HIPAA Compliance for Fluent Forms
I'm working with a client who processes Protected Health Information (PHI) and needs a way for clients to submit their blood data on a regular basis. I see that Gravity Forms has an add-on for this feature, but I don't see anything like that for Fluent Forms.
One of the cases could be resolved using Fluent Forms to collect and pass the data on to a HIPAA compliant storage. Hope you give this some thought.
I didn’t know Gravity has that feature (not that I’m switching plugins). This would be a handy add-on for FluentForms.
GF does have a third party add on and it uses a HIPAA FORMS Service API (subscription required) from https://www.hipaaforms.online/
Kevin Watson I wonder if this could be a solution without needing Gravity Forms or WordPress? It's just the PHI data collection we need to protect, I think. Still trying to determine the reporting to the client for protection.
William Beem I think that website makes the plugin and has integrated it fully with their service so you would need a different service..?
The data pass-through for HIPAA requires secure, encrypted collection and storage, strong access controls, and a signed Business Associate Agreement (BAA) with any third-party vendors. So it can't just send, the whole process has to be encrypted and HIPAA compliant. I know that JotForm has HIPAA compliance, but they control the whole process. It's not just the pass through, but the destination that has to fall in line. That is my understanding.
Kevin Watson That coincides with my understanding, too.
There are multiple aspects to this client project. He needs to collect data on six events per day and provide reports to each client. That's the HIPAA part. The intent is to use Google Sheets for storage and Looker Studio for reporting.
The other part is a community, CRM, etc. All the Fluent tools work fine for that. I'm trying to determine the best way to help segregate the HIPAA portion from the rest.
William Beem Maybe your hosting can be HIPAA compliant? Can you do that?
Kevin Watson Yes, we're looking at HIPAAVAAULT as a host. It's compliant, but likely not the best hosting for FluentCommunity.
WordPress isn't HIPAA compliant, so their page states that they've worked to make it compliant, the platform is compliant, etc. I'm investigating whether some of the plugins we add would jeopardize the compliance or possible not work with some of their modifications.
I've checked into getting our BAA with Google for using Sheets and that seems rather straight forward.