Encrypted Forms for HIPAA Workflows: Scope and Questions

What the encryption architecture changes

Cyphorm encrypts response contents in the respondent's browser before submission. The intended application flow does not send the form owner's private key to the service, so stored response data alone cannot be decrypted by Cyphorm.

The service still handles account and form administration, schema and field labels, ciphertext, and operational metadata such as response timing or counts where applicable. Users also trust the application code delivered to the browser, their devices, and their key-management process.

This architecture can reduce vendor access to plaintext response contents. It does not establish that a particular organization, service arrangement, or workflow meets HIPAA requirements.

What your organization still needs to assess

• Whether the information is electronic protected health information and which entities handle it.
• Whether Cyphorm or another service is acting as a business associate in the specific arrangement, and whether a written BAA is required and available.
• Administrative, physical, and technical safeguards, including workforce access and incident response.
• Risk analysis, privacy notices, minimum-necessary collection, retention, and deletion.
• What data is sent through notifications, integrations, exports, backups, and supporting services.

Confirm current contract terms and operational controls before collecting ePHI. Consult your organization's privacy, security, and legal professionals for the applicable requirements.

Use forms only for an appropriate part of the workflow

Consider whether a form is suitable for each data type and collection purpose. Ask only for information needed at that stage, name who can decrypt responses, set a retention plan, protect private-key backups, and avoid sending decrypted answers into services that have not been assessed.

See encrypted healthcare intake and the encrypted form architecture for more detail.