Security and HIPAA at Intake Pro
Intake Pro is built for protected health information. Staff use multi-factor authentication, access is scoped to your practice and logged, files are encrypted at rest, and connections use HTTPS.
We sign a business associate agreement before you collect real patient data. Your practice keeps control of who can read patient forms and how staff use them.
Last updated
- BAA Before real patient data
- MFA Required for staff
- Session length 12 hours
- Files Encrypted at rest
- Access Scoped and logged
How does Intake Pro protect patient data?
Intake Pro limits and records staff access to patient data. Every read is scoped to the practice, and every read is logged.
Staff sign in with multi-factor authentication, and sessions end after 12 hours. Files are encrypted at rest, and connections use HTTPS.
These controls support the way your practice handles protected health information. Read more about HIPAA compliant forms and the records they produce.
Does Intake Pro sign a BAA?
Yes. Intake Pro signs a business associate agreement before your practice collects real patient data. The BAA comes before patient forms go into use.
A business associate agreement sets the terms under which a vendor handles patient data for a practice. Read What is a BAA? for a plain-English guide, and confirm your practice's obligations with its own counsel.
Who can see patient forms?
Your practice decides which staff roles can see patient forms. Roles can be customized, and each read is limited to the staff member's practice.
Staff accounts use multi-factor authentication and sessions end after 12 hours. Each read of a patient form is logged.
What happens to a form after it is signed?
Intake Pro keeps the signed form version, who signed, when they signed, a signed PDF and an audit trail. Editing the form later makes a new version and does not change earlier submissions.
Staff can download one PDF, a packet PDF, a ZIP of PDFs or a spreadsheet with one row per response. See signed records and exports for the record each submission keeps.
How are uploaded PDF and Word files handled?
Intake Pro scans an uploaded PDF or Word file for malware before converting it. Staff then place the fields and publish the form.
Files are encrypted at rest and connections use HTTPS. Once a form version is published, it does not change; later edits create a new version.
Does HIPAA offer an official software certification?
No. There is no official HIPAA certification for software. A product's controls do not remove the practice's own responsibilities for protecting patient information.
Your practice still needs to set up staff roles, review access, decide which forms to collect and apply its own privacy and security policies. Intake Pro supports that work with a BAA, scoped and logged access, staff MFA and encrypted files.
This page is general information, not legal advice. Confirm your practice's HIPAA responsibilities with its own counsel or compliance lead.
Questions
Will Intake Pro sign a BAA before we collect patient data?
Yes. Intake Pro signs a business associate agreement before your practice collects real patient data. The BAA is in place before patient forms go into use at your practice.
Do staff need multi-factor authentication?
Yes. Staff sign in with multi-factor authentication, and sessions end after 12 hours. Each staff account uses MFA, and a new sign-in is required after that session ends.
Can our practice limit who sees a submission?
Yes. Roles can be customized, and every read is scoped to your practice and logged. Your practice decides which staff roles can see patient forms, and the access log records each read.
Are uploaded files encrypted?
Yes. Files are encrypted at rest and in transit. Uploaded PDF and Word files are also scanned for malware before conversion, and staff place the fields before publishing the form.
Does a signed submission change when we edit its form?
No. A published version is immutable. Editing creates a new version, and the earlier submission stays with the version, PDF and audit trail it was signed with.