HIPAA-Compliant
User Research
for Healthcare

There's no such thing as "HIPAA certified" — even the US Department of Health and Human Services doesn't offer a certification. HIPAA compliance is maintained through ongoing annual risk assessments, employee training, continuous monitoring, and policy updates. Great Question maintains all required HIPAA safeguards and undergoes annual independent security assessments.

Yes. We sign a BAA with every customer who needs HIPAA compliance, covering the PHI you store on the platform. Note that our video and transcription providers aren't covered under our BAA, so session recordings and transcripts are excluded and shouldn't contain PHI. Your legal team reviews our BAA once and you're covered for everything within its scope.

HIPAA compliance is available as a platform add-on on our Enterprise plan. It's priced separately because it represents real ongoing investment — annual audits, vendor BAA management, enhanced infrastructure, and dedicated engineering. We don't pass those costs to customers who don't need them. Contact sales for pricing.

No. Unlike some competitors that disable video downloads, restrict sharing, or force SSO when HIPAA is enabled, Great Question gives you the full product experience. Our HIPAA compliance is built into the platform architecture, not bolted on as restrictions.

You can safely store highlights, participant information, and research findings that contain protected health information. All PHI is encrypted at the field level, with access controls and comprehensive audit logging. Important: session recordings and transcripts are processed by third-party video and transcription providers that aren't covered by our BAA, so they shouldn't contain PHI.

Yes. Our Trust Portal contains all security documentation including our SOC 2 Type II report (available under NDA), security policies, and compliance details. Visit our Trust Portal to request access.