Security & HIPAA · Secure Form

Hosting and infrastructure

Two approaches to protecting patient information.

Every Direct Delivery and Workflow Portal customer shares one application, one database and one file store. The platform runs in our hosting provider's HIPAA-enabled environment, with files, backups and keys in Amazon Web Services, all in the United States and all under Business Associate Agreements. The two plans differ in what happens to a completed form after a patient presses Submit.

Direct Delivery

Delivered by encrypted email, then deleted.

The PDF and any attached files are emailed to your office through our secure email provider. The subject and body name only the form, your organization and the time. We keep the submission for 30 days after our email provider accepts the delivery email, so a lost email can be sent again and your patient never fills the form in twice. Then it's deleted, and its backup copies expire within a further 30 days. Direct Delivery submissions are never archived. Your Direct Delivery account holds your form links and submission counts, not patient records.

Workflow Portal

Kept in your portal while you're a client.

Your chosen staff get a notice with a link and no patient details, unless you ask us to attach the PDF. They open the submission in your secure portal, where they can search, view, download and track it. Submissions stay there while you are a customer, unless you ask us to set a shorter period. Your staff can't delete them, so nothing disappears by mistake; we delete junk or duplicates when you ask, and whenever the law requires.

Your records are kept apart at more than one layer. Every record carries the organization it belongs to, and your staff see only yours. In the database, row-level security means a query that doesn't name its organization returns nothing, and automated tests check that one customer can't read another's records. Your files sit in their own folder, encrypted with a key used only for you, and are downloaded only through the application, never through shareable links.
When you leave: on Direct Delivery, any submission we still hold is returned securely if you ask, up to 30 days after the end; on Workflow Portal, you get one free export if you ask, up to 10 days after the end. Then all submissions, forms and account data are deleted within 30 days, and backups expire within a further 30. Workflow Portal archive copies can't be deleted early, so each one is deleted when its one-year lock ends, and stays protected as patient information until then. Only the audit record and a record of each form that came in and where it was emailed, with no patient details, are kept, for six years.
How we build your forms, as a Form Conversion or a Form Review & Build, is independent of where they run.

From the patient to your office

How patient information is protected.

Encrypted in transit

Every connection that carries patient information uses TLS 1.2 or later, and browsers are told to use HTTPS only. Email leaves our application over TLS and our email provider delivers it over TLS. If a recipient's mail server can't accept TLS, the message is held in the provider's secure portal, where the recipient signs in to read it. No submission email goes out unencrypted.

Encrypted with a key used only for you

Before anything is stored, the application encrypts each submission's answers, signatures, files and PDF with a data key used only for your organization. That key can be unlocked only through a master key in AWS Key Management Service, which never leaves AWS, and AWS logs every use of it. Underneath, our database storage and Amazon S3 encrypt everything again with AES-256.

Access and sign-in

One account per person, with no shared logins, for your staff or ours. Two-step sign-in is required for every account on both plans, with no opt-out: a passkey such as Face ID or a fingerprint by default, or a password plus a second step. A device a user chooses to trust can skip the second step for up to 30 days, and sessions end after 30 minutes without activity, or 8 hours after sign-in. Only our authorized administrator and our designated emergency contractor can open stored submissions, each with their own account, and only for the purposes your agreement lists.

Every access recorded

Every view and download of a stored submission is recorded with the person and the time, and kept for six years. Your administrators see the whole log, on both plans, including every access by us.

A locked archive on Workflow Portal

On Workflow Portal, for HIPAA covered entities and business associates, each submission is also written once to a locked archive and kept for one year. Nobody, including us, can change or delete an archive copy before its year is up. Direct Delivery submissions are never archived, and Workflow Portal customers outside HIPAA get no archive.

Nothing else on the form page

The form pages your patients fill in on our platform carry no cookies, analytics or tracking, and load no scripts, fonts or images from other companies. Patient details stay out of page addresses, because our hosting provider's request logs record each visitor's IP address and the page address for 30 days.

Policies, procedures and people

HIPAA compliance goes beyond technology.

Encryption and secure servers are important, but they're only part of protecting patient information. These administrative safeguards work alongside our technical security measures.

A written security program

It covers the administrative, physical and technical safeguards of the HIPAA Security Rule.
A dated risk analysis

Of the systems that hold patient information, and the risk management that follows from it.
Training before access

Our workforce and our contractor complete HIPAA privacy and security training before they get access.
Fast notice if something goes wrong

Our Business Associate Agreement commits us to an initial notice within 3 business days of discovering an incident, and a full written report within 10 with everything known by then, supplemented as we learn more.

Detailed incident-response, backup and recovery materials are shared with IT and compliance teams through their vendor review rather than published here.

Business Associate Agreements

We sign a Business Associate Agreement with every healthcare customer.

We understand the responsibilities that come with handling protected health information. Before a form takes live patient information, every healthcare customer signs a Business Associate Agreement with us, along with our Services Agreement. Testing with made-up details needs neither: before you try your free first form, you accept our Free Demo Terms.

We also maintain agreements with the service providers that handle protected health information on our behalf.

Sample Business Associate Agreement Our Master BAA with its service schedules. Read it before you sign anything. Services Agreement The terms of the service. Your Order Form is its last page.

Privacy

Privacy is part of the job.

Healthcare organizations trust us with sensitive information, and we respect that trust.

We use patient information to provide services to our healthcare customers, not to market to patients or sell their data. We maintain privacy and data-handling policies that govern how information is collected, processed and protected.

Read our Privacy Policy

Questions about privacy or regulatory requirements? Contact us.

The full picture, section by section.

Secure Form is a Fieldstone Health service. The Fieldstone Health Security & Privacy page covers our agreements, incident response, subcontractors and governance in full, citing the section of our agreements behind each commitment.

Read Fieldstone Health's Security & Privacy page

Need more security details?

Hospitals and larger healthcare organizations have their own security and vendor approval requirements. If your IT or compliance team needs additional information about our infrastructure, security practices or HIPAA safeguards, or has a security questionnaire for us, we're happy to work with them through the review process.

To report a security concern, email security@fieldstone-health.com.

Request security documentation

Your first form is on us.

Send us a form of up to two pages and try it from start to finish with made-up details. There is nothing to sign and nothing to commit to.

Get your first form free

When you're ready to use it with real patients, choose a service plan and sign a Business Associate Agreement with us.

Have a security question first? Let's talk.

Protecting patient information is part of everything we do.