Security & HIPAA

Yes. Formisoft runs on ISO 27001 and ISO 27799 certified infrastructure and is designed to meet HIPAA's administrative, physical, and technical safeguard requirements:

• ISO 27001 information security management and ISO 27799 health informatics security
• 256-bit AES encryption at rest and TLS 1.3 in transit
• Role-based access controls with four permission levels
• Complete audit logging of all data access and modifications
• US-only data hosting
• Secure token generation for magic links
• Bcrypt password hashing and HMAC-signed webhooks

A Business Associate Agreement (BAA) is included on every plan.

Formisoft is hosted on infrastructure certified to international healthcare security standards:

• ISO 27001, information security management systems
• ISO 27799, security management in health informatics

These certifications complement our HIPAA-aligned administrative, physical, and technical safeguards, encryption, audit logging, and signed BAA on every plan.

Multiple encryption layers protect patient data:

• At rest - AES-256 encryption on all databases and file storage
• In transit - TLS 1.3 between browser and servers, and between Formisoft and all third-party services
• Passwords - hashed with bcrypt (10+ salt rounds)
• Form passwords and API tokens - cryptographically secured

Patient data never leaves US borders.

Every action in Formisoft is logged automatically. When anyone on your team performs an action, an audit entry is created with:

• Action type - create, read, update, delete, export, login
• Resource affected - patient, form, submission, appointment, etc.
• User who performed the action
• IP address and user agent (browser/device)
• Precise timestamp

Audit logs are admin-only, fully searchable, and exportable for HIPAA compliance reviews.

Four roles with distinct access levels:

• Admin - full access including team management, billing, organization settings, and all patient data
• Provider - view and manage patients, appointments, and submissions (no settings or billing)
• Staff - manage patients and appointments day-to-day (no settings)
• Patient - limited access to their own data only

Team members are invited by email and assigned a role by an admin. Roles can be changed at any time.

All data is stored and processed exclusively in the United States:

• Database - encrypted, US-hosted
• File storage - encrypted, US-hosted
• Application servers - US-based

Data never leaves US borders. Infrastructure is ISO 27001 and ISO 27799 certified and meets HIPAA requirements and many state-level healthcare data regulations.

Magic links use JWT (JSON Web Tokens) signed with a secret key:

• Each token contains the patient ID, appointment ID, form IDs, and organization ID
• Tokens expire after 7 days
• No login or account creation required for patients
• Tokens are single-use for appointment-based intake