Automate This: How to Build HIPAA-Compliant Data Collection Workflows Without a Developer

Quick Summary: FormAssembly lets healthcare organizations build HIPAA-compliant forms connected to Salesforce without writing code or standing up a custom compliant system.

• Real-world examples include HealthStream’s HIPAA-compliant training intake with a Salesforce LMS audit trail, and Alosa Health’s elimination of roughly 500 paper intake sheets per year.
• FormAssembly handles all four of HIPAA’s Security Rule requirements at the platform level: access controls, audit trails, encryption in transit and at rest, and a signed Business Associate Agreement (BAA).
• Building a compliant workflow requires FormAssembly’s Enterprise plan, a Salesforce org with FormAssembly’s Salesforce connector, and — if using SAML authentication — an existing identity provider such as Okta or Microsoft Entra ID.
• The build process has four steps: sign FormAssembly’s BAA, restrict form access with SAML authentication, design forms that collect only the minimum necessary ePHI, and connect submissions to Salesforce with the Submit Connector.
• Healthcare IT leads, Salesforce admins, and compliance officers can build and deploy these workflows themselves, with no developer involvement required.

---

Most healthcare organizations are collecting patient and staff data on forms that aren’t actually HIPAA-compliant. Not because compliance isn’t a priority, but because building compliant alternatives seems technically complex, expensive, and developer-dependent. The assumption is that HIPAA-compliant data collection requires either a custom-built system or a six-figure implementation project.

That assumption is wrong. FormAssembly handles HIPAA compliance at the platform level with access controls, encryption, audit trails, and the business associate agreement (BAA) combined in an easy-to-use package. Healthcare IT leads, Salesforce admins, and compliance officers can build and deploy HIPAA-compliant forms connected to Salesforce without writing a line of code. Here’s how.

What HIPAA actually requires from your forms

HIPAA’s Security Rule mandates specific technical safeguards for any system that creates, receives, maintains, or transmits electronic protected health information (ePHI). For data collection workflows, the relevant requirements are:

• Access controls: Only authorized users or patients should be able to access or submit a form that collects ePHI. This means forms can’t be publicly accessible without authentication.
• Audit controls: Systems must record and examine activity in systems that contain ePHI. Who accessed the form, when, and what was submitted must be logged.
• Encryption: ePHI must be encrypted in transit (when submitted) and at rest (when stored). TLS/HTTPS for transit; AES-256 or equivalent for storage.
• Business Associate Agreement: Any vendor handling ePHI on behalf of a covered entity must sign a BAA that defines their responsibilities under HIPAA.

FormAssembly addresses all four of these requirements at the platform level. The BAA is executed with FormAssembly as your business associate. Encryption in transit and at rest is standard across the platform. Audit trail logging is built in to select plans. Access controls are enforced through authentication options that include SAML single sign-on.

With FormAssembly, you don’t have to configure HIPAA compliance field by field. Instead, you can architect compliance with appropriate tools in a compliant environment.

What you need before you build

Before you build your first integrated HIPAA-compliant workflow, confirm you have the following:

• FormAssembly Enterprise plan. This is the plan tier that includes the HIPAA-compliant environment, BAA execution, and the platform-level controls described above. Standard plan accounts are not necessarily HIPAA-eligible.
• A Salesforce org and FormAssembly’s Salesforce connector. You need this for routing form data to the correct patient, staff, or case record. The Salesforce integration maps form fields to Salesforce objects at submission.
• A SAML identity provider (if using SAML authentication). Most healthcare organizations already have one: Okta, Microsoft Entra ID (formerly Azure AD), OneLogin, or a similar IdP. FormAssembly connects to your existing IdP rather than creating a separate login system.

FormAssembly features involved in this workflow:

• SAML Authentication
• Salesforce Integration (Submit Connector and Prefill Connector)
• Audit Trail
• Field-level encryption
• Conditional logic

How to build HIPAA-compliant workflows: 4 steps

Step 1. Signed Business Associates Agreement

The BAA is executed between your organization and FormAssembly as part of the account onboarding process. Once signed, FormAssembly is your business associate for any ePHI that passes through the platform. You don’t need a separate BAA for each form or each Salesforce object you connect to.

What this step gives you: encryption at rest and in transit, HIPAA-eligible data storage, a signed BAA on file, and an audit-ready environment before you’ve built a single form.

Step 2. Restrict access with SAML authentication

ePHI can’t be publicly accessible – only verified staff or patients should be able to reach it. FormAssembly’s SAML authentication enforces this at the form level.

Here’s how SAML works in this context: when a user attempts to open a FormAssembly account that requires SAML authentication, they’re redirected to your organization’s identity provider – Okta, Microsoft Entra ID, or whichever IdP you use. The IdP verifies their identity using your organization’s existing credentials and directory. Once verified, they’re returned to the form and allowed to proceed. If they’re not in your IdP’s authorized user list, they can’t access the form.

This means SAML authentication is enforced by your organization’s own identity infrastructure – it’s not a separate login system that FormAssembly manages. Staff don’t need a new password. The access control is as tight as your IdP’s policies, which for most healthcare organizations is already meeting HIPAA requirements.

To configure it: navigate to your account’s Security menu on the Admin dashboard. Full instructions here.

Pro tip: SAML authentication on forms can also pass user attributes — like a staff member’s employee ID or department — into hidden form fields automatically. Use this to pre-identify the submitter in the form response without requiring them to enter their own information, and to route that data to the correct Salesforce record on submission.

Step 3. Build forms with PHI-appropriate field design

Building the form itself is where clinical and operational knowledge matters most. The goal is to collect the ePHI you actually need – and nothing more. HIPAA’s minimum necessary standard applies to data collection, not just data sharing.

Practical guidelines for PHI-appropriate form design:

• Use conditional logic to keep forms short. If a field is only relevant based on a prior answer – a secondary diagnosis field that only appears if a primary diagnosis is selected, for example – use conditional logic to hide it by default. Patients see fewer fields, and you collect less data than you need to handle compliantly.
• Avoid collecting ePHI you won’t use. Date of birth, Social Security number, and insurance ID are common over-collections. If you don’t need it for the workflow downstream, don’t collect it.
• Use field-level labels that are clear to patients. Healthcare jargon is a friction point that increases form abandonment. “Primary diagnosis code” is for clinical staff. “What is your main health concern?” is for patients. Design for the actual respondent.
• Enable field-level encryption for the most sensitive fields – diagnosis codes, medication names, and financial data – as an additional layer of protection beyond the platform-wide encryption already in place.

The form builder in FormAssembly supports all standard field types (such as text, dropdown, date, and file upload) along with conditional logic, page breaks for multi-step forms, and field validation rules. No custom code is required for any of these.

Step 4. Connect to Salesforce

The Salesforce Integration (Submit Connector) maps your form fields to the correct Salesforce object when the form is submitted. In a healthcare workflow, this might be a patient record, an LMS training record, a case record, or a custom object specific to your implementation.

To configure it: add the Submit Connector to your form, authenticate it with your Salesforce org, select the object type, and map each form field to the corresponding Salesforce field. If the record already exists in Salesforce – a returning patient or an enrolled staff member, for example – use the “upsert” operation to update the existing record rather than creating a duplicate.

The audit trail logs every interaction with the form response: who accessed it, when, from what IP address, and what changes were made. This log is available in FormAssembly’s response management interface and can be exported for compliance reporting. It provides the “audit control” documentation that HIPAA requires without any additional configuration.

Pro tip: Use a hidden Salesforce record ID field in the form — populated via a secure, tokenized URL parameter — to ensure the Submit Connector updates the exact correct record, even in high-volume environments where multiple records of the same object type are active simultaneously.

This workflow in practice

HealthStream: HIPAA-compliant training intake with full Salesforce LMS audit trail

HealthStream – a healthcare learning and workforce development platform – uses FormAssembly to manage HIPAA-compliant training intake for its enterprise healthcare clients. The workflow uses SAML authentication to restrict form access to verified employees of each client organization. When a staff member completes the training intake form, the submission is written directly to the Salesforce LMS record for that employee.

The audit trail captures every interaction: who accessed the form, when they completed it, and what was submitted. That log feeds into the compliance reporting that HealthStream’s clients use for HIPAA training documentation requirements. The result is a fully automated training intake workflow – SAML-authenticated, HIPAA-compliant, and producing a Salesforce-native audit trail – with no developer involvement in the ongoing operation.

Alosa Health: 500 paper sheets per year eliminated

Alosa Health was processing approximately 500 paper intake sheets per year and transcribing the data manually into Excel before it could enter any downstream system. The process created transcription errors, created HIPAA exposure through physical document handling, and consumed significant administrative time.

After implementing FormAssembly, the paper process was eliminated entirely. Data collected through HIPAA-compliant forms goes directly into the system of record without a transcription step. Administrative burden decreased and the manual Excel workflow was retired.

What this unlocks beyond compliance

Once the HIPAA infrastructure is in place, FormAssembly can handle a range of adjacent workflows without requiring a separate compliant environment for each one.

• Clinical research intake: Continuum Clinical uses FormAssembly for research data collection and achieved a 20% reduction in worktime spent on data cleansing and organizing, and eliminated their manual outreach process entirely. The same compliant environment that handles patient intake handles research data collection.
• Patient surveys: Post-visit satisfaction surveys, symptom check-ins, and follow-up questionnaires can all run through the same HIPAA-compliant environment with the same Salesforce Integration routing responses to the correct patient record.
• Clinical trial recruitment: Initial screening questionnaires, eligibility assessments, and informed consent forms can be deployed as HIPAA-compliant FormAssembly workflows without a separate compliance review for each form type.
• Staff HR forms: Employee health screenings, vaccination attestations, and leave requests that include health information can all be handled under the same compliant roof, connected to the same Salesforce HR records.

This is the compounding benefit of building on a compliant platform rather than a compliant form: every new workflow you add inherits the infrastructure you already have. The second HIPAA-compliant workflow takes a fraction of the time to build as the first, because the hard parts – the BAA, the encryption, the authentication – are already done.