, so the log stays internal.

What you can build with the HIPAAtizer Webflow integration

The integration lets a Webflow site collect patient data without rebuilding it or moving it to specialized hosting, because the collection happens on HIPAAtizer's servers and only the frame lives on your page.

• Patient intake pages: Conditional logic serves a different form per visit type, so a new-patient packet and a follow-up sit on the same Webflow page, and AI conversion turns an existing paper packet into the embedded version.
• Consent and e-signature flows: Dermatology, dental and MedSpa sites replace the print, sign and scan loop with an embedded consent form, and the Canvas component lets a patient mark up an image during a consultation.
• Forms that take a payment: A telehealth or booking page collects a co-pay through the Stripe payment element inside the form, which HIPAAtizer keeps separate from the clinical fields.
• Lead routing that leaves patient data behind: A marketing site feeds a CRM through HIPAAtizer webhooks, sending a secure access link while the full submission stays in HIPAAtizer.

Most of these end with a member of staff needing to see something the public must not, so build the internal side as a role-based client portal. If you would rather drive the Webflow half from your editor or chat client, connect the MCP server and keep it pointed at pages, CMS content and custom code.