HIPAA Compliance and SurveyMonkey

HIPAA Features
Enabling HIPAA Features
Downgrades
HIPAA Security Tips
AI and Machine Learning (ML) Feature Access

ENTERPRISE ADD-ON: HIPAA compliant accounts are only available to customers on Enterprise. If you're interested, contact sales. If you already have an Enterprise account, contact your Customer Success Manager (CSM).

Does HIPAA apply to me? If you are a “covered entity” (as defined by HIPAA) and are using SurveyMonkey to collect or store protected health information (generally any information about the health status, provision of health care, or payment for health care that can be linked to a specific individual, such as an individual’s name and/or contact details combined with information about health care that the individual received), then HIPAA likely applies to your use of SurveyMonkey. If you don’t need HIPAA but do need a higher level of security when using SurveyMonkey to collect or store information, check out the Enhanced Sensitive Data Protection feature.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a United States law that regulates the collection and handling of “protected health information” (PHI). Certain organizations called “covered entities” and their business associates are required to comply with HIPAA.

For SurveyMonkey, being "HIPAA-compliant" means that we offer a service that enables covered entities to collect and manage PHI through surveys in a manner compliant with HIPAA. As part of offering this service, SurveyMonkey ensures that it operates in a way that is consistent and compatible with those laws and SurveyMonkey's role as a business associate to a covered entity user.

In accordance with our Terms of Use, SurveyMonkey only permits PHI to be collected by regulated entities if it is done through a “HIPAA-enabled account” with a business associate agreement (BAA) in place. However, SurveyMonkey does not require you to have a BAA if you are not regulated by HIPAA with respect to the PHI you collect in your surveys.

HIPAA Features

HIPAA Security Measures that SurveyMonkey Employs
As required by HIPAA, we implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic PHI that we receive, maintain, and transmit on behalf of covered entities with respect to their HIPAA-enabled accounts. These safeguards include measures required by the Security Rule, such as:
- Regular risk assessments of systems to ensure that safeguards remain relevant and effective
- Assigned security team which is responsible for maintaining compliance with HIPAA’s security requirements
- Screening, authorization, and training of SurveyMonkey staff who come into contact with customer PHI
- Data backup plans
- Disaster recovery plans
- Systems regularly monitored, updated, and patched
- Incident response plan that includes reporting of security incidents to affected covered entities
- All communications with SurveyMonkey servers encrypted with SSL
For more information, see our Security Statement.
Feature List
When you enable HIPAA-compliant features, the following features required by HIPAA are activated on your account. These features help covered entities to comply with their own HIPAA obligations:
- Security reminders: We remind users of their HIPAA obligations with in-product messages that appear whenever they perform certain sensitive operations on PHI (such as exporting survey data that could potentially be shared with third parties).
- Automatic logoff: We timeout user sessions after 30 minutes of inactivity.
- Logging: We log account access activity and a variety of events relating to HIPAA-enabled accounts by timestamp, identity (IP Address and/or account username), and event type. While there isn't a way to access these logs within your account—you can contact us to request logs.

Enabling HIPAA Features

SurveyMonkey offers a standard form BAA which meets the requirements of HIPAA. If you're interested in enabling HIPAA features on your account, please contact us.

If you've already entered into a BAA with us, you can contact us to receive a copy of your BAA.

Once an account is HIPAA-enabled, it cannot be reverted to a non-HIPAA account. If the BAA is terminated, your account will also be closed. See the Downgrades section below for more information.

Downgrades

Review the common questions below to understand how downgrades work for HIPAA-enabled accounts.

Can I downgrade my HIPAA-enabled account or team to a lower plan type?
No. Once you enable HIPAA-compliant features on your account or Enterprise team, it cannot be reverted back to a regular, non-HIPAA-enabled account.
If you want to remove HIPAA-compliant features from your account, or if you want a lower plan, you must open a new account. Note that you can transfer surveys from your HIPAA-enabled account to a regular account, but you must be very careful not to transfer any surveys that contain PHI (we do not permit users to store PHI in regular accounts, and regular accounts are not covered by a BAA).
What happens if I don't renew my HIPAA-enabled account or team?
If you decide you no longer need to use SurveyMonkey and don't renew your HIPAA-enabled account, your account will be placed into a suspended state. While suspended, SurveyMonkey will preserve all data contained within the account and continue to treat it in accordance with the BAA. However, you will not be able to access your survey data or account directly (except for limited billing and account administration functions).
SurveyMonkey will retain a suspended account for a period of time in order to provide you with an opportunity to unsuspend your account by renewing it. If your account is suspended and you need access to your data or want to close your account, please contact us. At the end of the suspension period, SurveyMonkey will close your account and delete all data in it.
What happens if I close my HIPAA-enabled account or terminate my BAA?

HIPAA Security Tips

Once you enable HIPAA-compliant features on your account or team, follow these best practices when performing certain actions to help ensure that you're handling your data responsibly and securely.

Action	HIPAA Security Tips
Exporting survey results	If you download survey results to your own computer, please ensure that those downloaded files are handled appropriately since they contain PHI. We suggest that you secure those files by encrypting them and only transferring them under an encrypted connection.
Sharing surveys with others	When you share a survey, the people you choose to share it with will have access to view and possibly edit the survey, or access any collected survey responses. Remember to only share surveys in a manner consistent with your HIPAA obligations. Only share a survey with people who are authorized to work on that survey.
Transferring a survey to another account	If you must transfer a survey to a different SurveyMonkey account, ensure that you are absolutely certain that the receiving account is the one you intend to send it to. To transfer a survey, you must enter the exact username of that account. The transfer process cannot be undone without action by the receiving account holder. If your survey contains PHI, it is your responsibility to ensure that such PHI is only disclosed to an appropriate recipient. This means that if you transfer PHI to another account, it is crucial that that account must also be HIPAA-enabled.
Collecting responses	If you collect PHI in your survey, we recommend that you use a Web Link Collector. We do not recommend the use of an Email Invitation Collector. Email Invitation Collectors email survey invitations to contacts with a unique survey link tied to a contact's email address. If respondents are able to edit their responses, a contact of an email invitation could complete all or part of a survey and forward their unique survey link to someone else. This would allow the second contact to view the first contact’s responses, which may contain PHI.
Sharing survey results	Your survey results may contain PHI, so remember to only share survey results in a manner consistent with your HIPAA obligations. Only disclose results to authorized recipients.

AI and Machine Learning (ML) Feature Access

The Primary Admin controls access to most of the AI/ML features available for Enterprise team users, which can be changed in Enterprise settings. However, some features like Build with AI are not available for HIPAA-enabled accounts.

Feature	HIPAA default permissions
Build with AI	Not available.
Sentiment Analysis	On Primary Admin controls access to this feature.
Response Quality	On Primary Admin controls access to this feature.

For more info check out the Managing AI Feature Access article.

Managing Seats on Your Enterprise Team

Custom Roles

Enterprise Admin Central

SurveyMonkey