It can be used on HIPAA sites, but compliance depends on other factors, not just the form builder.