HIPAA-Compliant
User Research
for Healthcare

There's no such thing as "HIPAA certified" — even the US Department of Health and Human Services doesn't offer a certification. HIPAA compliance is maintained through ongoing annual risk assessments, employee training, continuous monitoring, and policy updates. Great Question maintains all required HIPAA safeguards and undergoes annual independent security assessments.

Yes. We sign a BAA with every customer who needs HIPAA compliance. We also maintain BAAs with every sub-processor and vendor in our stack. Your legal team reviews our BAA once, and you're covered for all research on the platform.

HIPAA compliance is available as a platform add-on on our Enterprise plan. It's priced separately because it represents real ongoing investment — annual audits, vendor BAA management, enhanced infrastructure, and dedicated engineering. We don't pass those costs to customers who don't need them. Contact sales for pricing.

No. Unlike some competitors that disable video downloads, restrict sharing, or force SSO when HIPAA is enabled, Great Question gives you the full product experience. Our HIPAA compliance is built into the platform architecture, not bolted on as restrictions.

You can safely store session recordings, transcripts, highlights, participant information, and research findings that contain protected health information. All PHI is encrypted at the field level, with access controls and comprehensive audit logging.

Yes. Our Trust Portal contains all security documentation including our SOC 2 Type II report (available under NDA), security policies, and compliance details. Visit our Trust Portal to request access.