Client wants sensitive data in forms. Best solution?

Okay. So I have one client that wants sensitive data in their business websites forms.

This data seems to me that it would need to be compliant with hipaa and ferpa. I don't want to niche down in this area, and meeting compliance with regular audits, security, etc sounds like a bad time for the ROI.

I've looked into other solutions a little, but it usually has ended with "enterprise plan, contact for details"

Does anybody have a solution that minimizes the costs and bureaucracy in situations like these?