VerifID Forms: Online Form Builder for HIPAA Safeguards
Safeguarding Protected Health Information (PHI) through rigorous technical controls and zero-knowledge data architecture.
Zero-Knowledge Architecture: Beyond Standard Compliance
VerifID Forms utilizes client-side End-to-End Encryption (E2EE) powered by RSA-3072 and AES-256 protocols.[cite: 11] This ensures that Protected Health Information (PHI) is encrypted on the user's device before reaching our servers. As a “Zero-Knowledge” platform, we hold no decryption keys, making it mathematically impossible for us or any unauthorized party to access sensitive patient records.
Administrative & Technical Safeguards
Engineered explicitly to satisfy the rigorous data conditions of healthcare organizations.
AES-256 Encryption
Responses are encrypted in the respondent's browser with AES-256, the key is wrapped with RSA-3072, and only ciphertext is stored. Connections use TLS.
BAA on Request
For US covered entities and business associates, a Business Associate Agreement is available on qualifying plans before any PHI is collected.
Keys You Hold
Only the person holding the private key can read patient data. VerifID staff cannot, so access is limited to the people you give the key to.
Verifiable Deletion
Delete a record and destroy the key, and any remaining copies stay permanently unreadable.
HIPAA Technical Safeguards
How our architecture aligns with the technical security directives of the law.
Owner Accounts
Form owners sign in with their own accounts, and the decryption key is held separately from the account.
Key Backup, Not Key Recovery
We cannot recover a lost key, by design. Before collecting PHI, store the key file and passphrase in a password manager and agree a break-glass procedure for your team.
Deep Dive: HIPAA & HITECH Digital Compliance
The Health Insurance Portability and Accountability Act (HIPAA) ensures patient privacy. VerifID Forms adds a zero-knowledge environment on top of standard technical safeguards. This means even as your service provider, we have no access to the plaintext data submitted by patients, which supports the technical safeguards HIPAA and the HITECH Act expect. Combined with your own access controls and policies, it helps medical institutions and business associates protect patient data.
Frequently asked questions
Is VerifID Forms HIPAA compliant? ▾
There is no official HIPAA certification for software. VerifID Forms is built to support a compliant workflow: submissions are encrypted client-side so the platform cannot read Protected Health Information, and a Business Associate Agreement is available on request for qualifying plans. Compliance is a shared responsibility between the platform and your organization's own policies.
Do you sign a Business Associate Agreement (BAA)? ▾
A BAA is available on request for US covered entities and business associates on qualifying plans. Contact us before you collect Protected Health Information, and have the BAA signed first.
How is patient data protected? ▾
Each response is encrypted in the respondent's browser using RSA-3072 and AES-256 before it is transmitted. The decryption key is generated client-side and never sent to our servers, so VerifID staff, automated systems, and anyone who compromised our database would see only ciphertext.
Can VerifID staff read form submissions? ▾
No. Because the private key never leaves the form owner's control, we have no technical ability to decrypt submission content. This is what makes the architecture 'zero-knowledge'.
What happens to PHI when I delete a form or response? ▾
Deleting the encrypted record removes it from storage. Because only the form owner holds the decryption key, destroying that key also renders any residual copies permanently unreadable, which makes erasure requests straightforward to honor and verify.