1

I'm starting a company that will build and sell websites to pharmacies. Each website will need HIPAA compliant forms, for example for patients to order refills on.

Would Cognito Forms allow me to purchase an enterprise plan and then place a different form on each individual pharmacy website so that, again for example, if a patient reorders their medication, their response would be emailed directly to that individual pharmacy and not to me or to any other?

Would Cognito Forms sign a BAA (Business Associate Agreement) with just my website/marketing company or with my company and each individual pharmacy I build a website for?

1

This is technically two questions:

1. Are emails sent from Cognito Forms HIPAA compliant?

Yes, when following HIPAA guidelines. Cognito Forms leverages MailGun for HIPAA compliant transmission of emails and has a BAA with MailGun. This means that communications with MailGun are secure and MailGun has privacy measures in place to ensure emails are safe when passing through their servers.

However, when sending notifications to third parties, like pharmacies, these email accounts must also be HIPAA compliant to ensure that the security and processes for managing these email accounts comply with HIPAA guidelines. Additionally, prior consent is always required before sending emails to patients for any reason, regardless of how secure the transmission is.

A better approach would be to leverage the secure JSON webhooks to send requests directly into a HIPAA-compliant order fulfillment system maintained by the pharmacy, instead of relying on email.

2. Can a single Cognito Forms Enterprise plan be used for multiple Covered Entities?

Yes, though not ideal. If your organization is acting as a Business Associate on behalf of multiple Covered Entities, then you can sign a BAA with Cognito Forms for a single Enterprise account and leverage this for your customers. Your customers would, in turn, sign a separate BAA directly with your organization, establishing a chain of trust, similar to our BAA's with Microsoft Azure for hosting and MailGun for email delivery.

However, this poses a number of limitations and possible security issues if not managed correctly by you. First, you must ensure that you either do not allow pharmacies to log into Cognito Forms or you must assign them a global permission of None and only provide Editor or Reviewer permissions for their specific forms. You will also be directly responsible for the data in Cognito Forms and honoring any requests to remove this data on their behalf.

Our recommendation is for each Covered Entity to have their own Cognito Forms organization, with agencies having a single guest account to assist with form building and integration activities. This gives Covered Entities more control over their data.

| improve this answer | |
  • "Our recommendation is for each Covered Entity to have their own Cognito Forms organization, with agencies having a single guest account to assist with form building and integration activities. This gives Covered Entities more control over their data." ....by this do you mean each pharmacy (aka covered entity) would have their own Enterprise plan? or do you mean I would have 1 Enterprise plan for my website building/marketing company and then make each pharmacy a seperate username/password? – John D Apr 6 '17 at 22:07
  • A better approach would be to leverage the secure JSON webhooks to send requests directly into a HIPAA-compliant order fulfillment system maintained by the pharmacy, instead of relying on email. ...what is a JSON webhook? is this something I set up through CognitoForms? – John D Apr 6 '17 at 22:08
  • Correct, each organization would have their own plan. If organizations share the same plan, they would not be able to enter into a BAA with Cognito Forms directly, but would instead need to enter into one with you as a business associate. You can post JSON data to another website by specifying the URL under Submission Settings. This option will require some assistance from a developer familiar with the system the data will be pushed into. – Jamie Thomas Apr 26 '17 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.