Oraform
Security

Built to protect patient information.

Your patients share their most sensitive details on these forms. Here is how we handle them.

Signed BAA

We sign a business associate agreement with every clinic before any patient information is collected, and our hosting provider signs one with us.

Encryption

All data is encrypted in transit and at rest. Each clinic's data is encrypted with its own key.

Clinic isolation

Each clinic's submissions are separated at the database level, not just in the application.

Audit logging

Every time a submission is viewed or exported, it's logged with who, what and when.

No tracking on forms

Patient-facing forms carry no advertising, analytics or third-party scripts.

Access control

Staff sign in with individual accounts. Access can be removed instantly when someone leaves.

A note on "HIPAA compliant"

No software makes a practice HIPAA compliant on its own. Compliance also depends on how your team uses the tools.

What we provide is HIPAA-ready infrastructure, a signed BAA, and safeguards designed around the HIPAA Security Rule. We're happy to answer questions from your compliance lead.

See your own forms, rebuilt.

Send us what you use today and we'll send back a working version you can open on your phone and your computer. No cost, no commitment.

Send us your forms