Are you encouraging insecurity via your Web site contact and intake forms?
Friday, April 15th, 2016
Many Web sites have “contact us” pages and other Web forms for receiving requests from existing or potential customers. This includes “new patient intake” forms on the Web sites of healthcare providers.
The garden variety Web form suffers from several serious problems:
- Spam – Getting unwanted form submissions from Web robots.
- Privacy – Often, sensitive data is submitted insecurely through these forms.
- Archival – You may need an archived record and backup of all submissions.
- Notices – You may need to be alerted of form submissions, even if you are not online.
Proactive privacy vs. neglect of privacy
When your Web forms transmit data insecurely, store or send data insecurely, or otherwise to do not treat the data submitted with the level protection that it deserves, you are putting the users of your forms at risk.
The typical argument is that “it is up to the user of the forms to decide if they want to submit sensitive information.” In fact, many insecure forms even have disclaimers requesting people to not submit sensitive information if they have concerns … and then the forms go on to ask lots of sensitive questions. Especially without a disclaimer, but even with one, the form is actively soliciting people to submit their information insecurely and requesting them to take risks with their private data. This is not good.
In areas such as healthcare, where these forms are often collecting sensitive health data (protected health information – PHI), the fact that an organization solicits the submission of PHI through insecure, non-HIPAA-compliant means is far from a “best practice”. Why?
Read the rest of this post »
It is simple; we find many organizations are looking for this because either:
Doctors and medical professionals are feeling increasing pressure to 
For folks in the medical field, there is often a lot of uncertainty regarding which kinds of web forms need HIPAA compliance and which ones do not. We often have customers asking if this or that form really needs to be secure or not.
