HIPAA Web Forms
Connect Gravity Forms to a HIPAA-compliant storage service so patient form data is encrypted, securely stored, and access-logged.
What it does
Healthcare websites often need to collect patient information online, but standard contact forms don't meet HIPAA requirements for data security and access control. This add-on bridges that gap by wrapping your existing Gravity Forms with encryption, secure off-site storage, and a full access audit log.
When a visitor submits a form, the data is encrypted with two separate keys and sent to the HIPAA Forms Service API, where it stays encrypted on HIPAA-compliant servers. Your hosting server never stores the protected health information. Authorized staff can log into your WordPress dashboard to view submissions, and the decrypted data is only ever rendered in the browser—it never touches your own server.
The add-on is aimed at web designers and developers building sites for dental clinics, health clinics, hospitals, and insurance agencies. A subscription license key from hipaaforms.online is required, along with an SSL certificate and a signed Business Associate Agreement (BAA) with Code Monkeys LLC.
Key features
- Checkbox in the admin interface instantly makes any Gravity Form HIPAA-compliant
- Form data encrypted with two separate keys before leaving the browser
- Encrypted data stored on HIPAA-compliant servers, never on your hosting server
- Authorized admin or hipaa-role users can view submissions from the WordPress dashboard
- Generate an encrypted, password-protected PDF of any submission; file is destroyed on the server after the window closes
- Full access log recorded every time someone views the HIPAA Forms admin interface
- Option to restrict who can see submitted forms: all authorized users, specific users, or a doctor selected within the form itself
Good for
Written from Code Monkeys LLC’s own listing. Version and dates come straight from the source and are checked weekly.
Do I need anything besides this plugin?
Yes. You need a license key from hipaaforms.online (a free tier is available), an SSL certificate on your site, and a signed BAA with Code Monkeys LLC. Forms cannot be submitted or viewed until all three requirements are met.
Where is the submitted form data stored?
All encrypted data is stored on the HIPAA Forms Service servers, not on your WordPress hosting server.
Can I export submissions as a PDF?
Yes. Authorized users can generate an encrypted, password-protected PDF from the admin dashboard. The file is deleted from the HIPAA Forms servers as soon as you close the generation window.
Who can view submitted forms?
Users with an administrator or hipaa role can view forms. You can restrict access further to specific users or to a particular doctor chosen by the patient inside the form.