HIPAA-Compliant User Research
The all-in-one research platform for teams that handle health data, from HR and benefits tools to healthcare providers. Recruit participants, run interviews, and analyze findings, all with enterprise-grade HIPAA compliance built in.
- HIPAA Compliant
- SOC 2 Type II
- BAA Available
Trusted by 300+ customer-obsessed teams
The cost of non-compliance is catastrophic
Healthcare organizations can't afford to take shortcuts with PHI. The stakes are too high.
What's included in our HIPAA compliance
We invest in the technical controls, legal framework, and ongoing compliance processes so your team can focus on research.
Business Associate Agreement
Signed BAA with Great Question covering the PHI you store on the platform: a legally binding commitment to protect your data. Video recordings and transcripts are handled by third-party providers outside our BAA.
SOC 2 Type II Certified
Independent third-party audit of our security controls, availability, and confidentiality practices. Report available under NDA.
Independent Security Assessment
Annual HIPAA Security Risk Assessment conducted by an independent firm, with penetration testing scoped for PHI handling.
Field-Level Encryption
PHI is encrypted at the field level, beyond standard AES-256 at-rest encryption. Sensitive health data is isolated from PII.
Complete Audit Trail
Every access, modification, and export of PHI is logged. Complete audit trail for compliance reviews and incident investigations.
Consent & Data Controls
Configurable data retention, deletion policies, anonymization capabilities, and consent tracking built into every study.
Built for teams that handle health data
Run every type of research with PHI: safely, compliantly, and without workarounds.
HR & Benefits Tools
Research benefits enrollment, leave, and wellness programs with employees and HR admins. Store findings that touch employee health information under your BAA.
Health & Wellness Apps
Test fitness, mental health, and wellbeing products with the people who use them. Keep participants' health details in encrypted, access-controlled fields.
Patient Experience Research
Interview patients about their care journey, collect feedback on portals and apps, and analyze findings.
Provider Recruitment Panels
Build and manage a panel of healthcare professionals for ongoing research. Track consent, NDAs, and participation history in one compliant CRM.
Clinical Workflow Testing
Test EHR workflows, clinical decision support tools, and care coordination platforms with real providers. Record sessions and store findings.
Telehealth UX Research
Run moderated and unmoderated studies on telehealth platforms. Store highlights, participant information, and research findings containing PHI. (Session recordings and transcripts are processed by third-party providers and fall outside our BAA.)
How we compare
Not all HIPAA compliance is created equal.
Capability | Great Question | UserTesting | Dovetail | Maze |
|---|---|---|---|---|
| HIPAA Compliance | ||||
| BAA Available | Excluding transcriptions & recordings | |||
| SOC 2 Type II | ||||
| Independent HIPAA Assessment | Unclear | |||
| Research Capabilities with HIPAA | ||||
| Participant Recruitment | ||||
| Moderated Interviews | ||||
| Unmoderated Testing | ||||
| Research Repository | Limited | |||
| Video Downloads Allowed | Disable by default | |||
| Participant CRM | ||||
| Full product without restrictions | Restricts sharing, forces SSO |
See how Great Question stacks up against alternatives
vs. UserTesting
UserTesting charges $500K+ for 3-year healthcare deals. Great Question delivers the same HIPAA compliance at a fraction of the cost, with a dedicated participant CRM that doesn't recycle panelists.
vs. Dovetail
Dovetail requires Enterprise + a separate HIPAA add-on, then restricts video downloads and sharing. Great Question keeps the full product available under HIPAA; recordings and transcripts sit outside our BAA.
vs. Rally
Rally is CRM-only. Great Question gives you CRM, interviews, repository, and unmoderated testing in one platform, with the BAA covering the PHI you store in it.
vs. Maze
Maze doesn't support HIPAA at all. No BAA, no HIPAA assessment. If you're in healthcare, it's not an option.
Everything your compliance team needs
We make it easy for your legal and security teams to sign off: once, not per-study.
Signed BAA with Great Question
Covers the PHI you store on the platform
Independent HIPAA Security Risk Assessment
Conducted annually by third-party firm
SOC 2 Type II Certification
Available under NDA via Trust Portal
Complete Audit Trail
Every PHI access and modification logged
Configurable Data Retention
Set retention and deletion policies per your requirements
Incident Response Plan
Breach notification procedures documented
HIPAA-Eligible Infrastructure
Enhanced monitoring, backup, and disaster recovery
Frequently asked questions
Is Great Question HIPAA certified?
There's no such thing as "HIPAA certified": even the US Department of Health and Human Services doesn't offer a certification. HIPAA compliance is maintained through ongoing annual risk assessments, employee training, continuous monitoring, and policy updates. Great Question maintains all required HIPAA safeguards and undergoes annual independent security assessments.
Do you sign a Business Associate Agreement (BAA)?
Yes. We sign a BAA with every customer who needs HIPAA compliance, covering the PHI you store on the platform. Note that our video and transcription providers aren't covered under our BAA, so session recordings and transcripts are excluded and shouldn't contain PHI. Your legal team reviews our BAA once and you're covered for everything within its scope.
How is HIPAA compliance priced?
HIPAA compliance is available as a platform add-on on our Enterprise plan. It's priced separately because it represents real ongoing investment: annual audits, vendor BAA management, enhanced infrastructure, and dedicated engineering. We don't pass those costs to customers who don't need them. Contact sales for pricing.
Does HIPAA compliance restrict any features?
No. Unlike some competitors that disable video downloads, restrict sharing, or force SSO when HIPAA is enabled, Great Question gives you the full product experience. Our HIPAA compliance is built into the platform architecture, so it doesn't come with feature restrictions.
What types of PHI can I store on Great Question?
You can safely store highlights, participant information, and research findings that contain protected health information. All PHI is encrypted at the field level, with access controls and complete audit logging. Important: session recordings and transcripts are processed by third-party video and transcription providers that aren't covered by our BAA, so they shouldn't contain PHI.
Can I see your security documentation?
Yes. Our Trust Portal contains all security documentation including our SOC 2 Type II report (available under NDA), security policies, and compliance details. Visit our Trust Portal to request access.
Ready to run HIPAA-compliant research?
Join HR tech, benefits, and healthcare teams who trust Great Question to protect PHI while accelerating their research.