Security & HIPAA

Yes. Formisoft is designed to meet HIPAA's administrative, physical, and technical safeguard requirements:

• 256-bit AES encryption at rest and TLS 1.3 in transit
• Role-based access controls with four permission levels
• Complete audit logging of all data access and modifications
• US-only data hosting on AWS infrastructure
• Secure token generation for magic links
• Bcrypt password hashing and HMAC-signed webhooks

A Business Associate Agreement (BAA) is available on the Enterprise plan.

Multiple encryption layers protect patient data:

• At rest — AES-256 encryption on AWS RDS (PostgreSQL) and AWS S3 (file storage)
• In transit — TLS 1.3 between browser and servers, and between Formisoft and all third-party services
• Passwords — hashed with bcrypt (10+ salt rounds)
• Form passwords and API tokens — cryptographically secured

Patient data never leaves US borders.

Every action in Formisoft is logged automatically. When anyone on your team performs an action, an audit entry is created with:

• Action type — create, read, update, delete, export, login
• Resource affected — patient, form, submission, appointment, etc.
• User who performed the action
• IP address and user agent (browser/device)
• Precise timestamp

Audit logs are admin-only, fully searchable, and exportable for HIPAA compliance reviews.

Four roles with distinct access levels:

• Admin — full access including team management, billing, organization settings, and all patient data
• Provider — view and manage patients, appointments, and submissions (no settings or billing)
• Staff — manage patients and appointments day-to-day (no settings)
• Patient — limited access to their own data only

Team members are invited by email and assigned a role by an admin. Roles can be changed at any time.

All data is stored and processed exclusively in the United States on AWS infrastructure:

• Database — AWS RDS PostgreSQL in a US region
• File storage — AWS S3 in a US region
• Application servers — US-based

Data never leaves US borders. This meets HIPAA requirements and many state-level healthcare data regulations.

Magic links use JWT (JSON Web Tokens) signed with a secret key:

• Each token contains the patient ID, appointment ID, form IDs, and organization ID
• Tokens expire after 7 days
• No login or account creation required for patients
• Tokens are single-use for appointment-based intake