Growing groups add locations and specialties faster than they add privacy reviews. Someone duplicates last year's PDF into a free form tool so "the new office can go live Friday." That is how PHI leaves the program.
Personalize inside the approved builder
Clone a template, change the specialty questions, brand it for the location, and keep submissions in the same access model. Do not stand up a second product because a physician wants three extra fields.
What HIPAA Companion forms are for
The builder is meant for physician offices that need different packets (new patient, consent, records request, referral) without a developer for every change. E-signatures, mobile layout, and team alerts are included so staff do not print the web form "to make it easier."
Review new live forms the way you review a new email template: who can see submissions, where alerts go, and whether the BAA already covers the tool. If the answer is "we used a personal Typeform," stop and move the form.