Skip to main content
A website inquiry to a treatment program is health information, and some of it is covered by 42 CFR Part 2. Carescale stores it securely, but a copy also sits on the website: in its database, its uploads folder, its emails and any service the form shares data with. This checklist keeps that copy small and short-lived. Gravity Forms doesn’t sign Business Associate Agreements and stores entries unencrypted. Your website host is the party that can sign one.

​
Before real inquiries arrive

1

Delete entries after 1 day

In each form, open Settings, then Personal Data. Turn on retention and set entries to be deleted after 1 day. This also deletes uploaded files. Carescale has its copy within seconds, and the day leaves time for a late delivery.
2

Don't store IP addresses

In the same Personal Data settings, turn on the option that prevents storing the user’s IP address.
3

Keep answers out of notification emails

Notification emails travel and sit in inboxes. Remove {all_fields} and any field merge tags from each form’s notifications, so the email says only that a form was submitted. Staff get the details in Carescale.
4

Don't pass entries to other services

Don’t connect these forms to Zapier, a CRM add-on, a mailing list or Akismet. Each one sends the answers to another company. Carescale is the only place the entry should go.
5

Block spam without sharing content

Keep Gravity Forms’ honeypot on (it’s on by default), and add a Cloudflare Turnstile field with the Turnstile add-on. Both work without sending the form’s answers anywhere.
6

Keep logging off

Gravity Forms logging writes full entries to a file on the server. Leave it off, and turn it on only briefly while troubleshooting.
7

No ad or analytics pixels on the form

Don’t run advertising or analytics pixels, such as Meta, Google Ads or TikTok, on the form page or its confirmation page. They can send the page’s contents and the visitor’s identity to the ad network. Measure campaigns with the tracking keys Carescale records instead.
8

Get a BAA from your host

Ask your website host for a Business Associate Agreement, and serve the whole site over HTTPS.

​
Ask only what the first call needs

A contact form needs a name, a way to reach the person, who the inquiry is for and an optional message. Admissions staff collect the rest on the call. A “Verify insurance” form may also ask for date of birth, the insurance carrier, the member ID and insurance card photos, but only when:
  • the website host covers the site under a BAA,
  • entries and uploads are deleted after 1 day, and
  • the form is served over HTTPS.
Never ask for a diagnosis, treatment history, medications or substance use on any public form. If the form has a free-text box, keep its prompt general, such as “How can we help?”

​
Uploaded files

Gravity Forms saves uploads at public addresses on your site until retention deletes them. Anyone with the address can open the file. Carescale downloads each file within the hour and keeps its own copy on the lead, so 1-day retention is safe.